🇩🇪 DE 🇬🇧 EN
AUTH 535 5.7.8

“535 5.7.8 Authentication credentials invalid” — SMTP login refused

This message appears at submission, not at delivery — your program logs in to an outgoing server and is turned away. In most cases the password is correct and still wrong.

How the message looks
535 5.7.8 Error: authentication failed: authentication failure 535-5.7.8 Username and Password not accepted. For more information, go to https://support.google.com/mail/?p=BadCredentials 535 5.7.139 Authentication unsuccessful, basic authentication is disabled

Why a correct password gets rejected

The most common reason today is not a typo but a policy. Large providers have retired plain login with the account password:

  • Two-factor authentication is on. A program that cannot prompt for a second factor needs its own app password. The regular account password is then rejected on principle, no matter how often you retype it.
  • Basic auth is disabled. The extra code 5.7.139 in the reply is the unambiguous signature of this in Exchange Online. Only OAuth 2.0 or an account explicitly cleared for it helps — a different password changes nothing.
  • SMTP AUTH is blocked for this mailbox. In hosted environments that is often the default and has to be enabled per mailbox. Webmail login keeps working meanwhile — which reliably misleads.

Username and connection

  1. Full address rather than a short name. Many servers expect name@yourdomain.com, not name. Some accept both, some only one form.
  2. Port and encryption have to match. 587 with STARTTLS or 465 with implicit TLS. The combination “587 without encryption” fails at nearly every provider, often before the password is even checked.
  3. The right host. The outgoing server is not the domain's MX record. Entering the MX as the sending server means logging in to the inbound server, which offers no login at all.
  4. Account temporarily locked. After several failed attempts providers lock login for a while. Then even the now-correct password fails — wait rather than keep trying.

Reproducing it cleanly

The dialogue can be walked through by hand, which rules out client quirks:

openssl s_client -starttls smtp -crlf -connect smtp.yourprovider.com:587

Send EHLO test once connected. If the reply contains no 250-AUTH, the server offers no login on this path at all — then the port choice is the problem, not the password.

What this message is not

It has nothing to do with SPF, DKIM or DMARC. Those decide whether a delivered mail counts as genuine; here the attempt to submit it fails in the first place. Nor is it a reputation block — that would arrive as 5.7.1 and only after a successful login.

Find the cause in the actual message

Send or forward the affected email to hello@analyzemy.email. For that exact message the report shows which IP sent it, how SPF, DKIM and DMARC turned out, and where the chain breaks.

Analyze your email now

Last updated: · All error messages