Skip to content
Standard SMTP codes · temporary error

432 4.7.12: password transition needed

A temporary login reply: the user has to move to the authentication method that was requested, which is usually done by logging in once with the PLAIN method.

Standard
Provider
Temporary (4xx)
Class
Sources checked
Author

At a glance

Code
432 4.7.12
Temporary or permanent
TemporaryThe sending server keeps the message and tries again later.
Who has to act
The sender. The fix is on the sending side: your domain, your server or your list.
What the server says
432 4.7.12 A password transition is needed

What it means

RFC 4954 defines 432 4.7.12 as the reply when a user has to make a transition to the selected authentication mechanism. The RFC says this is typically done by authenticating once with PLAIN, after which the requested mechanism should work in later sessions. It is a 4xx reply, so nothing is lost: the client is expected to try again, with PLAIN over an encrypted connection, and then use the requested mechanism from then on. The registry also lists reply 422 for this code.

Common causes

  • A server that can only set up the requested mechanism after one login with PLAIN.
  • A newly created or migrated account with no stored credentials yet for the requested mechanism.

How to fix it

  1. 01Log in once with the plain password method over TLS, then switch the client back to the requested method.
  2. 02Retry later with the original mechanism.
  3. 03If it keeps happening, ask the server's administrator to check the account's credential setup.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

  1. 432Password transition needed.A temporary reply to a login attempt: the user has to move to the authentication method that was requested, which is usually done by logging in once with the PLAIN method.StandardTemporary
  2. 535 5.7.8Login failed: invalid credentials.The SMTP server rejected the login because the username, password or token was wrong or not sufficient, so it will not accept mail from this session.StandardPermanent

All 105 standard codesEvery code in the wikiPaste your own bounce

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule: 41 checks, 33 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.

example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 33

Illustrative. Your domain, every few hours.

Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer