Two parts: a DNS TXT record at _mta-sts.example.com (v=STSv1; id=20261020) that signals a policy and its version, and a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt with version: STSv1, mode: enforce, testing or none, one or more mx: patterns and max_age in seconds. Sending servers cache the policy and refuse to deliver to MX hosts that fail certificate validation.
Deploy in testing mode with TLS reporting first: TLS-RPT (RFC 8460, a TXT record at _smtp._tls.example.com such as v=TLSRPTv1; rua=mailto:tls@example.com) sends daily JSON reports of failures. Changing MX hosts requires updating the policy and its id before switching. Unlike DANE, MTA-STS needs no DNSSEC but trusts the first fetch of the policy.