SMTP error 504, what it means and what to do
RFC 5321 defines 504 as "Command parameter not implemented": the server understood the command but not the option attached to it. In modern mail the overwhelmingly common case is authentication: the client issues AUTH with a mechanism the server does not support (for example CRAM-MD5 or a vendor-specific method), and the server answers 504 with enhanced code 5.7.4, "Unrecognized authentication type". It is a negotiation mismatch, not a credential failure; no password was ever checked.
The fix, in order
- See what the server actually offers. The server's EHLO response lists its AUTH mechanisms (for example PLAIN, LOGIN, XOAUTH2). Any tool that shows the SMTP conversation, or a manual EHLO over a TLS session, reveals the list the client must choose from.
- Set the client to a supported mechanism. In the outgoing server settings, pick an authentication method the server advertises, typically Normal password (PLAIN) or Encrypted password only if listed. Automatic mechanism selection in some clients and libraries picks exotic methods first; pinning it to a listed one ends most 504s.
- Authenticate after STARTTLS, not before. Many servers only advertise AUTH once the connection is encrypted. A client that attempts authentication on the plain connection can get 504 because, pre-TLS, no mechanism exists from the server's point of view. Port 587 with STARTTLS in the client settings is the standard arrangement.
- Check for proxy and gateway interference. Mail security gateways sometimes strip or alter EHLO keywords, so the client sees (or misses) mechanisms the real server did not publish. Testing from a path that bypasses the gateway separates this from a genuine server limitation.
- If you run the server: configure the authentication mechanisms deliberately and confirm they appear in EHLO. After disabling a mechanism for security reasons (a common hardening step), expect clients still configured for it to surface with 504 until their settings are updated.
- For scripts and applications: mail libraries expose the mechanism explicitly; set it (commonly PLAIN or LOGIN) rather than accepting a default that negotiates to something the receiving submission service does not offer, such as GSSAPI on a non-domain machine.
If it still happens
A 504 contains no judgment about the account or password: the conversation failed at the how-shall-we-authenticate stage. Once the mechanism matches the server's published list and the connection is encrypted first, the same credentials that never got tested usually authenticate immediately, or produce an honest 535 if they are genuinely wrong.
Common questions
What is the difference between 504 and 535? 504 means the authentication method itself was not recognized, so no credentials were evaluated. 535 means a recognized method was used and the credentials were rejected. Fixing 504 is about settings; fixing 535 is about the password.
Why did 504 start after a server upgrade? Upgrades and hardening passes commonly remove older authentication mechanisms such as CRAM-MD5. Clients still configured for a removed mechanism negotiate into a wall and report 504 until switched to a surviving method.
Related errors