What the message looks like
Server certificate not verified4.7.5 Remote certificate failed MTA-STS validation4.7.322 certificate-expired: Destination mail server's certificate is expired
What it means
The sending server wanted an encrypted, verified connection to the recipient's mail server, but the receiving server's TLS certificate couldn't be verified. Rather than send the email without that protection, the sending server stopped and will try again later. The standard name for this status is "cryptographic failure".
This usually happens when the recipient's domain says its mail must always be encrypted and verified, using MTA-STS or DANE, but its mail server's certificate doesn't match. Microsoft 365 reports these with more specific codes, such as 4.4.8 for an MTA-STS failure and 4.7.321 to 4.7.325 for TLS and DANE problems.
Common causes
- The receiving mail server's certificate has expired.
- The certificate doesn't cover the mail server's hostname.
- The certificate is self-signed, or missing part of its chain.
- The domain's MTA-STS policy or DANE (TLSA) records list the wrong mail server or certificate.
If you're the recipient
If it's your own domain, check the certificate on your mail server, and that your MTA-STS policy or TLSA records match your current mail server and certificate. Renewing an expired certificate usually fixes it, and emails still being retried are then delivered.
If you're the sender
Let your server keep retrying, and let the recipient know their mail server's certificate has a problem if you can reach them another way. Don't turn off certificate checks to force it through, as that defeats the protection the domain asked for.
If you use addy.io
If this appears on your Failed Deliveries page, the mail server for your recipient address has a certificate problem. addy.io keeps retrying for a while. If you run that mail server, fix its certificate. Otherwise contact your email provider, or add a different recipient.