MTA-STS Checker

Check that a domain publishes an MTA-STS policy enforcing TLS for inbound mail. Fetches the DNS TXT record at _mta-sts and the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt, then parses the mode, MX patterns, and max_age. Partial results are shown when the DNS record is present but the policy file is unreachable, so you can diagnose the broken half.