Microsoft DANE transport error
Outlook 550 5.7.323: tlsa-invalid: The domain failed DANE validation
Microsoft found an authentic TLSA record, but the destination MX certificate did not satisfy it. The recipient's mail and DNS operators own the fix.
The Microsoft response contains:
550 5.7.323 tlsa-invalid: The domain failed DANE validation.
A 550 response is permanent for this attempt. New delivery will fail until the destination's DANE configuration is consistent.
Fix the recipient’s DANE configuration
- Read the destination MX records and DNSSEC-authenticated TLSA records.
- Connect to every MX hostname and save the certificate each one presents.
- Check each certificate against the TLSA usage, selector, and matching type.
- Replace stale certificates or TLSA data. During a planned rollover, publish enough overlap for old and new keys or certificates.
- Wait for DNS caches to expire, then retest every MX endpoint before new delivery.
If you are the sender, give the complete NDR to the recipient’s email administrator. Changing the sender’s SPF, DKIM, or DMARC cannot repair destination DANE.
Frequently asked questions
Who should fix Outlook 550 5.7.323?
The administrator of the recipient domain must reconcile its DNSSEC, TLSA records, and SMTP certificates. A sender normally cannot fix it.
Should I delete the TLSA record?
Not as a shortcut. First correct the stale certificate or TLSA data. Removing DANE should be a deliberate security-policy change.
Related email diagnostics
Primary sources: Microsoft Exchange Online NDR reference, Microsoft: How SMTP DANE works, RFC 7672: SMTP Security via DANE.