MTA-STS TXT record must comply with RFC8461 MTA STS is malformed.
If you are getting a lot of suspicious phishing emails despite setting up DKIM and SPM, you can verify your domain's email delivery strength by going to Google Workspace's Toolbox
https://toolbox.googleapps.com/apps/checkmx/check
1. Enter your domain name
2. You will see a list of all the issues with your domain
One of the issues that could lead to "MTA-STS TXT record must comply with RFC8461 MTA STS is malformed." is a lack of MTA-STS and TLS reporting in your DNS entries.