5.7.323: certificate does not match the TLSA record (DANE)

What it means

TLSA records tell a sender which certificate or key to expect from a domain's mail server. Exchange Online found the records properly signed with DNSSEC but could not reconcile them with what the server presented: the certificate does not match, the record itself is misconfigured, the certificate's start date is in the future, or another DANE check failed. Microsoft also lists an attack on the destination domain as a possible cause. Delivery waits (4.7.323) and then fails (5.7.323) until the destination fixes the mismatch.

Common causes

• The certificate was replaced without updating the TLSA records.
• The TLSA record is misconfigured, for example with the wrong usage, selector or hash.
• The certificate's start date is still in the future.
• Someone is interfering with connections to the destination.

How to fix it

1. 01Tell the recipient's admin and include the full error text.
2. 02The destination admin should regenerate the TLSA records from the certificate or key actually in use on each MX host.
3. 03When rotating certificates, publish TLSA records for the new certificate before switching, and remove the old ones only afterwards.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

• Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
• How SMTP DNS-based Authentication of Named Entities (DANE) workslearn.microsoft.com