This appears to be an issue with certificates on servers on the same local subnet. I had to change my DNS to 8.8.8.8 on the host instance to solve the email delivery issue caused by the introduction of email validation.
Email problem after update - ITFlow Forum
Not sure if it's possible to specify a specific DNS server for a particular cron script like certificate_refresher.php?
Obviously, I need email delivery more than I need certificate expiration notifications so it may remain broken for now.