5.7.325: certificate name does not match the MX host (DANE)
The receiving server's certificate does not name the destination domain or its MX host, so Exchange Online would not deliver under DANE.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 5.7.325
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The recipient's side. Their mail admin has to change something; you can tell them.
- What the server says
5.7.325 certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name…
What it means
When Exchange Online delivers under DANE, it also checks the names in the receiving server's certificate. At least one of its common name or subject alternative names must match the recipient domain or the MX host it connected to. When none do, the service treats the certificate as belonging to some other server and stops. Microsoft lists the error as 4.7.325 and 5.7.325. It typically follows a move to new mail hosts, or a certificate issued for the wrong names.
Common causes
- The certificate was issued for a different host name than the one in the MX record.
- The MX record now points to a new server that presents a certificate for another name.
How to fix it
- 01Tell the recipient's admin.
- 02The destination admin should install a certificate whose subject alternative names include every MX host name.
- 03After replacing the certificate, check that the TLSA records still match it.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
- How SMTP DNS-based Authentication of Named Entities (DANE) workslearn.microsoft.com
Related codes
- 5.7.321Destination server does not offer TLS (DANE).Exchange Online needed TLS for this domain under DANE, but the receiving server did not answer STARTTLS or the handshake failed.
- 5.7.323Certificate does not match the TLSA record (DANE).The destination's DNSSEC-signed TLSA records do not match the certificate its server presented, so Exchange Online treated delivery as unsafe.
All 111 Microsoft codesEvery code in the wikiPaste your own bounce