Skip to content
Standard SMTP codes · permanent error

5.7.5: cryptographic failure

A system that was authorised to check or decrypt the message could not do it, because a key or other required information was missing or invalid.

Standard
Provider
Permanent (5xx)
Class
Sources checked
Author

At a glance

Code
5.7.5
Temporary or permanent
PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
Who has to act
Either side, depending on the cause. Start with the checks below that are yours.
What the server says
5.7.5 Cryptographic failure

What it means

X.7.5 covers a transport system that is supposed to validate or decrypt a message in transit and cannot, because the key it needs is unavailable or invalid. RFC 3463 ties it to no class. 5.7.5 means the message was returned; a 4.7.5 suggests the key problem may be temporary, such as a key or certificate source that did not answer. It mostly appears where gateways decrypt or verify mail on behalf of users, for example in organisations that apply S/MIME or OpenPGP at the gateway.

Common causes

  • The gateway lacks the private key or certificate needed to decrypt the message.
  • A certificate or key that has expired or been revoked.
  • A key or certificate server that could not be reached.

How to fix it

  1. 01Check that you encrypted to the recipient's current certificate or key.
  2. 02Renew or republish your own signing certificate if it has expired.
  3. 03For 4.7.5, wait for the retries; the key source may come back.
  4. 04Recipient admins: check the gateway's keys and certificates.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

  1. 5.7.6Cryptographic algorithm not supported.A system that should validate or decrypt the message could not, because it does not support the algorithm the message uses.StandardPermanent
  2. 5.7.7Message integrity check failed.A system authorised to validate the message found it corrupted or altered, so the check on its integrity failed.StandardPermanent
  3. 5.7.3Secure format conversion not possible.Delivery needed the message converted from one secure messaging format to another, and that conversion could not be done.StandardPermanent

5.7.5 at other providers

  1. 5.7.5Destination certificate fails MTA-STS.Exchange Online stopped delivery because the receiving server's TLS certificate does not satisfy the destination domain's MTA-STS policy.MicrosoftPermanent

All 105 standard codesEvery code in the wikiPaste your own bounce

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule: 41 checks, 33 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.

example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 33

Illustrative. Your domain, every few hours.

Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer