Check MTA-STS.
MTA-STS makes sending servers encrypt the connection to your mail server and verify its certificate, and TLS-RPT reports failed attempts. I check the record, the policy file and MX coverage.
What to fix, in this order
Nothing to fix in this check.
Before you ask.
Does a store need MTA-STS?
It protects inbound mail from eavesdropping and downgrade attacks. For a small store it is optional; with mail at Google Workspace or Microsoft 365 the provider will not set it up for you, but the risk is small.
Where does the policy file go?
At https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, with a valid certificate for the mta-sts subdomain. The file holds version, mode, the mx list and max_age.
Testing or enforce?
Start with mode: testing plus TLS-RPT, read the reports for a week, then switch to enforce. In enforce, an MX outside the list means rejected mail.
Would you rather have meset it up and watch it?
WooCommerce store support plans from 1,200 PLN net per month, no minimum term. For a 20-minute call I keep two fixed slots: Tuesday and Thursday, 18:00-19:00 CET.