5.7.5 Microsoft bounce: mta-sts cert check failed
What 5.7.5 means
The recipient server's TLS certificate did not pass the MTA-STS check, so Exchange Online will not deliver to it.
Message text
Remote certificate failed MTA-STS validation. Reason: <validityStatus>
Common causes of 5.7.5
- Certificate does not chain to a trusted root CA
- Common Name or Subject Alternative Name does not match the host in the MTA-STS policy
How to fix 5.7.5
- Ask the recipient domain's administrator to fix the certificate on its MX host.
- Check the recipient's MX hosts with MX lookup and compare them with its MTA-STS policy.
Check your domain
Check the MX records of the recipient domainRuns in your browser; nothing is uploaded.
Get your domain's deliverability score
Have the full bounce message? Paste it into the bounce code lookup and it will match the code and the provider for you. Open the bounce code lookup.
How to read 5.7.5
The second part, 5.7.5, is an enhanced status code (RFC 3463 §2) written class.subject.detail. Class 5 is a Permanent failure (5xx): the command was rejected and the sender should not repeat it unchanged (RFC 5321 §4.2.1; RFC 3463 §2).. Subject 7 is security or policy: authentication, authorization or policy refused the message. The detail number refines the subject, and providers may define details of their own, which is why one code can read differently at Gmail, Microsoft and Yahoo.
Do not keep resending the same message: a permanent failure repeats until the cause is fixed. Correct the cause, then send a new message.
Official source: learn.microsoft.com. Last verified 2026-10-20.
Related guides
- How to create an SPF record (syntax and examples)
- How DKIM works and how to publish a DKIM record
- How to set up a DMARC record, from p=none to p=reject
Related codes
- 5.7.0 SMTP: security status
- 5.7.1 SMTP: delivery not authorized
- 5.7.23 SMTP: SPF validation failed
- 5.7.25 SMTP: reverse DNS failed
- 5.7.26 SMTP: authentication failed
- 5.7.27 SMTP: sender has null MX
FAQ
What does 5.7.5 mean?
The recipient server's TLS certificate did not pass the MTA-STS check, so Exchange Online will not deliver to it. This is a permanent failure.
How do I fix 5.7.5?
Ask the recipient domain's administrator to fix the certificate on its MX host. Check the recipient's MX hosts with MX lookup and compare them with its MTA-STS policy.
Is 5.7.5 permanent, and should I retry?
5.7.5 is a permanent failure, so retrying the same message will fail again. Fix the cause first, then send a new message.