Gmail and Google Workspace · permanent error
530 5.7.0: STARTTLS required first
Gmail requires your client to switch the connection to TLS with STARTTLS before it signs in or sends mail, and your client did not.
- Gmail
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 530 5.7.0
- Provider
- Gmail and Google Workspace
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
530 5.7.0 Must issue a STARTTLS command first.
What it means
On Google's submission servers a client must encrypt the connection before signing in, since credentials would otherwise cross the network in the clear. Your client sent AUTH or MAIL FROM on an unencrypted connection, so Gmail asked it to issue STARTTLS first. Google refers to RFC 3207, the STARTTLS standard. In the client, choose STARTTLS (sometimes labelled TLS) for port 587, or SSL/TLS for port 465.
Common causes
- The client is set to send without encryption.
- STARTTLS failed and the client carried on without it.
- Old software that does not support STARTTLS.
How to fix it
- 01Turn on STARTTLS in the client for port 587, or use implicit TLS on port 465.
- 02If STARTTLS fails, check the client's TLS libraries and update them.
- 03Replace devices that cannot use TLS, or relay them through a local mail server that can.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Gmail SMTP errors and codes (Google Workspace Admin Help)knowledge.workspace.google.com
Related codes
- 523 5.7.10Commands pipelined after STARTTLS.Your client sent more commands straight after STARTTLS without waiting for the TLS handshake, which Gmail treats as a protocol violation.
- 421 4.7.0TLS required by the recipient's domain.The Workspace domain you are writing to only accepts mail over an encrypted connection, and your server tried to deliver without TLS.
- 530 5.7.0Authentication required.Your client tried to send through a Google SMTP server that needs a signed-in account, without signing in first.
- 530Authentication required.The server requires the client to log in, or to start TLS, before it accepts this command, which usually means before it accepts any mail.
- 5.7.0Security or policy refusal, unspecified.The message or session was refused for a security or policy reason that the server did not describe more precisely, or chose not to reveal.
5.7.0 at other providers
All 108 Gmail codesEvery code in the wikiPaste your own bounce