535: authentication credentials invalid
The server rejected the login because the username, password or token is wrong or not sufficient for this account, so no mail is sent.
- Standard
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 535
- Provider
- Standard SMTP codes
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
535 Authentication credentials invalid
What it means
RFC 4954 defines 535, with enhanced code 5.7.8, for an AUTH command that failed because the credentials are invalid or insufficient, and says the client should ask the user for new ones. It is the standard reply to a wrong password. Providers also send it when the password is right but the account needs an app password or OAuth, or when they have switched off password login for SMTP. No message goes out until the login succeeds. The registry also lists 535 alongside 5.7.14 (trust relationship required).
Common causes
- A wrong, expired or recently changed password.
- An account with two-step verification that needs an app password or OAuth for SMTP.
- A provider that no longer accepts plain password login for SMTP.
- The wrong username, such as a display name instead of the full email address.
How to fix it
- 01Re-enter the username (usually the full email address) and the password.
- 02If the account uses two-step verification, create an app password or switch the client to OAuth.
- 03Check the provider's documentation for the SMTP server, port and login method it requires.
- 04Sign in to webmail to confirm the account is not locked or disabled.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 535 5.7.8Login failed: invalid credentials.The SMTP server rejected the login because the username, password or token was wrong or not sufficient, so it will not accept mail from this session.
- 5.7.13User account disabled.The login itself worked, but the account has been disabled by its administrator, so the server will not accept mail from it until it is re-enabled.
- 534Authentication method too weak.The server refused the login because the authentication method the client chose is weaker than its policy allows for this user.
- 530Authentication required.The server requires the client to log in, or to start TLS, before it accepts this command, which usually means before it accepts any mail.
535 at other providers
All 105 standard codesEvery code in the wikiPaste your own bounce