5.7.5
Enhanced Status Code 5.7.5: Authentication Required
Permanent failure
High severity
Security
RFC 3463
What it means
Enhanced Status Code 5.7.5 means “Authentication Required.” The server requires cryptographic authentication that your message failed to provide. This is different from SMTP AUTH - it refers to email authentication mechanisms like SPF, DKIM, or mutual TLS that the receiving server mandates.
At a glance
Code5.7.5
Bounce typeHard (permanent)
SeverityHigh
CategorySecurity
What to doSuppress the address; do not retry
StandardRFC 3463
550 5.7.5 Cryptographic failure: TLS negotiation could not be completed; the receiving server requires a trusted certificate and a supported cipherWhat does 5.7.5 mean?
Enhanced status code 5.7.5 indicates the receiving server requires a specific cryptographic or protocol-level authentication that your message did not satisfy. This can refer to SMTP AUTH (login credentials), but more commonly in modern email it indicates the server requires sender authentication via SPF, DKIM, or TLS and your message failed these checks.
Some receiving servers, particularly in government and regulated industries, require mutual TLS or client certificate authentication. If the sending server cannot provide the required authentication, the message is rejected with 5.7.5.
How 5.7.5 plays out
Your server attempts delivery
The recipient server returns a permanent
5.7.5 rejectionThis is a hard bounce: the message will not be accepted as sent
Suppress the address and fix the root cause before resending
Where 5.7.5 sits: soft vs hard bounce
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| SMTP class | 4xx | 5xx |
| What to do | Let it retry | Suppress the address |
| Recoverable? | Often | No |
| 5.7.5 is | ✓ this code |
Common causes of 5.7.5
- Server requires SMTP AUTH credentials that were not provided
- Required sender authentication (SPF/DKIM) missing or failing
- Mutual TLS or client certificate required but not provided
- Authentication mechanism mismatch between sender and receiver
How to fix 5.7.5
- Configure SMTP AUTH credentials if the server requires login
- Implement and verify SPF and DKIM authentication for your domain
- Check if the server requires specific TLS or certificate authentication
- Review the error message text for details on which authentication is required
Frequently asked questions
What does SMTP enhanced status code 5.7.5 mean?
Enhanced status code 5.7.5 indicates a "Cryptographic failure": the mail transport system was unable to validate or decrypt a message because necessary cryptographic information (such as an encryption key or certificate) was unavailable or invalid. This is a permanent failure in the security/policy category of SMTP status codes. It typically occurs when TLS negotiation fails, S/MIME decryption cannot be completed, or required cryptographic credentials are missing.
What causes a 5.7.5 cryptographic failure in email?
Common causes include expired or invalid TLS/SSL certificates on the sending or receiving mail server, mismatched cipher suites between servers that prevent TLS negotiation, missing or corrupted S/MIME certificates for encrypted messages, and server configurations that require specific encryption standards the other party cannot meet. This error is less common than other 5.7.x codes and typically affects server-to-server communication rather than end users directly.
How do I fix a 5.7.5 cryptographic authentication error?
Verify that your mail server's TLS/SSL certificate is valid, not expired, and properly installed. Ensure your server supports modern TLS versions (TLS 1.2 or 1.3); many servers now reject connections using TLS 1.0 or 1.1. If the error relates to S/MIME encryption, confirm the recipient's public key certificate is valid and that your mail client has the correct certificate installed. Check your server logs for specific cipher negotiation failures and update cipher suites as needed.
Is 5.7.5 related to STARTTLS errors?
Yes, 5.7.5 can occur during STARTTLS negotiation when the cryptographic handshake fails. If the receiving server requires TLS but the connection cannot be established due to certificate issues or incompatible cipher suites, a cryptographic failure is returned. This is distinct from errors like 5.7.0 ("Must issue a STARTTLS command first"), which means TLS was required but never initiated. Error 5.7.5 means TLS was attempted but the cryptographic exchange itself failed.
Related bounce codes
Sources & further reading
Reviewed by Jennifer Jackson, Email Deliverability Analyst · June 2026
← All bounce codes