538 5.7.11: encryption required for this login method
The chosen authentication method may only be used over an encrypted connection, and the current SMTP connection is not encrypted.
- Standard
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 538 5.7.11
- Provider
- Standard SMTP codes
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
538 5.7.11 Encryption required for requested authentication mechanism
What it means
RFC 4954 defines 538 5.7.11 for an AUTH command that uses a mechanism the server allows only once the connection is encrypted. The RFC notes the code is documented for historical purposes: modern servers should not offer such mechanisms until TLS is active, so a well-behaved client never gets this reply. When it does appear, the client is logging in without TLS. The registry also lists reply 524 for it. The fix is the same as for 5.7.10: start TLS, then authenticate.
Common causes
- A client configured to connect without STARTTLS or TLS.
- An older server that advertises mechanisms it then refuses on unencrypted connections.
How to fix it
- 01Enable STARTTLS or implicit TLS in the client's outgoing server settings.
- 02Use the port the provider documents for encrypted submission.
- 03Update the client if it ignores the server's STARTTLS offer.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 538Encryption required for this login method.The authentication method the client chose is only allowed over an encrypted connection, and this connection is not encrypted.
- 5.7.10Encryption needed.The server requires an encrypted connection (TLS) before this kind of login can happen, or a message that demands TLS could not be passed on securely.
- 530Authentication required.The server requires the client to log in, or to start TLS, before it accepts this command, which usually means before it accepts any mail.
5.7.11 at other providers
All 105 standard codesEvery code in the wikiPaste your own bounce