How do I implement MTA-STS?

You must:

Configure server side TLS by ensuring all your inbound mail servers listed in your MX records already support TLS 1.2 or higher with a valid trusted certificate.

Create the HTTPS endpoint.

Publish the policy file.

Add the DNS TXT record.

Set the mode to testing first.

Monitor TLS reports.

Then move to enforce.