How do expired certificates cause bounces?

TLS (Transport Layer Security) is the encryption protocol mail servers use when transferring messages between each other. TLS certificates prove that the server you're connecting to is who it claims to be. When a certificate expires, that trust chain breaks.

Here's what happens at delivery time. Your mail server initiates a connection to the recipient's server and issues a STARTTLS command to upgrade to an encrypted session. The receiving server presents its TLS certificate. If that certificate is expired, the certificate validation step fails. What happens next depends on the receiving server's policy:

• Soft failure: the server downgrades to an unencrypted connection. Mail gets through, but you've just sent email in plaintext. This is the old behavior and increasingly uncommon.
• Hard failure: the server rejects the connection entirely and returns a bounce. This is what happens when the receiving domain has MTA-STS (Mail Transfer Agent Strict Transport Security) enabled. MTA-STS is a standard that lets domain owners publish a policy requiring TLS delivery and rejecting any connection that can't establish it properly.

The practical result: if a recipient's mail server has an expired certificate and MTA-STS enforced, your emails to that domain will bounce until their certificate is renewed. You'll typically see the bounce code reference a TLS or certificate failure in the diagnostic message.

If it's your own infrastructure: set up automated certificate renewal. Let's Encrypt certificates expire every 90 days. Tools like certbot handle renewal automatically, but they need to be configured and monitored. A missed renewal is a common cause of sudden delivery failures across an entire sending domain.

If it's a third-party provider: that's their problem to manage. But if you're seeing a sudden spike in TLS-related bounces to a specific provider or domain cluster, it's worth flagging to their support team.