The relay now sends what the downstream hands it: by MX, one domain at a
time, with DANE where the MX and the host's addresses are signed and its
TLSA records are, MTA-STS where the domain enforces a policy, and
otherwise STARTTLS per the new outboundTls setting. Each recipient's
deliveryStatus is the remote server's own reply; retries follow
outboundRetry, and what is still queued at expiresAt is refused with the
last reply. Sessions report outbound.attempt and outbound.tls events, the
latter for TLS-RPT. DNS, DANE and MTA-STS come from crates/outbound-tls.