Does 5.7.6 involve TLS cipher suites?

Rarely. TLS cipher mismatches usually abort the handshake and leave a 4.x deferral or connection error. 5.7.6 is mostly about message-level encryption.

Should I downgrade my algorithm?

Avoid it. Ask the recipient to update their gateway, and use a weaker algorithm only as a short, agreed workaround.

5.7.6 bounce: cryptographic algorithm not supported

5.7.6Cryptographic algorithm not supportedPermanent: retrying will not help

Typical wording

554 5.7.6 Cryptographic algorithm not supported

What it means

RFC 3463 defines X.7.6 as “cryptographic algorithm not supported”. The transport system was asked to handle a message protected with an algorithm it does not implement, so it cannot decrypt, verify or re-protect it.

You meet it mainly with S/MIME and PGP. A sender may encrypt with a cipher the recipient’s gateway does not know, or sign with a hash the gateway has disabled for being weak, such as SHA-1 or MD5. Old gateways that never learned AES-GCM or modern elliptic-curve keys also return it.

It is narrower than 5.7.5, which reports a failed operation with an algorithm that is supported. A 4.7.6 form is essentially unused, since support does not change between retries.

Likely causes

Encrypting with 3DES or RC2 to a gateway that only accepts AES.
Signing with SHA-1 when the receiver requires SHA-256 or better.
Using elliptic-curve keys with a gateway that only supports RSA.
A client defaulting to a legacy algorithm because it reads outdated capability data from the recipient’s certificate.

How to fix it

Check which algorithm your client or gateway used; S/MIME clients usually show it in the message security properties.
Configure encryption to use AES-256 (or AES-128) and signatures to use SHA-256.
If you run the receiving gateway, update it or enable the modern algorithm the sender used, rather than asking senders to downgrade.
Re-send the message and confirm the bounce does not return.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Shows the TLS version and certificate in use on the receiving server, a quick sign of whether its crypto stack is current.
MX Lookup Identifies the recipient’s inbound host, which helps you contact the right team about the gateway that rejected the algorithm.

FAQ

Does 5.7.6 involve TLS cipher suites?: Rarely. TLS cipher mismatches usually abort the handshake and leave a 4.x deferral or connection error. 5.7.6 is mostly about message-level encryption.
Should I downgrade my algorithm?: Avoid it. Ask the recipient to update their gateway, and use a weaker algorithm only as a short, agreed workaround.

All 191 bounce codes