Microsoft DANE transport error
Fix Outlook 5.7.323 DANE/TLSA validation failure
Microsoft uses 5.7.323 when the destination domain's DNSSEC-authenticated TLSA data does not validate the SMTP certificate. Coordinate DNSSEC, TLSA, and certificate deployment as one change.
The NDR reports:
550 5.7.323 tlsa-invalid: The domain failed DANE validation.
The delivery fails permanently while authenticated TLSA and the presented certificate disagree.
Probable causes
- TLSA data still references a previous certificate or key.
- The new certificate reached only some MX hosts.
- TLSA usage, selector, or matching type is wrong.
- The certificate start date is in the future or another DANE check fails.
Safe resolution
- Validate the DNSSEC chain and read authentic TLSA records.
- Inspect the certificate presented by every MX endpoint.
- Calculate the configured TLSA association against that certificate/key.
- Roll certificate and TLSA changes in the correct overlap sequence.
- Retest DNSSEC and SMTP before new delivery.
Frequently asked questions
What does Microsoft 5.7.323 mean?
DANE validation failed because the authentic TLSA data and presented SMTP certificate did not produce a valid result.
Can I simply delete the TLSA record?
Only as an intentionally reviewed change to the domain's transport policy. First determine whether the certificate or TLSA deployment is stale or wrong.
Does MailFixIt validate DANE?
No. The current checker does not perform DNSSEC-authenticated TLSA and live SMTP certificate validation.
Related email diagnostics
Primary sources: Microsoft Exchange Online NDR reference and RFC 7672 SMTP Security via DANE.