Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
SMTP error code · Microsoft 365 / Outlook.com

450 4.4.317: cannot connect to remote server [Message=UntrustedRoot]

450 4.4.317 Temporary failure (4xx): the sender retries
By iBlockSpam Team Checked against sources 2 sources How we check our content
What it means

During the TLS handshake, a mail server sent only its own (leaf) certificate without the intermediate certificates, so Exchange Online couldn't build a chain to a trusted root.

What the bounce says
Cannot connect to remote server [Message=UntrustedRoot]

The description for 450 4.4.317 in Microsoft's Exchange Online NDR reference.

What 450 4.4.317 means

Microsoft documents 450 4.4.317 for TLS connections between Exchange Online and another mail server (a remote MTA). In both directions, the remote server sends only its leaf certificate without the certificates of the intermediate certification authorities. If Exchange Online can't validate the certificate by building the chain to a Microsoft-trusted root CA, it fails the connection.

It happens two ways. When Exchange Online sends to an external server that presents an incomplete chain, Exchange Online generates the NDR for your sender. When an external server sends to Exchange Online with an incomplete chain, Exchange Online rejects the message and the remote server generates the NDR for its sender. Either way, the server presenting the incomplete chain is the one to fix.

Microsoft states that Exchange Online doesn't fetch intermediate certificates on demand, so a remote MTA must present the full certificate chain, and that MTAs managed by Exchange Online always do. The 4xx class means the failure is temporary: the sending server keeps retrying until the certificate is fixed or the message expires.

Likely causes

  • The remote mail server is configured with the leaf certificate only, not the full chain file.
  • A certificate was renewed and installed without its intermediate CA certificates.
  • The certificate chain doesn't lead to a root CA that Microsoft trusts.

How to fix it

If you sent the message

  1. Users: contact your email admin.
  2. Admins of the remote server: configure it to present the full certificate chain (leaf plus intermediates).
  3. Admins in the Exchange Online organization: notify the remote organization's admin about the NDR.

If you're the recipient or their admin

  1. If your server is the one named in the error, install the complete certificate chain and restart the mail service.
MTA-STS Checker MX Lookup Email Health Check

Frequently asked questions

Who has to fix the 4.4.317 UntrustedRoot error?

The admin of the mail server that presents the incomplete certificate chain. Microsoft says Exchange Online doesn't fetch intermediate certificates on demand, so that server must be configured to send its full chain.

Will mail held by 450 4.4.317 be delivered later?

Only if the certificate problem is fixed before the sending server gives up. A 450 is temporary, so the sender keeps retrying, but each attempt fails the same way until the full chain is installed.

Sources

  1. NDR error code 450 4.4.317 (Cannot connect to remote server [Message=UntrustedRoot]) (Microsoft Learn)
  2. Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)

Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.

Related codes

Related guides

Email security basics

Is my email encrypted in transit? STARTTLS, MTA-STS and DANE explained

What STARTTLS does for email, why opportunistic TLS can be downgraded, how MTA-STS and DANE enforce it, what Gmail's lock icons mean, and where TLS stops.

9 min read SPF, DKIM & DMARC

MTA-STS and TLS-RPT explained: how to set them up safely

What MTA-STS and TLS-RPT protect against, the DNS records and policy file you need, testing vs enforce mode, and safe rollout behind a filtering gateway.

9 min read Email security basics

What is DANE for SMTP, and do you need it?

DANE for SMTP explained: TLSA records, why DNSSEC is required, how it compares with MTA-STS, Exchange Online's DANE support, and how to check a domain.

9 min read