534 5.7.9: authentication method too weak
The server refused the login because the chosen authentication method is weaker than its policy allows for this user; the client should pick a stronger one.
- Standard
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 534 5.7.9
- Provider
- Standard SMTP codes
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
534 5.7.9 Authentication mechanism is too weak
What it means
RFC 4954 defines 534 5.7.9 as the reply to an AUTH command using a mechanism weaker than server policy permits, and says the client should retry with another mechanism. It is a login error, so it affects every message from that client until the setting changes. Separately, some mailbox providers send 5.7.9 when they reject incoming mail under their own policies, which has nothing to do with logging in. When the bounce comes from the recipient's server rather than from your own outgoing server, read the reply text and that provider's documentation.
Common causes
- A client set to an older or plain authentication method the server no longer allows for this account.
- An account policy that requires a stronger method such as OAuth.
How to fix it
- 01Change the client's authentication setting to a method the server lists in its EHLO reply.
- 02If the provider requires OAuth, use a client that supports it.
- 03If the 5.7.9 came from a recipient's server during delivery, follow that provider's guidance instead.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 534Authentication method too weak.The server refused the login because the authentication method the client chose is weaker than its policy allows for this user.
- 535 5.7.8Login failed: invalid credentials.The SMTP server rejected the login because the username, password or token was wrong or not sufficient, so it will not accept mail from this session.
- 538 5.7.11Encryption required for this login method.The chosen authentication method may only be used over an encrypted connection, and the current SMTP connection is not encrypted.
- 5.7.4Security feature not supported.The message or session asked for a security feature, such as a form of secure authentication, that the delivery protocol here cannot support.
5.7.9 at other providers
- 534 5.7.9App password required.The account uses 2-Step Verification, so Google will not accept its normal password from your mail client and asks for an app password instead.
- 534 5.7.9Sign in with a web browser first.Google refused your client's SMTP sign-in and wants the account owner to sign in through a web browser first, where Google can run its checks.
Further reading
All 105 standard codesEvery code in the wikiPaste your own bounce