As far as I recall nothing in the certification requires you to create any CNAME records. For mail you do need an MX record (or  multiple).

You are going to need:
1. An MX record for your domain listing the hostname of the mail server.
2. A AAAA record mapping the hostname of the mail server to an IPv6 address.
3. For the next stage of the test, a PTR record mapping the IPv6 address of the mail server back to the hostname.

I think the test is supposed to work as long as at least one of the MX records point to a hostname that has at least one AAAA record. If you have multiple MX records for your domain, it is acceptable to have some of them be IPv4 only.

If the hostname of your mail server is within the same domain, then the MX and AAAA records can both be setup in the same place. The PTR record for the next stage of the test depends on your provider of IPv6 connectivity. If you happen to be using a tunnel through HE for IPv6 access, there is a webinterface to configure the PTR record.

how long ago did you create the records?

What you have created is an absolute name, not a relative name. Since mailbox is not a valid TLD, that is not going to work. If the interface does not allow you to type in a relative address, then you'll just have to type in the full name yourself, which I guess you intended to be mailbox.learningipv6.mooo.com.

Additionally your mailserver is not actually working. It can complete a TCP handshake, but after completing the handshake it does not present the banner it is supposed to, instead it just closes the connection.

Looks like you updated the mx record already.

When you connect to the SMTP port, the server is supposed to reply with status code 220 and a human readable text. Yours would just drop the connection after a fraction of a second without ever saying anything.

Right now it however looks like your tunnel is down, so I cannot connect to your mailserver anymore.

Your DNS records look correct, but 2001:470:4:b7f::2 is not online. So check that you even have IPv6 connectivity at the moment. Did you bring down your tunnel endpoint, or did you perhaps get a new IPv4 address for the tunnel endpoint without updating the tunnel configuration?