Enhanced SMTP status code · RFC 3463 · IANA
5.7.325 certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name matching the hostname (DANE)
The recipient server's certificate does not hold (in CN or SAN) the domain or the MX host name.
- Class: Permanent failure
Class 5: a permanent failure. Resending the same message will not help: something about the message, the sender or the destination must change (RFC 3463 §3.1).
Also seen as:
4.7.325 - Subject: X.7 · Security and policy
Policies (per-host or per-recipient filters) and cryptographic operations; up to the sender, the recipient or both.
How 5.7.325 appears at providers
The exact text from the provider's documentation, as you see it in the bounce, and what it means.
Microsoft 365 / Exchange Online
-
5.7.325
certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name matching the hostname (DANE)
The recipient server's certificate does not hold (in CN or SAN) the domain or the MX host name. Check with SMTP server check.
-
4.7.325
certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name that matches the hostname (DANE)
The recipient server's certificate does not hold (in CN or SAN) the domain or the MX host name. Check with SMTP server check.
What you can check here
Have the whole error message?
Sources: RFC 5321 · RFC 3463 · RFC 3464 · IANA · Gmail · Microsoft 365 · read on 26 September 2026