SMTP error 535, what it means and what to do
Error 535, formally "Authentication credentials invalid" (enhanced code 5.7.8), is refreshingly specific: the connection reached the mail server, an authentication method was agreed on, and the username and password combination was refused. The server is reachable and speaking SMTP; the identity proof failed. That confines the fault to the credentials themselves, how they are being presented, or the account's security state.
The fix, in order
- Use the full email address as the username. Most submission servers expect the complete address, not the part before the @. A bare username is the single most common cause of 535 on an otherwise correct password.
- Re-type the password by hand. Saved passwords go stale after any password change, and copy-paste can carry a trailing space. Enter the current password manually in the outgoing server settings, not only in the incoming settings; clients store them separately.
- Use an app password where two-step verification is on. Accounts with 2-step verification often refuse the normal password from mail clients and scripts. Generate an app password in the account's security settings and use it in the client. Google and Microsoft accounts both behave this way.
- Check for account locks and security holds. Sign in to the account on the web. A locked account, a forced password reset, or a suspicious-activity hold all surface in the client as 535 while the web sign-in shows the real reason in plain language.
- Verify the authentication mechanism. The client must offer a mechanism the server accepts (commonly PLAIN or LOGIN over a TLS connection). If the response mentions the mechanism, align the client's setting, and always authenticate over STARTTLS on port 587 so the credentials are not sent in the clear.
- If you run the server: check the authentication backend (the user database, password hashing compatibility, and any per-user SMTP restrictions) and the logs, which record whether the user was unknown, the password mismatched, or the account was administratively blocked from submitting.
If it still happens
A 535 that appears suddenly across many users of one service is rarely forty simultaneous password mistakes; it is the provider's authentication backend or a policy change (such as basic authentication being disabled, as major providers have done). Checking the provider's status and announcements is the correct move before resetting anything.
Common questions
Does 535 mean my account is hacked? No. It means the presented credentials were rejected. That includes the mundane majority: an old saved password, a missing app password, or a username in the wrong format. A lock discovered in step 4 can follow suspicious activity, but 535 alone is not evidence of it.
Why does receiving mail work while sending gives 535? Receiving and sending authenticate separately, sometimes against different servers with separately stored passwords in the client. Updating the password in one place and not the other produces exactly this split.
Related errors