Microsoft mail servers 450 4.4.317
Transport security
Transport security means the receiving provider rejected the message for a provider-specific reason. Use the diagnostic text before deciding on retries or suppression.
Decision
A retry can work, especially after a short wait.
Confidence: high. Recipient validity: unknown.
Match this reply
- SMTP stage
- STARTTLS
- Endpoint
- Inbound MX
UntrustedRootCannot connect to remote serverUse tools
Start here
- 1
Make sure the SMTP session negotiates TLS correctly.
- 2
Check certificate trust, TLS policy, and whether the receiving provider requires encrypted delivery.
Confirm the cause
- Confirm the SMTP session negotiates TLS on the expected endpoint.
- Check certificate trust, hostname coverage, and connector TLS requirements.
- Retry after TLS policy and certificate issues are fixed.
App handling
- Queue a retry with backoff and keep the original SMTP reply attached to the attempt.
- Slow or pause provider-specific sending if the same deferral repeats across many recipients.
- Escalate to reputation, authentication, or volume review when retries keep failing.
Avoid
- Do not suppress the recipient from a temporary response.
- Do not keep the same retry pace if the deferral repeats across many recipients.
- Do not ignore sender reputation or authentication if this keeps happening.
Common causes
- The receiving provider requires TLS and the SMTP session did not negotiate it.
- The TLS certificate chain is untrusted, expired, or not accepted by the provider.
- A connector or policy requires encrypted delivery for this route.
Developer details
Fields to log
raw SMTP replyremote MX or hostSMTP stagereply codeenhanced codeprovidermatched rule idrecipientsending domaindecisiontimestampsource IPconnectorTLS result