Microsoft 365 5.7.5: “Remote certificate failed MTA-STS validation”

Short answer: Microsoft 365 refused to deliver because the recipient's mail server certificate failed the MTA-STS check: it doesn't chain to a trusted root CA, or its name doesn't match the MX host in the policy. The recipient has to fix the certificate (or set the policy to testing).

The bounce looks like this
5.7.5 Remote certificate failed MTA-STS validation. Reason: {validityStatus}

What it means

With an MTA-STS policy in enforce mode, the receiving mail server must present a certificate that chains to a trusted public CA and whose Common Name or Subject Alternative Name matches the MX host named in the policy. Self-signed, expired or wrong-name certificates on the MX make Exchange Online refuse delivery with this NDR.

How to fix it

  1. If it's your domain: check the certificate on each MX host (expiry, chain, the names it covers).
  2. Renew or replace it with one from a public CA that covers the exact MX hostname; automate renewal (certificate lifetimes shrink to 200 days in 2026 and 100 days in 2027 – details).
  3. While you fix it, set the policy to mode: testing and change the policy id so mail flows again.
  4. If you're the sender: forward the bounce to the recipient's IT.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other bounce errors