MTA-STS checker, encrypted mail delivery.

• It looks up the TXT record at _mta-sts.yourdomain: v=STSv1; id=…. No record means no policy.
• It fetches the policy over HTTPS from https://mta-sts.yourdomain/.well-known/mta-sts.txt. The certificate must be valid for that exact name, the answer must be 200 with no redirect, and the file should be text/plain.
• It keeps the policy for max_age seconds (at most 31557600, one year) and fetches it again only when the id in the TXT record changes.
• Before each delivery it checks that the MX host matches an mx: line (*.example.com covers one label, such as mail.example.com) and that the host offers TLS with a valid certificate.

• testing: senders deliver even when TLS fails and send you a report. Safe to start with.
• enforce: senders refuse to deliver unless TLS succeeds. This is the mode that protects mail.
• none: switches the policy off. To remove MTA-STS, publish mode none with a small max_age and a new id, wait until the old max_age has passed, then delete the record and the file.

Add the new provider's mail servers to the mx: lines, then change the id (file first, record second), wait for the old max_age to pass, then switch the MX records. In enforce mode, switching MX first makes senders that cached the old policy refuse your mail.

The last step, the STARTTLS handshake with each mail server on port 25, needs a connection that Cloudflare Workers, where Hivex runs, cannot open. Your TLS reports (_smtp._tls) show any failure there from the senders' side.