In more detail
A domain publishes a DNS TXT record at _mta-sts that signals a policy exists, and serves the policy as a text file over HTTPS at /.well-known/mta-sts.txt on the host mta-sts.<domain>. The policy lists the allowed MX hosts, a mode (testing, enforce or none) and a max_age in seconds. Senders that support it fetch and cache the policy, and in enforce mode they refuse to deliver if TLS fails or the certificate does not match the MX host.
Why it matters
Ordinary SMTP encryption (STARTTLS) is opportunistic and can be stripped by an attacker on the network path. MTA-STS closes that downgrade gap for mail sent to your domain, and the companion TLS-RPT record reports failures. Create the files and records with the MTA-STS Policy Generator.
Example
_mta-sts.example.com. TXT "v=STSv1; id=20261028T000000Z"
version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800