Postfix and Exim both support DANE/TLSA. When I email somebody with TLSA set up, or they email me, the certificates are validated using DNSSEC signed DNS records:

  mike@snake:~$ dig +short mx grepular.com
  20 mail.grepular.com.
  10 mx1.grepular.com.
  mike@snake:~$ dig +short tlsa _25._tcp.mx1.grepular.com
  2 1 1 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18
  2 1 1 B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B
  mike@snake:~$ dig +short tlsa _25._tcp.mail.grepular.com
  2 1 1 B111DD8A1C2091A89BD4FD60C57F0716CCE50FEEFF8137CDBEE0326E 02CF362B
  2 1 1 60B87575447DCBA2A36B7D11AC09FB24A9DB406FEE12D2CC90180517 616E8A18
  mike@snake:~$