Most common causes
- The destination SMTP service does not advertise STARTTLS
- A gateway or load balancer is terminating SMTP without the expected TLS capability
- The wrong MX target or service endpoint is receiving the connection
- A transport-security policy requires TLS but the destination path cannot negotiate it
What to verify next
- Run Mail Transport Security against the destination domain
- Verify the MX targets and whether each advertises STARTTLS
- Check whether an MTA-STS or connector policy requires encrypted transport
- Inspect recent gateway or certificate configuration changes
Best diagnostic path
Live analysis
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisMail Transport Security
Inspect MX, TLS, MTA-STS and transport-policy evidence for the destination.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft Exchange Online NDR reference.