SMTP Authentication Failed Error

Editorial Team·1 months ago

019513 minutes read

Quick answer: An SMTP authentication failed error means the outgoing mail server rejected the login credentials. The most common causes are an incorrect or outdated password, an app-specific password being required (Gmail/Yahoo with 2FA), SMTP AUTH being disabled on the server (Microsoft 365), or a port/encryption mismatch. Verifying credentials and SMTP settings against the provider's current documentation resolves the majority of cases.

"Cannot Send Email — Authentication Failed" — What the SMTP Error Actually Means

A situation that comes up regularly when configuring email clients or applications that send email: the setup appears correct, the account receives email without problems, but sending fails with an error like "SMTP Authentication Failed," "535 Authentication credentials invalid," or "Cannot connect to outgoing mail server." The receiving side (IMAP) works because it only needs to read messages from the server. The sending side (SMTP) fails because the server is rejecting the credentials being used to authenticate the outgoing connection. The two sides of an email account can fail independently, which is why IMAP working does not mean SMTP will work. This guide covers the most common causes of SMTP authentication failed errors and the steps to fix them — for Gmail, Outlook, Microsoft 365, Yahoo Mail, and custom mail servers. SMTP authentication requirements have become more complex in recent years as providers move toward app-specific passwords and modern authentication; the details here reflect current best practice as of mid-2026, and verifying current SMTP settings against the provider's documentation before configuring is always recommended.

How SMTP Authentication Works — and Why It Fails

SMTP (Simple Mail Transfer Protocol) is the protocol used to send email. When an email client or application sends a message, it connects to the SMTP server and authenticates using a username and password before the server will accept the message for delivery. This authentication step — called SMTP AUTH — is what prevents unauthorized parties from using the mail server to send email. If authentication fails, the server returns an error code and the message is not sent. The most common SMTP error codes for authentication failures are: 535 (5.7.8 Authentication credentials invalid — the username or password was rejected), 534 (5.7.9 Authentication mechanism too weak — the client is using an authentication method the server does not accept), 530 (5.7.0 Authentication required — the client attempted to send without authenticating), and 538 (5.7.11 Encryption required for requested authentication mechanism — the client is not using the required encryption). Understanding which error code is returned narrows the cause significantly. Provider-side requirements for SMTP authentication have changed substantially in recent years. Google has moved away from allowing basic username/password authentication for SMTP when 2FA is enabled, requiring app-specific passwords instead. Microsoft has been disabling basic SMTP authentication (SMTP AUTH) for Microsoft 365 accounts as a security measure, requiring modern authentication (OAuth) for some configurations. Yahoo requires app passwords for SMTP access. These changes mean that SMTP configurations that worked previously may stop working after a provider policy change, even if no settings were changed on the client side.

SMTP Authentication Failed — 5 Common Causes and Fixes

Error Code / SymptomLikely CauseFix535 — Credentials invalidWrong password or app password neededGenerate app password; update credentials534 — Auth mechanism too weakBasic auth not accepted; OAuth requiredUpdate client; enable modern auth530 — Authentication requiredSMTP AUTH not enabled in clientEnable authentication in SMTP settingsConnection refused / timeoutWrong port or firewall blocking SMTPUse port 587 (STARTTLS) or 465 (SSL)SMTP AUTH disabled (Microsoft 365)Admin policy disabled SMTP AUTHIT admin enables SMTP AUTH for mailbox

1. Incorrect Password or App-Specific Password Required

The most common cause of SMTP error 535 is an incorrect password — including a password that was recently changed and not updated in the email client or application. A subtler but equally common cause is that the provider requires an app-specific password for SMTP access when two-factor authentication is enabled, and the regular account password is being used instead. Gmail and Yahoo both require app-specific passwords for SMTP when 2FA is active — the regular password will be rejected with a 535 error even though it is correct for web login. For Gmail, generate an app password at myaccount.google.com/apppasswords — the Google account must have 2FA enabled to access this page. Select "Mail" as the app type and generate the password. Use the 16-character code as the SMTP password in the email client or application. For Yahoo Mail, generate an app password at login.yahoo.com/account/security under "Generate app password." After generating the app password, update the SMTP password field in the email client's account settings and test sending. If the error persists after using the app password, verify that the SMTP username is the full email address (not just the username portion before the @).

2. SMTP AUTH Disabled for Microsoft 365 Accounts

Microsoft has been disabling basic SMTP authentication (SMTP AUTH) for Microsoft 365 accounts as a security measure. When SMTP AUTH is disabled at the organizational level, any application or email client that uses basic SMTP authentication (username and password) to send email will receive an authentication error — even with the correct credentials. This affects applications that send email via SMTP, such as CRM systems, monitoring tools, and legacy email clients that do not support modern authentication. The fix requires action by the Microsoft 365 administrator. SMTP AUTH can be enabled for specific mailboxes in the Microsoft 365 admin center under Users > Active Users > [User] > Mail > Manage email apps > Authenticated SMTP. It can also be enabled using PowerShell with the command `Set-CASMailbox -Identity [user] -SmtpClientAuthenticationDisabled $false`. For applications that need to send email via SMTP, Microsoft recommends using a dedicated service account with SMTP AUTH enabled, or migrating to a sending method that supports modern authentication (such as Microsoft Graph API for application email sending). Checking with the IT administrator before troubleshooting other causes is recommended for Microsoft 365 business accounts.

3. Wrong SMTP Port or Encryption Setting

SMTP connections use different ports depending on the encryption method: port 25 is the traditional SMTP port used for server-to-server delivery (most providers block port 25 for client connections to prevent spam); port 465 uses SSL/TLS encryption from the start of the connection; port 587 uses STARTTLS, which upgrades a plain connection to encrypted after the initial handshake. Using the wrong port or the wrong encryption setting results in connection failures or authentication errors — a client configured for port 465 with STARTTLS, for example, will fail because port 465 expects SSL/TLS, not STARTTLS. The current standard for client SMTP connections is port 587 with STARTTLS, which is supported by Gmail, Outlook.com, Yahoo Mail, and most other providers. Port 465 with SSL is also supported by Gmail and Yahoo. Port 25 is generally not available for client connections. Verifying the port and encryption setting against the provider's documentation and ensuring they match — port 587 with STARTTLS, or port 465 with SSL — resolves connection and authentication errors caused by port mismatches.

4. SMTP Authentication Not Enabled in the Email Client

Some email clients and applications have SMTP authentication disabled by default, or have it configured to "None" rather than "Normal password" or "Encrypted password." When authentication is disabled, the client attempts to send without providing credentials — the server returns a 530 error (5.7.0 Authentication required) because it requires authentication before accepting messages. This is a configuration issue in the client rather than a credentials issue. In most email clients, SMTP authentication is configured in the outgoing server settings. In Thunderbird, go to Account Settings > Outgoing Server (SMTP) > [Server] > Edit > Authentication method — set it to "Normal password" or "OAuth2" depending on the provider's requirements. In Apple Mail, go to Mail > Preferences > Accounts > [Account] > Server Settings > Outgoing Mail Server > Authentication — set it to "Password." In Outlook (as an IMAP/SMTP client), go to File > Account Settings > Account Settings > [Account] > Change > More Settings > Outgoing Server > check "My outgoing server (SMTP) requires authentication."

5. Account Temporarily Blocked Due to Suspicious Activity

⚠️ Worth checking if credentials are confirmed correct: Email providers temporarily block SMTP access for accounts that show signs of suspicious activity — a large number of failed authentication attempts, sending patterns that resemble spam, or login from an unfamiliar IP address. When an account is temporarily blocked, SMTP authentication fails even with the correct credentials. The block typically resolves automatically after a period of time (minutes to hours depending on the provider), but the account may also require the account holder to verify their identity through the provider's web interface. Logging into the account through the provider's web interface and checking for any security alerts or verification prompts is the first step when credentials are confirmed correct but authentication is still failing.

Step-by-Step: How to Fix SMTP Authentication Failed

Step 1: Note the Exact Error Code and Verify SMTP Settings

Note the exact error code returned by the SMTP server — 535, 534, 530, or another code — as this narrows the cause. Then verify the SMTP settings in the email client against the provider's current documentation. For Gmail: server smtp.gmail.com, port 587 (STARTTLS) or 465 (SSL), authentication required, username is the full Gmail address. For Outlook.com: server smtp.office365.com, port 587, STARTTLS, authentication required. For Yahoo Mail: server smtp.mail.yahoo.com, port 587 (STARTTLS) or 465 (SSL), authentication required. Correct any discrepancies and test sending before proceeding to other steps.

Step 2: Generate and Use an App-Specific Password

If the account has two-factor authentication enabled (Gmail, Yahoo, or other providers that require app passwords for SMTP), generate an app-specific password and use it as the SMTP password. For Gmail: myaccount.google.com/apppasswords > Select app: Mail > Generate. For Yahoo: login.yahoo.com/account/security > Generate app password. Enter the 16-character code as the SMTP password in the email client's outgoing server settings. If the email client was previously configured with the regular account password, update the SMTP password field with the app password and test sending.

Step 3: Enable SMTP Authentication in the Email Client

Confirm that SMTP authentication is enabled in the email client's outgoing server settings. The setting is typically labeled "My outgoing server requires authentication," "Authentication method," or similar. Set it to "Normal password" (or "Password") for providers that use basic authentication, or "OAuth2" for providers that require modern authentication. If the authentication method is set to "None" or "Anonymous," the server will reject the connection with a 530 error.

Step 4: For Microsoft 365 — Enable SMTP AUTH for the Mailbox

If the account is a Microsoft 365 business account and SMTP AUTH has been disabled by the organization's administrator, contact the IT administrator to enable SMTP AUTH for the affected mailbox. The administrator can enable it in the Microsoft 365 admin center under Users > Active Users > [User] > Mail > Manage email apps > Authenticated SMTP, or via PowerShell. If SMTP AUTH cannot be enabled due to organizational policy, consider using Microsoft Graph API for application email sending, or using a dedicated SMTP relay service that supports modern authentication.

Step 5: Check for Account Security Alerts and Temporary Blocks

Log into the email account through the provider's web interface and check for any security alerts, verification prompts, or account activity notifications. Google may display a "Critical security alert" if it detected unusual SMTP activity. Microsoft may show a sign-in risk alert in the account security settings. Yahoo may prompt for account verification. Completing any required verification steps through the web interface typically restores SMTP access within a few minutes. After resolving any security alerts, test SMTP sending from the email client.

Frequently Asked Questions — SMTP Authentication Failed

What does SMTP authentication failed mean?

It means the outgoing mail server rejected the login credentials provided during the SMTP connection. Common causes include an incorrect password, an app-specific password being required (Gmail/Yahoo with 2FA), SMTP AUTH being disabled on the server (Microsoft 365), or the client using an authentication method the server does not support.

What is SMTP error 535?

SMTP error 535 (535 5.7.8 Authentication credentials invalid) means the username and password were rejected by the SMTP server. It is the most common SMTP authentication error. Causes include an incorrect password, a recently changed password not updated in the client, or an app-specific password being required instead of the regular account password.

Why does SMTP authentication fail even with the correct password?

The provider may require an app-specific password for SMTP when 2FA is enabled (Gmail, Yahoo), or may require modern authentication (OAuth) rather than basic username/password (Microsoft 365). The account may also be temporarily blocked due to suspicious activity. Checking whether an app password is required and verifying the SMTP port and encryption settings resolves most cases.

What are the correct SMTP settings for Gmail?

Gmail SMTP: server smtp.gmail.com, port 587 (STARTTLS) or 465 (SSL), authentication required, username is the full Gmail address. If 2FA is enabled, use an app password from myaccount.google.com/apppasswords instead of the regular account password. Verify against Google's current documentation before configuring.

How do I fix SMTP authentication failed in Outlook?

For Outlook.com: verify settings (smtp.office365.com, port 587, STARTTLS, authentication enabled) and ensure the password is current. For Microsoft 365 business accounts: contact the IT administrator to enable SMTP AUTH for the mailbox in the Microsoft 365 admin center, or use an alternative sending method that supports modern authentication.

Conclusion & My Take

SMTP authentication failed errors are almost always caused by one of five things: incorrect credentials (including the app password requirement), SMTP AUTH being disabled at the server level, a wrong port or encryption setting, authentication not being enabled in the email client, or a temporary account block. The error code returned by the server — 535, 534, 530 — is the most reliable indicator of which cause applies, and working through the fixes in the order that matches the error code resolves the problem efficiently. The Microsoft 365 SMTP AUTH situation is worth highlighting for organizations that use Microsoft 365 and have applications or legacy email clients that send via SMTP. Microsoft's move to disable basic SMTP authentication by default is a security improvement, but it breaks existing SMTP configurations without warning. Organizations that discover this issue after a Microsoft 365 policy change should evaluate whether enabling SMTP AUTH for specific mailboxes is the right approach, or whether migrating to a sending method that supports modern authentication (Microsoft Graph API, a dedicated SMTP relay service) is more appropriate for the long term. Have you encountered an SMTP authentication error that was caused by a provider policy change rather than a configuration mistake, or found a workaround for a specific application that does not support modern authentication? SMTP authentication requirements vary significantly by provider and change over time — feel free to share your experience in the comments below.