The TLSA and MTA-STS types, the DANE certificate check, MTA-STS policy parsing and matching, and the DNSSEC lookups with the bogus-answer recheck move out of crates/smtp and crates/common into crates/outbound-tls (RL-30), so inbuxa-relay can deliver with the same code. The server keeps its caches, trace events, policy fetch and test mocks around them; its behavior is unchanged.