5.4.8: destination MX not covered by its MTA-STS policy
Exchange Online did not deliver because the receiving MX host is missing from the destination domain's MTA-STS policy.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 5.4.8
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The recipient's side. Their mail admin has to change something; you can tell them.
- What the server says
5.4.8 MX hosts of … failed MTA-STS validation
What it means
MTA-STS lets a domain publish which MX hosts may receive its mail and require TLS to them. Exchange Online honours that policy when it sends. If the MX host it is about to use does not appear in the policy, it treats the destination as unverified and stops. Microsoft lists the same wording under 4.4.8, while the service keeps retrying, and 5.4.8, when it gives up. The sender cannot fix it: the destination domain has to bring its MTA-STS policy and its MX records back in line.
Common causes
- The destination changed its MX records without adding the new hosts to its MTA-STS policy file.
- The policy file lists the wrong host names, or a pattern that does not match the MX hosts.
How to fix it
- 01Tell the recipient's admin; the policy is published by their domain, not yours.
- 02The destination admin should compare the mx lines in the policy file at mta-sts.<domain>/.well-known/mta-sts.txt with the domain's MX records.
- 03After correcting the policy, change the id in the _mta-sts TXT record so senders fetch the new version.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
- Enhance mail flow with MTA-STSlearn.microsoft.com
Related codes
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce