Microsoft SMTP certificate error

Fix Outlook 5.7.322 expired destination certificate

Microsoft uses 5.7.322 when DNSSEC checks pass but the destination mail server presents an expired certificate. Renew and deploy the correct chain on every affected MX listener.

Problem description

The NDR reports:

550 5.7.322 certificate-expired: Destination mail server's certificate is expired.

Diagnostic availability: MailFixIt does not currently probe live MX certificates. Check the SMTP listener directly and do not infer its certificate from HTTPS.

Is this temporary or permanent?

The 5.x.x delivery result is permanent until a currently valid certificate is presented.

What to check

NotBefore and NotAfter dates on the presented leaf certificate.
All MX hosts, IP families, load balancers, and backend listeners.
Complete intermediate chain and trusted root path.
Certificate selection/SNI behavior of the SMTP service.

How to fix it

Identify the destination host from the NDR.
Inspect the certificate presented after STARTTLS.
Renew through the approved CA and deploy the complete chain.
Restart or reload the correct SMTP listener safely.
Verify every MX endpoint before a fresh delivery.

Frequently asked questions

What does Microsoft 5.7.322 mean?

The destination SMTP server presented an expired X.509 certificate.

Is renewing the website certificate enough?

Only if the SMTP service uses that certificate. Verify the certificate actually presented by every MX host.

Can a new certificate still fail?

Yes. It can be untrusted, deployed to the wrong listener, missing intermediates, or not valid for the MX hostname.

Related email diagnostics

Primary source: Microsoft Exchange Online NDR reference.