SMTP Error 535: Authentication Failed
SMTP Error 535 means “Authentication Failed.” SMTP AUTH was attempted and rejected. The username or password is wrong, expired, or not permitted for this connection. It is the single most common error when an application first tries to send.
535 5.7.139 Authentication unsuccessful, SMTP AUTH is disabled for the mailboxWhat does 535 mean?
SMTP reply code 535 means authentication failed. It arrives immediately after an AUTH command and is nearly always accompanied by an enhanced code that narrows the reason, most often 5.7.8 for invalid credentials. It is the error almost every developer meets the first time an application tries to send through a real mail server.
The credentials being wrong is only one possibility, and often not the interesting one. Providers have spent several years removing the ability to authenticate with a plain account password. Google returns 535 5.7.80 for a username and password not accepted, and 534 5.7.90 when an application-specific password is required instead. Microsoft returns 535 5.7.139 when SMTP AUTH is disabled for the tenant or the mailbox, and 535 5.7.142 or 5.7.143 when an OAuth token has expired. In each of those the password may be perfectly correct and still refused.
The durable fix is to stop authenticating as a person. An application holding a user's mailbox password breaks whenever that person changes it, leaves, or has multi-factor authentication enabled, and it is the pattern every provider is actively closing off. Move to OAuth 2.0, or to a dedicated relay with an API key issued for the purpose.
How 535 plays out
535 rejectionWhere 535 sits: soft vs hard bounce
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| SMTP class | 4xx | 5xx |
| What to do | Let it retry | Suppress the address |
| Recoverable? | Often | No |
| 535 is | ✓ this code |
What each provider means by 535
A registered code does not oblige a provider to use it that way, and the large ones diverge. Match the wording in your own bounce, not the definition above.
Common causes of 535
- The username or password is genuinely incorrect or has been changed
- SMTP AUTH is disabled for the tenant or for the specific mailbox
- The account has multi-factor authentication and requires an app password
- An OAuth access token has expired or was revoked
- Authentication was attempted before STARTTLS, and the server refuses credentials in cleartext
- The wrong authentication mechanism was offered, such as LOGIN where only XOAUTH2 is permitted
How to fix 535
- Confirm SMTP AUTH is enabled for the mailbox, not just that the password is right
- Move to OAuth 2.0 rather than storing an account password in an application
- Where OAuth is unavailable, issue an app password instead of using the login password
- Start TLS before authenticating, since most servers refuse credentials on a cleartext session
- Use port 587 with STARTTLS, or 465 with implicit TLS, rather than port 25 for submission
- Send through a dedicated relay with an API key rather than a personal mailbox