5.7.322: destination certificate expired (DANE)

What it means

Under DANE the receiving server must present a valid X.509 certificate that has not expired. Here DNSSEC validation passed, the connection opened, and the certificate the server offered was past its expiry date. Exchange Online will not deliver over a connection it cannot trust, so it holds the message (4.7.322) and later returns it (5.7.322). Certificates have to be renewed when they expire, most often every year, and this error is often the first sign that a renewal was missed on a mail server.

Common causes

• The certificate on the receiving server expired and was not renewed.
• A renewed certificate was obtained but never installed on the mail server.

How to fix it

1. 01Tell the recipient's admin.
2. 02The destination admin should install a current certificate on every MX host.
3. 03If the TLSA records pin the old certificate or key, publish TLSA records for the replacement before or alongside the change.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

• Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
• How SMTP DNS-based Authentication of Named Entities (DANE) workslearn.microsoft.com