ProbeKit
Sign inSign up

5.7.5 bounce: cryptographic failure

5.7.5Cryptographic failurePermanent: retrying will not help

Typical wording
554 5.7.5 Cryptographic failure

What it means

X.7.5 is “cryptographic failure” in RFC 3463: a transport system tried to perform a cryptographic operation on the message and it did not succeed. The code is deliberately general and covers decryption, signature creation and key handling.

It is most often produced by encryption gateways and S/MIME or PGP processing on the receiving side, for example when an encrypted message cannot be decrypted with the gateway’s private key. Some servers also use it when a TLS-level operation fails after negotiation has started.

Its neighbours are narrower: 5.7.6 means the algorithm is not supported, and 5.7.7 means an integrity check failed. With 5.7.5 the operation was attempted with a supported algorithm and still broke. A 4.7.5 can occur when a hardware security module or key service was temporarily unavailable.

Likely causes

  • A message encrypted to an old certificate whose private key the recipient’s gateway no longer holds.
  • A corrupted encrypted attachment (smime.p7m) that cannot be decrypted.
  • A gateway key store or HSM that failed during processing.
  • A sender gateway signing with a key that has expired or been revoked.

How to fix it

  1. Find which system raised the error; the Reporting-MTA in the bounce shows whether it is yours or the recipient’s.
  2. If you encrypt to the recipient, make sure you are using their current certificate and ask them to resend theirs if unsure.
  3. If your own gateway failed, check its logs and key store, renew expired keys, and restart the service.
  4. Send a plain test message to confirm that ordinary delivery works, which isolates the problem to the cryptographic layer.

Checks that apply

  • SMTP Diagnostics Shows the server’s TLS certificate and handshake result, ruling the transport layer in or out.
  • MailFlow Monitor Sends an unencrypted test through the same path, confirming that only the cryptographic step is failing.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Is 5.7.5 the same as a DKIM failure?
No. DKIM failures have their own codes, 5.7.20 to 5.7.22. A 5.7.5 is about encryption or signing done by a gateway, not about domain authentication.
Who should act on it?
Whoever owns the gateway named in the bounce. Often that is the recipient’s admin when their decryption step fails.

All 191 bounce codes