Microsoft SMTP certificate error

Outlook 5.7.322: certificate-expired: Destination mail server's certificate is expired

Microsoft uses 5.7.322 when DNSSEC checks pass but the destination mail server presents an expired certificate. Renew and deploy the correct chain on every affected MX listener.

Problem description

The NDR reports:

550 5.7.322 certificate-expired: Destination mail server's certificate is expired.

Diagnostic availability: MailFixIt does not currently probe live MX certificates. Check the SMTP listener directly and do not infer its certificate from HTTPS.

Is this temporary or permanent?

The 5.x.x delivery result is permanent until a currently valid certificate is presented.

What to check

NotBefore and NotAfter dates on the presented leaf certificate.
All MX hosts, IP families, load balancers, and backend listeners.
Complete intermediate chain and trusted root path.
Certificate selection/SNI behavior of the SMTP service.

How to fix it

Identify the destination host from the NDR.
Inspect the certificate presented after STARTTLS.
Renew through the approved CA and deploy the complete chain.
Restart or reload the correct SMTP listener safely.
Verify every MX endpoint before a fresh delivery.

Frequently asked questions

What does Microsoft 5.7.322 mean?

The destination SMTP server presented an expired X.509 certificate.

Is renewing the website certificate enough?

Only if the SMTP service uses that certificate. Verify the certificate actually presented by every MX host.

Can a new certificate still fail?

Yes. It can be untrusted, deployed to the wrong listener, missing intermediates, or not valid for the MX hostname.

Related email diagnostics

Outlook 5.7.321: starttls-not-supported: Destination mail server must support TLS to receive mailFix Microsoft 365 5.7.321 when the destination SMTP server must support STARTTLS but does not advertise or negotiate it. Outlook 5.7.325: certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name matching the hostname (DANE)Fix Outlook 5.7.325 by installing a certificate whose CN or SAN matches the recipient MX hostname on every destination SMTP server. Outlook 550 5.7.323: tlsa-invalid: The domain failed DANE validationFix Outlook 550 5.7.323 by making the recipient MX certificate match its DNSSEC-authenticated TLSA record.

Primary sources: Microsoft Exchange Online NDR reference.