5.7.323

Enhanced Status Code 5.7.323: DANE Validation Failed

Permanent failure High severity Security
What it means

Enhanced Status Code 5.7.323 means “DANE Validation Failed.” The destination domain publishes DANE records and the certificate presented did not match them. DANE is stricter than ordinary TLS and offers no fallback.

At a glance
Code5.7.323
Bounce typeHard (permanent)
SeverityHigh
CategorySecurity
What to doSuppress the address; do not retry
What it looks like in your mail logs 
550 5.7.323 tlsa-invalid: The domain failed DANE validation

What does 5.7.323 mean?

Microsoft returns 5.7.323 with the text tlsa-invalid, meaning the destination domain failed DANE validation. DANE binds a mail server's certificate to DNS through TLSA records secured with DNSSEC, so the sender can verify the certificate against what the domain owner published rather than against a public certificate authority.

That binding is what makes DANE strict. A certificate that any ordinary client would accept still fails if it does not match the published TLSA record, and there is no downgrade path. The usual cause is a certificate renewal at the destination that was not accompanied by an update to the TLSA record, which is easy to overlook because the new certificate works everywhere except against DANE.

Senders cannot work around this and should not try. A DANE failure means either the destination has a stale record or something is interfering with the connection, and both warrant investigation rather than a bypass. The recipient address is unaffected and delivery resumes once the mismatch is corrected at the destination.

How 5.7.323 plays out

Your server attempts delivery
The recipient server returns a permanent 5.7.323 rejection
This is a hard bounce: the message will not be accepted as sent
Suppress the address and fix the root cause before resending

Where 5.7.323 sits: soft vs hard bounce

Soft bounce (4xx) Hard bounce (5xx)
NatureTemporaryPermanent
SMTP class4xx5xx
What to doLet it retrySuppress the address
Recoverable?OftenNo
5.7.323 is✓ this code

What each provider means by 5.7.323

A registered code does not oblige a provider to use it that way, and the large ones diverge. Match the wording in your own bounce, not the definition above.

Exchange Online The destination domain failed DANE TLSA validation Reference

Common causes of 5.7.323

  • The destination renewed its certificate without updating the TLSA record
  • The TLSA record references a certificate or key that is no longer in use
  • The published TLSA record has the wrong usage, selector or matching type
  • Only some hosts in the MX set have matching TLSA records
  • DNSSEC validation for the domain is failing, so the TLSA record cannot be trusted
  • A TLS terminator presents a different certificate than the one the record covers

How to fix 5.7.323

  • Do not suppress the recipient, since the address is valid and the fault is a stale record
  • Tell the receiving organisation that their TLSA record does not match their certificate
  • Verify their DNSSEC chain, since DANE depends entirely on it
  • Check each MX host, because a partial rollout produces intermittent failure
  • Do not disable DANE enforcement to work around it
  • Where you publish DANE yourself, automate TLSA updates alongside certificate renewal

Frequently asked questions

What does 5.7.323 mean?
It means the destination domain publishes DANE TLSA records and the certificate its server presented did not match them. Microsoft reports it as tlsa-invalid. DANE has no fallback, so a mismatch stops delivery rather than downgrading the connection.
What is DANE?
DANE binds a server's certificate to DNS. The domain owner publishes a TLSA record, secured by DNSSEC, describing the certificate or key their mail server will present. A sender then verifies the presented certificate against that record instead of trusting any public certificate authority, which removes a large class of interception attacks.
Why does DANE fail after a certificate renewal?
Because the TLSA record has to be updated alongside the certificate, and it is easy to forget. The new certificate is valid and works with every ordinary client, so nothing appears wrong until a DANE-enforcing sender tries to connect. Automating the TLSA update as part of renewal is the only reliable fix.
Can I bypass DANE for one destination?
You should not. A DANE failure means the published binding does not match what is being presented, which is exactly the condition DANE exists to detect. Bypassing it to get one message through discards the protection for that destination permanently, and the underlying mismatch stays unfixed.
Is this the same as an MTA-STS failure?
They are related but distinct. MTA-STS uses a policy file fetched over HTTPS and validates against normal certificate authorities. DANE uses DNS records secured by DNSSEC. A domain can publish either or both, and 5.4.8 covers MTA-STS validation failure specifically.

Related bounce codes

5.7.5 Cryptographic Failure 4.7.5 Cryptographic Failure - Temporary 5.4.8 MTA-STS Validation Failed 5.7.324 Destination DNSSEC Records Invalid 5.7.322 Destination Certificate Expired

Sources & further reading

How SMTP DANE works · Microsoft reference for DANE, TLSA records and the 5.7.32x codes RFC 7672 · SMTP security via opportunistic DANE TLS, which defines TLSA validation
Reviewed by Jennifer Jackson, Email Deliverability Analyst · June 2026 ← All bounce codes