Good rollout coverage. One limit worth stating next to the threat table: MTA-STS is trust on first use. A sender only enforces your policy after it has fetched and cached it over HTTPS, so an attacker who can block that first fetch, or the refresh after the cache expires, can still force a downgrade. That is why a longer max_age helps once you are confident in enforce mode, and it is the main practical difference from DANE, which anchors trust in DNSSEC instead. A line on that in the FAQ would make the Is MTA-STS the same as DANE answer more complete.