Mail server TLS certificate
smtp.tls-certificate
Opportunistic TLS encrypts but does not authenticate. MTA-STS and DANE are what turn it into a real guarantee, and both require the certificate to match the MX hostname.
A longer write-up of this check has not been published yet. The report itself shows the raw evidence behind every result, which is usually the fastest way to see what was measured.
Run this check on a domain
Mail server TLS certificate is one of 49 checks in every report, alongside delegation, mail authentication, TLS and registration.