Microsoft SMTP TLS error

Fix Outlook 5.7.321 STARTTLS not supported

Microsoft uses 5.7.321 when the destination mail server must support TLS but does not advertise or complete STARTTLS. The destination MX or gateway operator owns the repair.

Problem description

The NDR reports:

550 5.7.321 starttls-not-supported: Destination mail server must support TLS to receive mail.

Diagnostic availability: MailFixIt does not currently connect to destination SMTP services. This manual page does not imply a live transport test.

Is this temporary or permanent?

The 5.x.x result is permanent under the required-TLS policy. Correct STARTTLS support before sending a new message.

Probable causes

The destination server does not advertise STARTTLS on port 25.
A firewall, proxy, or inspection device strips the capability.
The SMTP TLS service is disabled or misbound.
MX points to a legacy or unintended gateway.

How to fix it

Identify the exact MX host Microsoft tried.
Test its port 25 EHLO response from an authorized network.
Enable STARTTLS and a suitable certificate on the receiving service.
Check firewalls and proxies for SMTP capability modification.
Retest every MX target before requesting a new delivery.

Frequently asked questions

What does Microsoft 5.7.321 mean?

The destination mail server must support TLS but did not support STARTTLS for the delivery.

Is this the same as port 465?

No. Server-to-server mail normally negotiates STARTTLS on SMTP port 25; implicit TLS submission on port 465 is a different service.

Does MailFixIt currently probe STARTTLS?

No. The asynchronous SMTP/TLS worker is deferred, so this page provides manual guidance only.

Related email diagnostics

Primary sources: Microsoft Exchange Online NDR reference and RFC 3207 SMTP STARTTLS.