MTA-STS policy is not enforce
The policy was published with a mode other than enforce, such as testing or none.
Why it matters
Testing reports failures without requiring TLS. none disables the policy.
What to do
Switch mode to enforce after MX hosts present valid certificates.
Reference
MTA-STS lets receiving domains require TLS for inbound email.