Microsoft 365 5.4.8: “MX hosts of the domain failed MTA-STS validation”

Short answer: Microsoft 365 refused to deliver because the recipient domain's MTA-STS policy (mode: enforce) doesn't list the MX host the domain actually uses. The fix is on the recipient's side: add the MX host to the policy's mx: lines (or switch it to testing), then change the policy id.

5.4.8 MX hosts of 'contoso.com' failed MTA-STS validation

What it means

Exchange Online checks the MTA-STS policy of every domain it sends to. When the policy is in enforce mode and the recipient's live MX host isn't covered by any mx: line, Microsoft returns this NDR instead of delivering. Typical causes: the domain moved its MX (for example to Microsoft's new *.mx.microsoft hosts, or to a new mail filter) without updating the policy, or the policy uses a wildcard that covers the wrong number of labels (*.mx.microsoft doesn't match contoso-com.o-v1.mx.microsoft).

How to fix it

1. If it's your domain that people can't reach: open https://mta-sts.yourdomain/.well-known/mta-sts.txt and compare its mx: lines with your MX records – run the checker below, it does this the way senders do.
2. Add every MX host you use (exact name, or a wildcard that covers exactly one label), or set mode: testing while you fix it.
3. Change the id= in your _mta-sts TXT record so senders fetch the new policy; until then they keep the cached one for up to max_age.
4. If you're the sender: forward the bounce to the recipient's IT – only they can fix their policy. More: the mx.microsoft trap.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Other bounce errors

• Gmail 550 5.7.26
• Gmail 421 4.7.26
• Gmail 550 5.7.27 / 421 4.7.27
• Gmail 550 5.7.30 / 421 4.7.30
• Gmail 550 5.7.32 / 421 4.7.32
• Gmail 550 5.7.40 / 421 4.7.40
• Gmail 550 5.7.24 / 421 4.7.24
• Gmail 550 5.7.25 / 421 4.7.23
• Gmail 550 5.7.29 / 421 4.7.29
• Outlook / Hotmail 550 5.7.515
• Outlook / Hotmail 550 5.7.1 S3150 / S3140
• Microsoft 365 550 5.7.606 / 5.7.511
• Microsoft 365 / Outlook 550 5.7.509
• Outlook / Hotmail 451 4.7.650 (S775)
• Yahoo / AOL 421 4.7.0 [TSS04]
• Yahoo / AOL 553 5.7.1 [BL21] / [BL23]
• Yahoo / AOL 554 5.7.9
• Gmail 421 4.7.28
• Microsoft 365 550 5.7.708
• Microsoft 365 535 5.7.139 / 530 5.7.57
• Microsoft 365 550 5.7.233 / 5.7.232
• Microsoft 365 550 5.7.236
• Microsoft 365 / Outlook 550 5.7.520
• Microsoft 365 550 5.1.8
• Gmail 550 5.7.1 / 421 4.7.0
• Gmail 550 5.7.1 / 421 4.7.0
• Gmail / Google Workspace 550 5.4.5
• Gmail / Yahoo / iCloud 550 5.7.26 / 554 5.7.9 / 554 5.7.1 [BS01]
• Validity Heatwave domain blocklist
• Microsoft 365 5.7.5