SMTP 503 Bad Sequence of Commands: Causes and Fixes

A 503 reply means the SMTP commands arrived in an order the server will not accept. RFC 5321 defines the text as "Bad sequence of commands". SMTP is a strict conversation: greeting, EHLO, optional STARTTLS and AUTH, then MAIL FROM, one or more RCPT TO, DATA, and finally QUIT. A client that skips or repeats a step gets 503.

503 5.5.1 Error: send HELO/EHLO first
503 5.5.1 Error: need RCPT command
503 5.5.1 Error: need MAIL command
503 5.5.1 Error: authentication not enabled
503 5.5.1 Bad sequence of commands
503 5.5.1 Error: nested MAIL command

Gmail documents several 503 variants, such as "EHLO/HELO first", "RCPT first", "No DATA after BDAT" and 5.7.0 No identity changes permitted. Check its current SMTP reference for exact wording.

Causes, most likely first

1. No EHLO/HELO before MAIL FROM, or a second EHLO that the server rejects after TLS or AUTH.
2. DATA before any valid RCPT TO. If every recipient was refused, a client that blindly continues to DATA gets "need RCPT command".
3. AUTH sent at the wrong time: after MAIL FROM has started, or twice, or on a server where authentication is not offered.
4. Pipelining mistakes, where a client sends commands in a batch and does not handle an early failure.
5. A proxy, firewall or "SMTP fixup" feature that rewrites or reorders traffic.
6. A script talking raw SMTP with a hand-built conversation.

Step 1: find the first error, not the 503

The 503 is often a symptom. The earlier line that failed explains it. Capture the conversation (your library's debug mode, or openssl s_client -starttls smtp -crlf) and read from the top:

C: EHLO app01
S: 250-mail.example.com
S: 250 STARTTLS
C: MAIL FROM:<noreply@example.com>
S: 530 5.7.0 Must issue a STARTTLS command first
C: RCPT TO:<user@example.net>
S: 503 5.5.1 Error: need MAIL command

Here the real error is the 530; see SMTP 530 must issue a STARTTLS command first. The 503 followed because MAIL FROM never succeeded.

Step 2: check the required order

The minimal valid transaction:

EHLO client.example.com
MAIL FROM:<sender@example.com>
RCPT TO:<recipient@example.net>
DATA
(message headers and body)
.
QUIT

If TLS is used: EHLO, STARTTLS, the TLS handshake, then EHLO again. After STARTTLS the server discards what it learned, so your client must send a new EHLO. A client that skips the second EHLO gets "send HELO/EHLO first". For authenticated submission the order is: EHLO, STARTTLS, EHLO, AUTH, MAIL FROM. Confirm the port and encryption mode; submission on 587 uses STARTTLS and port 465 uses implicit TLS from the first byte. The Port Checker tells you which ports respond, and the TLS Version Checker shows supported TLS versions.

Step 3: fix common client bugs

• Using the wrong security mode. Library options like ssl=True on port 587 or starttls on 465 break the sequence. Match mode to port.
• Connection reuse after failure. If a transaction fails, send RSET before starting a new MAIL FROM, or open a new connection. Starting a new MAIL while one is open produces "nested MAIL command".
• Sending to a list where all recipients fail. Check each RCPT response and abort if none were accepted.
• Sending AUTH more than once per session. Authenticate once.

In Python's smtplib, the pattern is:

with smtplib.SMTP("smtp.example.com", 587) as s:
    s.ehlo()
    s.starttls()
    s.ehlo()          # required again after STARTTLS
    s.login(user, pw)
    s.sendmail(sender, recipients, msg)

Step 4: rule out middleboxes

Some firewalls have an SMTP inspection feature (Cisco's ASA "fixup"/inspect, for example) that mangles commands and breaks ESMTP extensions. If the same client works from another network, disable SMTP inspection for that path or switch to an alternative submission port. Compare using another network, and verify the provider's MX with the MX Lookup.

How to verify

A clean manual session ends with 250 2.0.0 OK after the final period. Send a real message and verify status=sent in the logs. Finish with the Email Deliverability Test to check that the same path also passes authentication.

Next steps

• Read SMTP 501 syntax error in parameters for malformed arguments.
• See SMTP 535 authentication failed for credential errors.
• Learn the code families in email bounce codes explained.
• Check WordPress email not sending if the sender is a plugin.

FAQ

Is 503 temporary or permanent?

It is a permanent error for that session. Retrying the same bad sequence fails again; fix the client order.

Why do I get 503 only after STARTTLS?

The client probably did not repeat EHLO after the TLS handshake. The server resets its state at that point.

Can a firewall cause it?

Yes. SMTP inspection features can alter or drop commands. Test from a different network to confirm.

Is a bad sequence the same as a syntax error?

No. Syntax errors (501) mean a malformed command; 503 means a valid command at the wrong time.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.