DANE / TLSA

DANE pins your mail server's certificate in DNS, so a sender can tell the real host from a substituted one. It rests entirely on DNSSEC — without a signed zone, a TLSA record protects nothing at all.

Try ietf.org, nlnetlabs.nl or posteo.de