@Keltounet @mwl Yeah, I've had some annoying issues with MTA-STS on my personal server in the past too, related to the use of CNAMEs: https://thomasp.vivaldi.net/2020/11/22/adventures-with-mta-sts/
@Keltounet That said, this current issue is not a problem with MTA-STS itself. If we were using another method to verify that a TLS connection should be used, it would still fail, because the TLS connection itself is at fault here.
@thomasp I agree for this specific issue, just that more failure points is not very good.