SMTP "535 Authentication Failed" Error: Causes and Fixes

An SMTP 535 reply means the mail server rejected the login you offered when you tried to send. The server was reached and it understood the request, but the username, password or authentication method was not accepted. The message is not delivered at all, because the server will not accept mail from an unauthenticated client.

You see it in an email client, a CMS or WordPress mail plugin, a script using smtplib, Nodemailer or PHPMailer, or a monitoring tool trying to send alerts. Typical wordings:

535 5.7.8 Authentication failed
535-5.7.8 Username and Password not accepted. For more information, go to https://support.google.com/mail/?p=BadCredentials
535 5.7.3 Authentication unsuccessful
535 5.7.139 Authentication unsuccessful, basic authentication is disabled

Causes, most likely first

1. Wrong username or password. Often a stale saved password, a typo, or the plain login password used where the provider wants an app-specific one.
2. Username format. Most providers want the full email address, not just the part before the at sign.
3. The provider no longer allows basic password login for SMTP, or requires an app password, OAuth or an API key.
4. Wrong host, port or encryption pairing. For example, SSL/TLS selected on port 587, or plain text on 465, which can fail in confusing ways.
5. Special characters mangled by the application, a config file or an environment variable, such as $, #, %, quotes or a trailing newline.
6. Account lockout or security block after repeated failures, or a fail2ban ban on your own server.
7. Using a web login for an SMTP-only credential, such as an API key that must be used with a fixed username (some providers use a literal username such as apikey; check your provider's documentation).

Step 1: test the login outside your application

Take your application out of the equation with a command line test. With swaks (from your package manager):

swaks --to test@example.org --from you@example.com \
  --server smtp.example.com --port 587 --tls \
  --auth LOGIN --auth-user you@example.com --auth-password 'your-password'

If this fails with 535, the credentials or provider settings are wrong. If it succeeds, the problem lives in the application configuration, probably escaping or the wrong port.

You can also test manually and see the server's capabilities:

openssl s_client -starttls smtp -connect smtp.example.com:587 -crlf -quiet
EHLO test.example.com

Look at the AUTH line in the response, for example 250-AUTH PLAIN LOGIN. If AUTH is not offered, you are probably before STARTTLS or on the wrong port. For implicit TLS use openssl s_client -connect smtp.example.com:465 -crlf -quiet.

Step 2: match the provider's current requirements

Providers change authentication rules, so check their current documentation rather than old tutorials.

• Gmail and Google Workspace. The old "less secure apps" password login has been discontinued. Use an app password (requires 2-step verification) or OAuth. The username is the full address.
• Microsoft 365 and Outlook.com. Microsoft has been moving SMTP AUTH away from basic authentication toward OAuth, and tenants may have SMTP AUTH client submission turned off. Check Microsoft's current guidance and your tenant's setting for the mailbox.
• Hosted mailboxes (cPanel, Zoho, and others). Use the mailbox's full address and its own password, with the host name given in the mail setup page, which is often not localhost or your domain.
• Transactional services. Use the SMTP credentials the service generated for you, not your dashboard login.

Step 3: align port and encryption

Confirm the port is reachable with the Port Checker. A timeout is a network block, not a 535.

Step 4: escape special characters

If the password contains $ or # and lives in a .env, YAML or shell file, wrap it in quotes and check for stray whitespace or a trailing newline:

# .env
SMTP_PASSWORD='pa$$word#1'

When in doubt, generate a new password without special characters, or an app-specific one, and retry. In Nodemailer or PHPMailer set secure or SMTPSecure to match the port: implicit TLS on 465, STARTTLS on 587.

Step 5: rule out lockouts

After many failures, providers can temporarily block the account or IP. On your own mail server, look for bans:

sudo fail2ban-client status postfix-sasl
sudo grep "authentication failed" /var/log/mail.log | tail

Unban the address with sudo fail2ban-client set postfix-sasl unbanip 198.51.100.9 (jail name varies). On Postfix with Dovecot SASL, also check the Dovecot auth log for the reason, such as an unsupported mechanism.

How to verify

Run the same swaks command and look for 235 2.7.0 Authentication successful followed by a 250 acceptance. Then send from your real application and confirm delivery. If messages now send but land in spam, check records with the Email DNS Checker. To confirm your sending IP has no listing, use the Blacklist Checker.

Next steps

• Confirm the SMTP port is open with the Port Checker.
• Check where your mail is hosted with the MX Lookup.
• Read WordPress email not sending fix if the sender is WordPress.
• See SMTP relay access denied if login works but sending is refused.

FAQ

Does 535 mean my password is wrong?

Often, but not always. The server also returns 535 when basic authentication is disabled, the account is locked, or the application sends the credentials in an unsupported way.

Why does Gmail say "Username and Password not accepted" with the right password?

Gmail needs an app password or OAuth for SMTP clients. Your normal account password is usually refused.

Do I need to enable two-factor authentication?

For app passwords at Google, yes. App passwords are generated only for accounts with 2-step verification enabled.

Can a wrong port produce a 535?

It can produce a variety of errors, including a 535 or a handshake failure. Match SSL/TLS to 465 and STARTTLS to 587.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.