Microsoft SMTP certificate identity error
Fix Outlook 5.7.325 certificate hostname mismatch
Microsoft uses 5.7.325 when the destination SMTP certificate identities do not match the required hostname or MX host. Deploy a certificate with the correct subject alternative name on every destination listener.
The NDR reports:
550 5.7.325 certificate-host-mismatch: Remote certificate must match the hostname.
The 5.x.x result remains permanent until certificate identity and destination host agree.
Probable causes
- The certificate covers a web hostname but not the MX hostname.
- A load balancer presents its default certificate.
- One MX node has an old or wrong certificate.
- MX or DANE policy changed without coordinated certificate deployment.
How to fix it
- Identify the exact MX hostname in the failure.
- Inspect the leaf certificate presented after STARTTLS.
- Compare every DNS-ID/SAN with required hostnames.
- Deploy the correct certificate and complete chain to all listeners.
- Retest each MX host and address family.
Frequently asked questions
What does Microsoft 5.7.325 mean?
The destination SMTP certificate's common name or subject alternative names do not match the required hostname or MX host.
Should the certificate cover the email domain?
It must cover the actual SMTP host identity required by the transport policy, which is commonly an MX hostname rather than the bare recipient domain.
Does MailFixIt inspect live SMTP certificates?
No. Live certificate and policy validation remains outside the current checker.
Related email diagnostics
Primary sources: Microsoft Exchange Online NDR reference and RFC 7672 SMTP Security via DANE.