Pro move: type dmarc:yourdomain.com or blacklist:1.2.3.4 straight into the box — it switches tools for you.
About this tool. MTA-STS tells sending servers they must use verified TLS when delivering to you, blocking downgrade and man-in-the-middle attacks. It needs both a DNS record and a policy file — this check validates the pair together.