What it looks like in your logs
535-5.7.8 Username and Password not accepted. For more information, go to https://support.google.com/mail/?p=BadCredentials - gsmtpWhat does 5.7.8 mean?
RFC 4954 pairs the 535 reply with enhanced code 5.7.8 to mean authentication credentials invalid. Your application, printer, website plugin or script tried to log in to an SMTP server and was refused. Because the login failed, no message was accepted, and no recipient address is at fault. The fix is always on the sending side, in the credentials or the way the app signs in.
The obvious cause is a wrong or changed password, but modern providers add several less obvious ones. Accounts with multi-factor authentication often need an app password for SMTP. Some organizations disable basic authentication and accept only OAuth 2.0. An OAuth token can expire or be revoked. In each case, typing the right password again will not fix it. Check the provider's current authentication rules before assuming the password is the issue.
Gmail returns 535 5.7.8 "Username and Password not accepted" and links to its bad credentials help page. Microsoft 365 more often uses 535 5.7.3 or 535 5.7.139 for failed or disabled SMTP AUTH, but relays and hosted SMTP services commonly use 5.7.8.
Soft or hard bounce?
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| Sender behaviour | Queue and retry with backoff | Stop, suppress the address |
| Reputation risk | Low, unless it repeats for days | High above a 2% bounce rate |
| 5.7.8 | ✓ this code |
Common causes
- The password was changed, expired or mistyped in the app settings.
- The username is wrong, for example missing the domain part.
- The account requires an app password because multi-factor authentication is on.
- The provider or admin disabled basic authentication for SMTP.
- An OAuth token has expired or its consent was revoked.
- The account itself has been disabled or suspended.
How to fix 5.7.8
- Sign in to the account in a browser to confirm the credentials and that the account is active.
- Re-enter the full username, usually the complete email address, and the current password.
- If multi-factor authentication is on, generate an app password or move the app to OAuth 2.0.
- Refresh or re-authorize the OAuth connection if the app uses one.
- For application and bulk mail, use a dedicated SMTP relay with its own API key rather than a staff mailbox; see transactional vs marketing email.
5.7.8 questions
What does 535 5.7.8 "Username and Password not accepted" mean?
It means the mail server rejected your SMTP login. The username or password is wrong, or the account does not allow that kind of login. Nothing was sent, so no recipient is affected. Fix the credentials or the auth method in the sending app.
Why does Gmail return 5.7.8 when my password is correct?
Gmail does not accept a regular account password for SMTP when two-step verification is on, and it restricts less secure sign-in methods. Create an app password in your Google account security settings, or connect the app with OAuth. Workspace admins can also block SMTP access by policy.
How do I fix 5.7.8 in Microsoft 365?
Confirm SMTP AUTH is enabled for the mailbox, that the client uses port 587 with STARTTLS, and that basic authentication is not blocked by a policy. If it is, switch the app to OAuth or a relay service. See 535 for the Microsoft-specific codes.