What is MTA-STS?
MTA-STS (RFC 8461) lets a domain tell sending servers to deliver its mail only over TLS, with a valid certificate, to MX hosts it names. It has two parts: a TXT record at _mta-sts.yourdomain carrying a policy id, and a policy file served over https at mta-sts.yourdomain/.well-known/mta-sts.txt.
Reading the result
The tool reads the record, then fetches the policy file. You see the id, the mode (enforce, testing or none), the MX patterns the policy authorises and max_age, which is how long senders may cache it. A record whose policy file cannot be fetched is reported as a failure.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
Common MTA-STS problems
A policy file that cannot be fetched
The file must be served over https from mta-sts.yourdomain with a valid certificate for that name. A missing subdomain, a 404 or a bad certificate leaves the record pointing at nothing.
Mode set to testing
Senders report TLS problems to the address in your TLS-RPT record (RFC 8460) and deliver anyway. Testing is where to start, and it protects nothing until you switch to enforce.
An MX the policy does not list
In enforce mode, senders refuse to deliver to an MX host that matches none of the policy's mx: lines. Changing mail provider without updating the policy stops inbound mail.
A changed policy with the same id
Senders cache the policy and fetch it again only when the id in the TXT record changes. Edit the file without changing the id and they keep using the old one until max_age runs out.