X.7.5 · Security or policy
SMTP enhanced status code 5.7.5
Cryptographic failure
X.7.5 means a system that should validate or decrypt the message could not, because the key or other needed information was missing or invalid. Microsoft also uses 4.7.5 and 5.7.5 for certificates that fail MTA-STS validation.
| Registry code | X.7.5 |
|---|---|
| Forms in use | 5.7.5, 4.7.5 |
| Registry name | Cryptographic failure |
| Subject | 7: Security or policy |
| Permanent or temporary | 4.x.x persistent transient failure: retrying later may succeed; 5.x.x permanent failure: resending unchanged will not succeed |
| Associated basic codes | Not given |
| Defined in | [RFC 3463] |
What the registry says
A transport system otherwise authorized to validate or decrypt a message in transport was unable to do so because necessary information such as key was not available or such information was invalid.
IANA SMTP Enhanced Status Codes registry, X.7.5
In practice
X.7.5 covers missing or invalid keys and certificates. Microsoft uses 4.7.5 and 5.7.5 when a destination server's certificate fails MTA-STS validation, meaning it does not chain to a trusted root or does not match the host name. The fix is on whichever side presented the bad certificate. MTA-STS lets a receiving domain require valid TLS for its MX hosts, so a sender that honours the policy will refuse to deliver to a server with a bad certificate. The receiving domain needs to renew or fix its certificate.
What the sender should do
Check certificates and keys on the side that is reported as failing, including MTA-STS policy and certificate chain.
Would verifying the list have prevented 5.7.5?
No
This reply is about your sending setup, the message or the receiving system, not about whether the address exists, so verifying the list will not prevent it.
How providers use X.7.5
Quoted from each provider’s own error reference.
- Microsoft 365 4.7.5
Remote certificate failed MTA-STS validation. Reason: <validityStatus>
- Microsoft 365 5.7.5
Remote certificate failed MTA-STS validation. Reason: <validityStatus>
Common questions
- What does 5.7.5 mean?
- X.7.5 means a system that should validate or decrypt the message could not, because the key or other needed information was missing or invalid. Microsoft also uses 4.7.5 and 5.7.5 for certificates that fail MTA-STS validation.
- What is the difference between 5.7.5 and 4.7.5?
- They share the subject and detail digits, so they report the same condition, "Cryptographic failure". The first digit is the class: 4.x.x persistent transient failure: retrying later may succeed; 5.x.x permanent failure: resending unchanged will not succeed.
- What should I do about 5.7.5?
- Check certificates and keys on the side that is reported as failing, including MTA-STS policy and certificate chain.
- Would an email verifier have caught 5.7.5?
- No. This reply is about your sending setup, the message or the receiving system, not about whether the address exists, so verifying the list will not prevent it.
Sources
- IANA: SMTP Enhanced Status Codes registry (checked 2026-11-05)
- RFC 3463: Enhanced Mail System Status Codes (checked 2026-11-05)
- Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online (checked 2026-11-05)
Registry and provider wording is quoted exactly; guidance is written by the SimpleVerifier Team.
SimpleVerifier Team · Last checked against the sources 2026-11-05