Your provider is on the hook for properly configuring TLS on their mail server, but you still need to publish an MTA-STS policy saying who your provider is. Un

Your provider is on the hook for properly configuring TLS on their mail server, but you still need to publish an MTA-STS policy saying who your provider is. Unless your provider provides MTA-STS endpoints that you can CNAME your _mta-sts and mta-sts subdomains to. I haven't seen anyone do this yet.