5.7.324

Enhanced Status Code 5.7.324: Destination DNSSEC Records Invalid

Permanent failure High severity Security
What it means

Enhanced Status Code 5.7.324 means “Destination DNSSEC Records Invalid.” The destination domain returned DNSSEC records that failed validation. Because DANE depends on DNSSEC, a broken chain makes the certificate binding untrustworthy and delivery stops.

At a glance
Code5.7.324
Bounce typeHard (permanent)
SeverityHigh
CategorySecurity
What to doSuppress the address; do not retry
What it looks like in your mail logs 
550 5.7.324 dnssec-invalid: Destination domain returned invalid DNSSEC records

What does 5.7.324 mean?

Microsoft returns 5.7.324 with the text dnssec-invalid, meaning the destination domain returned invalid DNSSEC records. DNSSEC signs DNS responses so a resolver can prove they were not tampered with, and DANE depends on it completely: a TLSA record is only meaningful if the DNS answer carrying it can be trusted.

When validation fails, the sender cannot distinguish a genuine misconfiguration from an active attack, so it refuses rather than guessing. The usual cause is mundane. A key rollover that was not completed correctly, a DS record at the parent zone that no longer matches the child's key, or signatures that expired because a signing process stopped running will all break validation while leaving the domain apparently functional for anyone not validating.

That last point is what makes DNSSEC failures confusing to the domain owner. Most of the internet does not validate, so their website works, their own mail flows, and only senders that do validate are refused. They frequently need to be told, and pointing them at a DNSSEC analyser is more useful than describing the symptom.

How 5.7.324 plays out

Your server attempts delivery
The recipient server returns a permanent 5.7.324 rejection
This is a hard bounce: the message will not be accepted as sent
Suppress the address and fix the root cause before resending

Where 5.7.324 sits: soft vs hard bounce

Soft bounce (4xx) Hard bounce (5xx)
NatureTemporaryPermanent
SMTP class4xx5xx
What to doLet it retrySuppress the address
Recoverable?OftenNo
5.7.324 is✓ this code

What each provider means by 5.7.324

A registered code does not oblige a provider to use it that way, and the large ones diverge. Match the wording in your own bounce, not the definition above.

Exchange Online The destination domain returned invalid DNSSEC records Reference

Common causes of 5.7.324

  • A DNSSEC key rollover at the destination was not completed correctly
  • The DS record at the parent zone no longer matches the child zone key
  • Zone signatures expired because a signing process stopped running
  • The zone was modified without being re-signed
  • A DNS provider migration lost the DNSSEC configuration
  • An algorithm rollover left records signed with a key no longer published

How to fix 5.7.324

  • Do not suppress the recipient, since the address is valid and the fault is in their DNS
  • Tell the receiving organisation and point them at a DNSSEC validation analyser
  • Verify independently with dig +dnssec against their domain
  • Check whether the DS record at the parent matches their published key
  • Do not disable DNSSEC validation to work around it
  • Where you sign your own zone, monitor signature expiry rather than assuming it renews

Frequently asked questions

What does 5.7.324 mean?
It means the destination domain returned DNSSEC records that failed validation, so the DNS answers could not be trusted. Microsoft reports it as dnssec-invalid. Because DANE relies on DNSSEC, an untrustworthy chain makes certificate validation impossible and delivery stops.
Why does a DNS problem stop mail delivery?
Because DNSSEC failure is indistinguishable from tampering. A validating sender cannot tell a broken key rollover from an attacker substituting records, so refusing is the only safe response. That is the entire purpose of validation: an unverifiable answer is treated as untrustworthy rather than accepted.
Why does the domain seem fine otherwise?
Because most of the internet does not validate DNSSEC. Their website resolves, their own outbound mail flows, and everything appears healthy to anyone not checking signatures. Only validating senders are refused, which is why the domain owner is usually unaware until somebody tells them.
What usually breaks DNSSEC?
Incomplete key rollovers, a DS record at the parent registrar that no longer matches the child zone key, expired signatures where a signing process stopped, and DNS provider migrations that lose the configuration. All are operational rather than architectural, and all are invisible without monitoring.
Should I disable validation to deliver the message?
No. Disabling validation to work around a failure removes the protection for that domain permanently and leaves the real fault in place. Report it instead; DNSSEC problems are usually fixed quickly once somebody knows.

Related bounce codes

5.7.5 Cryptographic Failure 4.7.5 Cryptographic Failure - Temporary 5.7.30 REQUIRETLS Support Required 5.4.8 MTA-STS Validation Failed 5.7.4 Security Features Not Supported

Sources & further reading

How SMTP DANE works · Microsoft reference for DANE, TLSA records and the 5.7.32x codes Exchange Online NDR reference · Microsoft list of SMTP errors returned by Exchange Online
Reviewed by Jennifer Jackson, Email Deliverability Analyst · June 2026 ← All bounce codes