MTA-STS is published via a DNS TXT record plus an HTTPS-hosted policy file, and tells sending mail servers that support it to refuse delivery over plaintext SMTP or with an invalid certificate. Without it, opportunistic TLS silently falls back to plaintext if a connection is interfered with.
It protects mail in transit between servers, which is a different concern from SPF/DKIM/DMARC (message authenticity) or end-to-end encryption (message confidentiality from sender to reading client). All three are complementary, not substitutes for each other.
MTA-STS enforcement is opt-in per receiving domain and only affects senders that check for and honor the policy; it doesn't retroactively secure connections to domains that haven't published one.