DIAGNOSTIC PLAYBOOK
Expired SMTP certificate: confirm every receiving endpoint
An expired SMTP certificate can disrupt mail from senders that enforce certificate validation. Check every advertised receiving endpoint because one renewed server does not establish that its peers are current.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- List primary, equal-preference and backup MX targets and their resolved addresses.
- Inspect certificate validity and chains on each endpoint rather than only the load balancer's main address.
- Deploy the renewed certificate where needed and monitor delivery queues and TLS reports for recovery.
What this looks like
ILLUSTRATIVE EXAMPLE
The primary MX renews automatically, but a backup retains the expired certificate. Failures emerge only when senders reach the backup.
A mistake to avoid
Delivery behavior depends on the sender's policy and context. An expired certificate does not mean all mail everywhere will fail identically.
Keep the result in context
Transport encryption protects a connection between mail systems. It is different from message authentication and does not imply end-to-end encryption. Investigate the receiving MX hostname, the TLS session and the applicable policy separately before deciding which system needs a change.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.