5.7.324: destination DNSSEC does not validate

What it means

DANE depends on DNSSEC: TLSA records are only trusted if the DNS answers that carry them validate. Here the destination indicated that its zone is DNSSEC-signed, yet Exchange Online could not verify it as authentic. A broken chain of trust commonly comes from expired signatures, or from a DS record at the parent zone that no longer matches the zone's keys after a key rollover or a change of DNS host. Microsoft's DANE page shows the temporary form as 450 4.7.324; the permanent form is 5.7.324. The domain owner or its DNS host has to repair DNSSEC.

Common causes

• Signatures in the destination zone have expired.
• The DS record at the parent zone no longer matches the zone's signing key, often after a key rollover or a change of DNS host.
• The destination's DNS servers answer the TLSA query with SERVFAIL instead of NOERROR or NXDOMAIN, which Microsoft also reports as this error.

How to fix it

1. 01Tell the recipient's admin.
2. 02The destination should test its zone with a DNSSEC analyzer and fix the reported break in the chain of trust.
3. 03If DNSSEC cannot be repaired quickly, the domain owner can remove the DS record at the registrar to turn DNSSEC off cleanly, which also disables DANE.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

• Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
• How SMTP DNS-based Authentication of Named Entities (DANE) workslearn.microsoft.com