Add _mta-sts to labels allowed to have an underscore (#617)

Although _mta-sts is normally used with a TXT record it can
also be used with a CNAME record to delegate the authority.

See sections 3.1 and 8.2 of RFC8461 for details.

pkg/normalize/validate.go

@@ -92,6 +92,7 @@ var labelUnderscores = []string{
 	"_dmarc",
 	"_domainkey",
 	"_jabber",
+	"_mta-sts",
 	"_sip",
 	"_xmpp",
 }