STARTTLS check

Unlike the DNS-only checks, this one opens an actual SMTP connection to the domain's MX server, issues STARTTLS, and validates the resulting certificate (hostname match, expiry, chain of trust). This confirms mail delivered to your domain can be encrypted in transit — the receiving-side complement to the sending-side guarantees SPF/DKIM/DMARC provide.