STARTTLS is opportunistic: an attacker who strips it gets your mail in the clear, and nothing anywhere complains. MTA-STS tells sending servers encryption is mandatory for your domain, so a stripped connection is refused instead of downgraded.
The scan needs no account. Plans start at 12 €/mo with a 14-day trial.
MTA-STS is easy to publish and easy to let rot. The policy has to be served over valid HTTPS at a subdomain you now have to run, and if that certificate expires the enforcement silently stops.
We host the policy at mta-sts.<your domain> over HTTPS, with the certificate issued and renewed by our infrastructure. There is no web server for you to stand up.
The endpoint is probed and its real validity dates recorded. Inside two weeks of expiry the owner is alerted, and the dashboard re-derives expiry at read time so it stays honest even if that service is down.
Policies start in testing mode, where failures are reported rather than acted on. You move to enforce when the reports show your own mail is not the thing being refused.