Skip to content
notspoofed.comSPF · DKIM · DMARC

TLS and DANE validation bounces

By · Published

Soft bounceThe recipient's problemMicrosoft 365 / Exchange Online

The error

451 4.7.321 starttls-not-supported: Destination mail server must support TLS to receive mail

451 4.7.322 certificate-expired: Destination mail server's certificate is expired

451 4.7.323 tlsa-invalid: The domain failed DANE validation

What it means

Microsoft would not deliver because the destination’s TLS setup failed validation — no STARTTLS, an expired certificate, a hostname mismatch, or a failing DANE or DNSSEC record.

Nothing is wrong at your end. The recipient or their mail provider has to act, and there is usually nothing you can do but stop sending.

Why it happens

These appear when the recipient domain publishes MTA-STS or DANE and then lets its certificate or DNSSEC records lapse. The sender sees the bounce, but the fault and the fix are entirely at the receiving end.

How to fix it

  1. Read which of the five conditions the bounce names — they have different owners.
  2. Tell the recipient: only they can renew the certificate or repair the DANE or DNSSEC records.
  3. Nothing in your own configuration will work around this, and it should not be worked around.

Related guides

  • Microsoft 5.4.1: relay access denied — Microsoft returns 5.4.1 for two different situations: the recipient address does not exist in the destination tenant, or the receiving system does not accept mail for that domain at all.
  • Microsoft 5.7.23: SPF violation — The receiving Microsoft system checked your SPF record and the sending IP was not authorised by it.
  • Microsoft 5.7.606: banned sending IP — Microsoft has blocklisted the IP you are sending from. The codes 5.7.606 through 5.7.649 all mean the same thing; the varying number identifies which internal list caught it.