# 450 4.4.317: cannot connect to remote server [Message=UntrustedRoot]

URL: https://iblockspam.com/smtp-errors/450-4-4-317
Last updated: 2026-10-22

Code: 450 4.4.317 (temporary failure, the sender retries)
Provider: Microsoft 365 / Outlook.com

During the TLS handshake, a mail server sent only its own (leaf) certificate without the intermediate certificates, so Exchange Online couldn't build a chain to a trusted root.

What the bounce says:

```
Cannot connect to remote server [Message=UntrustedRoot]
```
The description for 450 4.4.317 in Microsoft's Exchange Online NDR reference.

Microsoft documents 450 4.4.317 for TLS connections between Exchange Online and another mail server (a remote MTA). In both directions, the remote server sends only its leaf certificate without the certificates of the intermediate certification authorities. If Exchange Online can't validate the certificate by building the chain to a Microsoft-trusted root CA, it fails the connection.

It happens two ways. When Exchange Online sends to an external server that presents an incomplete chain, Exchange Online generates the NDR for your sender. When an external server sends to Exchange Online with an incomplete chain, Exchange Online rejects the message and the remote server generates the NDR for its sender. Either way, the server presenting the incomplete chain is the one to fix.

Microsoft states that Exchange Online doesn't fetch intermediate certificates on demand, so a remote MTA must present the full certificate chain, and that MTAs managed by Exchange Online always do. The 4xx class means the failure is temporary: the sending server keeps retrying until the certificate is fixed or the message expires.

## Common causes

- The remote mail server is configured with the leaf certificate only, not the full chain file.
- A certificate was renewed and installed without its intermediate CA certificates.
- The certificate chain doesn't lead to a root CA that Microsoft trusts.

## How to fix it (sender)

- Users: contact your email admin.
- Admins of the remote server: configure it to present the full certificate chain (leaf plus intermediates).
- Admins in the Exchange Online organization: notify the remote organization's admin about the NDR.

## How to fix it (recipient or admin)

- If your server is the one named in the error, install the complete certificate chain and restart the mail service.

**Q: Who has to fix the 4.4.317 UntrustedRoot error?**
The admin of the mail server that presents the incomplete certificate chain. Microsoft says Exchange Online doesn't fetch intermediate certificates on demand, so that server must be configured to send its full chain.

**Q: Will mail held by 450 4.4.317 be delivered later?**
Only if the certificate problem is fixed before the sending server gives up. A 450 is temporary, so the sender keeps retrying, but each attempt fails the same way until the full chain is installed.

Sources:
- NDR error code 450 4.4.317 (Cannot connect to remote server [Message=UntrustedRoot]) (Microsoft Learn): https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/fix-error-code-450-4-4-317-untrusted-root
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn): https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online

---

Source: iBlockSpam, https://iblockspam.com/smtp-errors/450-4-4-317 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt