538: encryption required for this login method
The authentication method the client chose is only allowed over an encrypted connection, and this connection is not encrypted.
- Standard
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 538
- Provider
- Standard SMTP codes
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
538 Encryption required for requested authentication mechanism
What it means
RFC 4954 defines 538, with enhanced code 5.7.11, for an AUTH command that uses a mechanism the server allows only once the connection is encrypted. The RFC adds that the code is documented for historical purposes: modern servers should not offer such mechanisms at all until TLS is active, so a well-behaved client never reaches this point. When it does appear, the client is trying to log in without TLS. Starting TLS first and then authenticating resolves it.
Common causes
- A client configured to connect without STARTTLS or TLS.
- An older server that advertises mechanisms it then refuses on unencrypted connections.
How to fix it
- 01Enable STARTTLS or implicit TLS in the client's outgoing server settings.
- 02Use the port the provider documents for encrypted submission.
- 03Update the client if it ignores the server's STARTTLS offer.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 538 5.7.11Encryption required for this login method.The chosen authentication method may only be used over an encrypted connection, and the current SMTP connection is not encrypted.
- 5.7.10Encryption needed.The server requires an encrypted connection (TLS) before this kind of login can happen, or a message that demands TLS could not be passed on securely.
- 530Authentication required.The server requires the client to log in, or to start TLS, before it accepts this command, which usually means before it accepts any mail.
All 105 standard codesEvery code in the wikiPaste your own bounce