5.7.57

Enhanced Status Code 5.7.57: Client Not Authenticated to Send Mail

Permanent failure High severity Authentication
What it means

Enhanced Status Code 5.7.57 means “Client Not Authenticated to Send Mail.” Exchange Online received your message on the submission port without authentication. This is the error almost every application hits the first time it tries to send through Microsoft 365.

At a glance
Code5.7.57
Bounce typeHard (permanent)
SeverityHigh
CategoryAuthentication
What to doSuppress the address; do not retry
What it looks like in your mail logs 
535 5.7.57 Client not authenticated to send mail. Error: 530 5.7.57 SMTP; Client was not authenticated to send anonymous mail during MAIL FROM

What does 5.7.57 mean?

Microsoft returns 5.7.57 when a client attempts to send mail through Exchange Online without having authenticated. The full text usually reads that the SMTP server requires a secure connection or the client was not authenticated. It is not an IANA-registered code; it belongs to Microsoft's extended numbering.

The usual cause is not a bad password but SMTP AUTH being switched off. Microsoft disables authenticated SMTP by default on new tenants as a security measure, and the setting exists at both tenant level and per mailbox. A mailbox can have correct credentials and still be unable to submit because the per-mailbox switch is off, which is confusing because nothing about the error suggests a setting rather than a credential.

The second most common cause is connection shape. Authenticated submission belongs on port 587 with STARTTLS, or on 465 with implicit TLS. Applications configured for port 25 are attempting server-to-server relay, which Exchange Online will not accept from an unauthenticated client, and no amount of correcting the password fixes a wrong port.

How 5.7.57 plays out

Your server attempts delivery
The recipient server returns a permanent 5.7.57 rejection
This is a hard bounce: the message will not be accepted as sent
Suppress the address and fix the root cause before resending

Where 5.7.57 sits: soft vs hard bounce

Soft bounce (4xx) Hard bounce (5xx)
NatureTemporaryPermanent
SMTP class4xx5xx
What to doLet it retrySuppress the address
Recoverable?OftenNo
5.7.57 is✓ this code

What each provider means by 5.7.57

A registered code does not oblige a provider to use it that way, and the large ones diverge. Match the wording in your own bounce, not the definition above.

Exchange Online The client was not authenticated to send mail during MAIL FROM Reference

Common causes of 5.7.57

  • SMTP AUTH is disabled for the tenant or for the specific mailbox
  • The client is connecting to port 25 instead of 587 or 465
  • No authentication was attempted before MAIL FROM
  • Security defaults are enabled on the tenant, which block basic authentication
  • The application uses basic authentication where the tenant requires OAuth
  • STARTTLS was not negotiated, so the server refused to accept credentials

How to fix 5.7.57

  • Enable authenticated SMTP for the specific mailbox, not just at tenant level
  • Connect on port 587 with STARTTLS, or 465 with implicit TLS, never port 25
  • Authenticate before issuing MAIL FROM
  • If security defaults block basic authentication, move the application to OAuth 2.0
  • Consider a connector or a dedicated relay for applications that cannot authenticate
  • Check 535 and 5.7.8 if credentials are being offered and rejected rather than absent

Frequently asked questions

What does 5.7.57 mean?
It means Exchange Online received your message on the submission port without the client having authenticated. The message text usually says the SMTP server requires a secure connection or the client was not authenticated. It is the most common error when connecting an application to Microsoft 365 for the first time.
My credentials are correct, so why does this happen?
Because SMTP AUTH is disabled by default on new Microsoft 365 tenants, and the setting exists per mailbox as well as tenant-wide. Correct credentials on a mailbox with authenticated SMTP switched off produce exactly this error. Enable it on the specific mailbox rather than assuming the tenant setting covers it.
Which port should I use?
Port 587 with STARTTLS for authenticated submission, or 465 with implicit TLS. Port 25 is for server-to-server relay and Exchange Online will not accept authenticated submission on it. An application configured for port 25 will keep failing regardless of how correct its credentials are.
How is 5.7.57 different from 535?
They fail at different points. 5.7.57 means no authentication was performed at all, or the connection was not secure enough for the server to accept credentials. A 535 means credentials were offered and rejected. The first is a configuration problem, the second a credentials problem.
What if my application cannot do OAuth?
Use a Microsoft 365 connector, which authorises a sending IP address rather than a mailbox, or send through a dedicated relay service with an API key. Both are better than keeping basic authentication alive on a mailbox, which Microsoft is progressively removing.

Related bounce codes

535 Authentication Failed 5.7.8 Authentication Credentials Invalid 530 Authentication Required 5.7.13 User Account Disabled 5.7.0 Other Security or Policy Status

Sources & further reading

Exchange Online NDR reference · Microsoft list of SMTP errors returned by Exchange Online
Reviewed by Jennifer Jackson, Email Deliverability Analyst · June 2026 ← All bounce codes