Check your domain's MTA-STS DNS record and policy file.
MTA-STS (RFC 8461) lets a domain declare it accepts secure TLS connections and refuse delivery if TLS fails.
Two elements required: a DNS TXT at _mta-sts.yourdomain.com and an HTTPS policy file at mta-sts.yourdomain.com.
The policy file specifies mode (enforce or testing), MX hosts and cache duration (max_age). Start with testing.
MTA-STS is a pillar of email security. Sender Audit checks MTA-STS, TLS-RPT, DANE and all protocols.
Start a free audit