MTA-STS and TLS-RPT: The DNS Records Almost Nobody Publishes
Only 0.7 percent of the top million domains publish an MTA-STS policy, and about one in five of those are broken. Here is how STARTTLS silently falls back to plaintext, what the _mta-sts and _smtp._tls records actually do, and the caching trap that quietly breaks both.