Just pointing out that MTA-STS doesn’t mitigate downgrade attacks and that DNSSEC/DANE does: https://www.rfc-editor.org/rfc/rfc7672.html#section-1.3.1

And right from the MTA-STS RFC: https://www.rfc-editor.org/rfc/rfc8461.html#section-2

the mechanism described here instead relies on certification authorities (CAs) and does not require DNSSEC, at a cost of risking malicious downgrades.

So there’s that.