Certs for MX servers are supposed to have the MX as subject or SAN, not your email domain. It's important when the sender enforces encryption with a valid cert (e.g. MTA-STS, or config in the mail server, or many hosted solutions like Google Workspace also support enforcing this for selected or all domains).

Example:

example.com. MX aspmx.l.google.com.

Cert should have aspmx.l.google.com as subject or SAN.