SMTP 554 5.7.5: cryptographic failure (TLS or signature verification)
A 554 5.7.5 reply means a cryptographic operation failed while the server tried to validate or decrypt your message. RFC 3463 defines X.7.5 as "Cryptographic failure": a system that was allowed to verify or decrypt the mail could not, because a key was missing or the supplied information was invalid. This is about TLS and message signatures, not SPF, so do not start by editing your SPF record.
The enhanced status code 5.7.5 is defined by RFC 3463 as "Cryptographic failure": a transport system that was authorized to validate or decrypt the message could not do so, because a needed key was unavailable or the information it had was invalid.
What actually broke
A TLS handshake or certificate check failed on a link that required encryption.
A message signature such as DKIM or S-MIME could not be verified with the keys on hand.
An encrypted message could not be decrypted because the key was missing or wrong.
What it is not
Despite living in the 5.7.x security family, 5.7.5 is not an SPF result. SPF failures surface in the 5.7.x range too, but with their own wording, and editing your SPF record will not clear a genuine cryptographic error. Match the fix to the layer named in the reply text.
How to fix it
If TLS is involved, confirm your certificate is valid and that both sides agree on a protocol version and cipher. If a signature failed, check that your DKIM key is published in DNS and matches the selector you sign with. Because the leading digit is 5, the message is not retried until the crypto problem is resolved.
Common questions
Does 554 5.7.5 mean my SPF failed?→
No. 5.7.5 is a cryptographic failure covering TLS and signature verification. SPF has its own 5.7.x wording. Editing SPF will not fix a crypto error.
What cryptographic steps can trigger 5.7.5?→
A failed TLS handshake or certificate check, an unverifiable DKIM or S-MIME signature, or a message that could not be decrypted.
Is 554 5.7.5 permanent?→
Yes. The leading 5 marks it permanent, so the same message fails until the underlying key or TLS issue is fixed.
How do I start debugging 5.7.5?→
Read the reply text to see whether it names TLS, DKIM, or decryption, then check the certificate, cipher, or DKIM selector for that layer.