Enhanced Status Code 5.7.322: Destination Certificate Expired
Enhanced Status Code 5.7.322 means “Destination Certificate Expired.” The receiving server presented an expired TLS certificate and enforcement refused to proceed. Nothing at your end caused it and nothing at your end can fix it.
550 5.7.322 certificate-expired: Destination mail server's certificate is expiredWhat does 5.7.322 mean?
Microsoft returns 5.7.322 with the text certificate-expired, meaning the destination mail server presented a certificate whose validity period has passed. Exchange Online defers with 4.7.322 during its retry window and escalates to 5.7.322 afterwards.
Certificate expiry is the most predictable failure in email infrastructure and still one of the most common. A certificate that was valid yesterday stops being valid at a fixed moment, and where MTA-STS or DANE is enforced there is no tolerance and no downgrade. Mail that flowed normally stops abruptly with no change at either end other than the passage of time.
Because the fault is entirely at the destination, the sender's job is to notice and to tell them. Many organisations discover their own expired mail certificate only when a sender reports it, since their inbound mail simply stops arriving and there is no bounce on their side to see. The recipient address remains valid throughout, and delivery resumes as soon as the certificate is renewed.
How 5.7.322 plays out
5.7.322 rejectionWhere 5.7.322 sits: soft vs hard bounce
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| SMTP class | 4xx | 5xx |
| What to do | Let it retry | Suppress the address |
| Recoverable? | Often | No |
| 5.7.322 is | ✓ this code |
What each provider means by 5.7.322
A registered code does not oblige a provider to use it that way, and the large ones diverge. Match the wording in your own bounce, not the definition above.
Common causes of 5.7.322
- The certificate on the destination mail server has passed its expiry date
- An automated renewal at the destination failed silently
- A renewed certificate was issued but never deployed to the mail server
- One host in a multi-host MX set has an expired certificate while others are current
- A load balancer or TLS terminator at the destination holds the stale certificate
- The destination enforces MTA-STS or DANE, so expiry cannot be tolerated
How to fix 5.7.322
- Do not suppress the recipient, since the address is valid and will work again on renewal
- Tell the receiving organisation, as they frequently do not know
- Confirm the expiry date with openssl s_client -starttls smtp and read notAfter
- Check every host in their MX set, since only one may be affected
- Retry after they confirm renewal rather than waiting for a queue lifetime
- Monitor your own certificates so you never cause the same failure outbound