MailFixIt

Microsoft SMTP certificate identity error

Outlook 5.7.325: certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name matching the hostname (DANE)

The certificate presented by a recipient MX server does not identify the hostname Microsoft expected. The recipient's mail operator owns the fix.

Problem description

The Microsoft response contains:

5.7.325 certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name matching the hostname (DANE)
Is this temporary or permanent?

A 5.7.325 result is permanent for this delivery. New attempts will fail until the destination certificate and hostname agree.

Fix the destination certificate

  1. Save the full NDR and identify the destination MX hostname.
  2. Connect to every address for that MX host and inspect the certificate presented after STARTTLS.
  3. Check that a current CN or SAN matches the hostname Microsoft validates.
  4. Replace any default, expired, or wrong certificate and include the required chain.
  5. Confirm that all load balancers and MX servers present the corrected certificate.
  6. Retest each MX hostname and address family before new delivery.

If you are the sender, give the full NDR to the recipient’s administrator. SPF, DKIM, and DMARC changes cannot repair the recipient’s SMTP certificate.

Frequently asked questions

Who can fix Outlook 5.7.325?

The administrator of the recipient mail servers must install the correct certificate on every affected SMTP endpoint. A sender normally cannot fix it.

Should the certificate identify the bare email domain?

It must identify the hostname required by the transport policy, usually a destination MX hostname. Use the hostname named by the NDR and current MX route.

Related email diagnostics

Outlook 5.7.322: certificate-expired: Destination mail server's certificate is expiredFix Microsoft 365 5.7.322 when the destination mail server presents an expired SMTP TLS certificate. Outlook 550 5.7.323: tlsa-invalid: The domain failed DANE validationFix Outlook 550 5.7.323 by making the recipient MX certificate match its DNSSEC-authenticated TLSA record. Outlook 5.7.321: starttls-not-supported: Destination mail server must support TLS to receive mailFix Microsoft 365 5.7.321 when the destination SMTP server must support STARTTLS but does not advertise or negotiate it.

Primary sources: Microsoft Exchange Online NDR reference, RFC 7672: SMTP Security via DANE.