MTA-STS tells sending mail servers to only deliver to your domain over TLS, blocking downgrade attacks. It needs a DNS record AND a policy file served over HTTPS.
This tool is a one-shot check. PhishFence watches your domain 24/7 for DMARC changes, new lookalike registrations, and spoofing attempts.