SMTP 530 5.7.0: must issue a STARTTLS command first / authentication required
Why a server answers 530 5.7.0 ("Must issue a STARTTLS command first", Gmail) or 530 5.7.1 ("Authentication required", "Client was not authenticated"), and the client-side fixes: enabling TLS on 587, using SSL on 465, and sending AUTH.
What 530 means: A policy precondition was not met: the server requires encryption before AUTH, or requires AUTH before MAIL FROM. It is a client configuration problem 99% of the time.
Causes, most likely first — and the fix for each
- Client sent AUTH or MAIL FROM on port 587 without upgrading to TLS ("530 5.7.0 Must issue a STARTTLS command first").
Fix: Turn on STARTTLS/"TLS" in the client (PHPMailer SMTPSecure=tls, Nodemailer secure:false on 587, Python starttls(), Laravel MAIL_ENCRYPTION=tls). - Client connected to 465 without SSL, or to 587 with "SSL" (implicit TLS on a STARTTLS port) — the handshake garbles and the server replies 530 or closes.
Fix: Match the mode to the port: 465 = SSL/implicit TLS; 587/2525 = STARTTLS. - No credentials configured, so the client never sends AUTH ("530 5.7.1 Authentication required", Office 365 "530 5.7.57 Client not authenticated to send mail").
Fix: Enable authentication and enter the username/password. - Server advertises AUTH only after STARTTLS and the client decided "server does not support AUTH".
Fix: Same as the first cause — enable STARTTLS; the AUTH capability appears afterwards.
How to confirm which one you have
The SMTP tester shows the EHLO capabilities before and after STARTTLS; if AUTH only appears after, your client must upgrade first.
Open the SMTP tester Check SPF / DKIM / DMARC
Still stuck? Use a relay that tells you why
QueenSMTP shows every message's exact server reply in the log, verifies your domain's SPF and DKIM before you send, and is not subject to mailbox-provider caps. $5/year plus $0.10 per 1,000 emails; 100 a day free to test.
Try it freeRelated errors
Questions about 530
STARTTLS: the connection starts in plain text and upgrades with the STARTTLS command. Port 465 is implicit TLS (SSL from the first byte). Clients label these inconsistently — "TLS" usually means STARTTLS, "SSL" usually means 465.
Related Guides
Continue learning with these related articles