Check if your domain enforces email transport encryption with MTA-STS and receives TLS failure reports via TLS-RPT.
MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending servers that your domain requires TLS encryption for email delivery. Without it, emails can be downgraded to unencrypted connections via man-in-the-middle attacks.
TLS-RPT (TLS Reporting) sends you reports when other servers fail to establish TLS connections to your mail server. It's the TLS equivalent of DMARC aggregate reports.