5.7.5: destination certificate fails MTA-STS
Exchange Online stopped delivery because the receiving server's TLS certificate does not satisfy the destination domain's MTA-STS policy.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 5.7.5
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The recipient's side. Their mail admin has to change something; you can tell them.
- What the server says
5.7.5 Remote certificate failed MTA-STS validation. Reason: <validityStatus>
What it means
When a destination domain enforces MTA-STS, Exchange Online checks the certificate the receiving server presents. The certificate must chain to a trusted root certificate authority, and its common name or subject alternative names must include the host name listed in the policy. If either check fails, the service refuses to hand the message over and gives the reason in the reply. Microsoft lists the error as 4.7.5 while retrying and 5.7.5 once it gives up. The fault is on the receiving side.
Common causes
- The receiving server presents a self-signed certificate or one from an authority that is not publicly trusted.
- The certificate does not name the MX host that the policy lists.
- The server sends only its own certificate, so the chain to a trusted root cannot be built.
How to fix it
- 01Tell the recipient's admin and pass on the Reason value from the report, which names the failed check.
- 02The destination admin should install a certificate from a public authority that covers every MX host name in the policy.
- 03Configure the receiving server to send the full certificate chain, then test delivery again.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
- Enhance mail flow with MTA-STSlearn.microsoft.com
Related codes
- 5.4.8Destination MX not covered by its MTA-STS policy.Exchange Online did not deliver because the receiving MX host is missing from the destination domain's MTA-STS policy.
- 450 4.4.317Remote server sends an incomplete certificate chain.During the TLS handshake the other server sent only its own certificate, and Exchange Online could not verify it against a trusted root.
- 5.7.5Cryptographic failure.A system that was authorised to check or decrypt the message could not do it, because a key or other required information was missing or invalid.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce