Most common causes
- The destination SMTP certificate passed its validity end date
- A gateway still presents an old certificate after renewal
- Different MX hosts present inconsistent certificate versions
- TLS policy enforcement exposed a certificate lifecycle failure
What to verify next
- Run Mail Transport Security for every destination MX host
- Inspect the certificate validity window and SMTP hostname
- Check whether all gateway nodes received the renewed certificate
- Retest after the destination presents a current certificate
Best diagnostic path
Live analysis
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisMail Transport Security
Inspect MX, TLS, MTA-STS and transport-policy evidence for the destination.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft Exchange Online NDR reference.