Microsoft SMTP TLS error
Outlook 5.7.321: starttls-not-supported: Destination mail server must support TLS to receive mail
Microsoft uses 5.7.321 when the destination mail server must support TLS but does not advertise or complete STARTTLS. The destination MX or gateway operator owns the repair.
The NDR reports:
550 5.7.321 starttls-not-supported: Destination mail server must support TLS to receive mail.
The 5.x.x result is permanent under the required-TLS policy. Correct STARTTLS support before sending a new message.
Probable causes
- The destination server does not advertise STARTTLS on port 25.
- A firewall, proxy, or inspection device strips the capability.
- The SMTP TLS service is disabled or misbound.
- MX points to a legacy or unintended gateway.
How to fix it
- Identify the exact MX host Microsoft tried.
- Test its port 25 EHLO response from an authorized network.
- Enable STARTTLS and a suitable certificate on the receiving service.
- Check firewalls and proxies for SMTP capability modification.
- Retest every MX target before requesting a new delivery.
Frequently asked questions
What does Microsoft 5.7.321 mean?
The destination mail server must support TLS but did not support STARTTLS for the delivery.
Is this the same as port 465?
No. Server-to-server mail normally negotiates STARTTLS on SMTP port 25; implicit TLS submission on port 465 is a different service.
Does MailFixIt currently probe STARTTLS?
No. The asynchronous SMTP/TLS worker is deferred, so this page provides manual guidance only.
Related email diagnostics
Outlook 5.7.322: certificate-expired: Destination mail server's certificate is expiredFix Microsoft 365 5.7.322 when the destination mail server presents an expired SMTP TLS certificate.
Gmail 550 5.7.29: This message was blocked because it wasn't sent over a TLS connectionFix Gmail 550 5.7.29 by restoring TLS on the final SMTP connection to Gmail.
Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways.
Primary sources: Microsoft Exchange Online NDR reference, RFC 3207 SMTP STARTTLS.