TLS-RPT (RFC 8460) is a daily report from the servers that tried to deliver to you. When a relay quietly stops negotiating encryption, the report names the host, the day and the count, instead of leaving it to be noticed.
The scan needs no account. Plans start at 12 €/mo with a 14-day trial.
MTA-STS refuses connections that cannot encrypt. Before you turn that on, you want to know which of your legitimate partners would be refused, and TLS-RPT is the only thing that tells you.
Expired certificates, mismatched hostnames, self-signed chains, STARTTLS that never completed. Each is reported as what it is, against the host it happened to.
Reports arrive while your MTA-STS policy is still in testing mode, so the decision to enforce is made against evidence rather than hope.
Reports arrive as compressed JSON from every major provider. They are parsed, attributed to a domain and a day, and kept for as long as your plan retains them.