What it looks like in your logs
535 5.7.8 Authentication credentials invalid [smtp.example.com]What does 535 mean?
A 535 reply arrives right after your application sends the AUTH command, before any message is transmitted. RFC 4954 defines it as authentication credentials invalid. No recipient was involved, so this is not a bounce against any address on your list. It is a problem with how your app or device logs in to the mail server you are sending through.
Wrong passwords are only part of the story. Providers have spent years shutting down basic authentication with a normal account password. An app can hold the correct password and still get 535 because SMTP AUTH is disabled for the mailbox, multi-factor authentication requires an app password, or an OAuth token has expired. The enhanced code after 535 usually narrows it down.
Gmail returns 535 5.7.8 "Username and Password not accepted" and 534 5.7.9 when an application-specific password is required. Microsoft 365 returns 535 5.7.3 for failed logins and 535 5.7.139 when SMTP AUTH or basic authentication is disabled for the tenant or mailbox, and Microsoft is phasing out basic auth for client submission entirely.
Soft or hard bounce?
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| Sender behaviour | Queue and retry with backoff | Stop, suppress the address |
| Reputation risk | Low, unless it repeats for days | High above a 2% bounce rate |
| 535 | ✓ this code |
Common causes
- The username or password is wrong, or the password was changed or expired.
- SMTP AUTH is turned off for the mailbox or the whole tenant.
- The account has multi-factor authentication and needs an app password or OAuth.
- An OAuth access token expired or was revoked.
- The client tried to authenticate before starting TLS, and the server refuses credentials in cleartext.
- The client offered an auth mechanism, such as LOGIN, that the server no longer permits.
How to fix 535
- Log in to the account through webmail to confirm the credentials themselves are valid.
- Check whether SMTP AUTH is enabled for that specific mailbox, not only for the tenant.
- Switch the application to OAuth 2.0 where the provider supports it, or generate an app password as a stopgap.
- Submit on port 587 with STARTTLS or port 465 with implicit TLS, never port 25 for authenticated submission.
- For application or bulk sending, move to a dedicated SMTP relay with an API key instead of a staff mailbox; see transactional vs marketing email for why the streams should be separate.
535 questions
What does SMTP error 535 mean?
It means the mail server refused your SMTP login. The message was never sent, so no recipient is affected. The cause is on the sending side: wrong credentials, an expired token, a disabled SMTP AUTH setting or an authentication method the server no longer accepts.
My password is correct, so why do I get 535?
Because many providers no longer accept a plain password for SMTP. If the account has multi-factor authentication, you may need an app password. If the tenant has disabled basic authentication or SMTP AUTH, the correct password is refused anyway. Microsoft reports this as 535 5.7.139. OAuth 2.0 is the long-term fix.
How do I fix 535 with Microsoft 365?
Ask your admin to confirm SMTP AUTH is enabled for the mailbox in the Microsoft 365 admin center, then check that your client uses port 587 with STARTTLS. If basic authentication is blocked by policy, move the app to OAuth or send through a relay service with its own credentials instead of a user mailbox.
Is 535 the same as 5.7.8?
They usually appear together. 535 is the basic reply code for a failed login and 5.7.8 is the enhanced code that says the credentials were invalid. Other enhanced codes, such as 5.7.139 at Microsoft, give a more specific reason while keeping the same 535 reply.