ProbeKit
Sign inSign up

5.7.3 bounce: security conversion not possible

5.7.3Security conversion required but not possiblePermanent: retrying will not help

Typical wording
554 5.7.3 Security conversion required but not possible

What it means

RFC 3463 names X.7.3 “security conversion required but not possible”. A conversion from one secure format to another, or from plain to protected form, was needed to deliver the message, and the server holding it could not do it.

The classic case is a gateway between two encryption schemes, such as S/MIME and PGP, or between a protected internal system and the internet. Encryption gateways that apply policy (for example “all mail to this partner must be encrypted”) also use it when they lack a certificate or key for the recipient.

It is a specialised code. Most senders never see it unless their organisation, or the recipient’s, runs a mail encryption gateway. A 4.7.3 form is possible when a key lookup failed temporarily.

Likely causes

  • An outbound encryption gateway that must encrypt mail to a partner domain but has no public key or certificate for the recipient.
  • A gateway that cannot translate between S/MIME and PGP formats used by the two sides.
  • An expired recipient certificate in the gateway’s directory.
  • A key server or directory the gateway depends on being unreachable.

How to fix it

  1. Identify which gateway produced the code from the Reporting-MTA in the bounce.
  2. If it is your own gateway, obtain the recipient’s current certificate or public key and import it.
  3. Check the gateway’s policy rules; if encryption is not truly required for this partner, relax the rule or switch to TLS-only delivery.
  4. If the gateway belongs to the recipient, send them the bounce so their admin can fix the key lookup.

Checks that apply

  • SMTP Diagnostics Confirms that the recipient’s server supports STARTTLS, which can stand in for message-level encryption in many policies.
  • MTA-STS Check Shows whether the recipient enforces TLS with MTA-STS, a common lighter alternative to gateway encryption.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Is 5.7.3 about TLS?
Usually not. It concerns message-level security conversion such as S/MIME or PGP; TLS problems use codes like 5.7.0, 5.7.10 or 4.7.0.
Can I just send it unencrypted?
Only if your organisation’s policy allows it. The gateway is enforcing a rule someone set deliberately.

All 191 bounce codes