SMTP error 535: authentication failed — how to fix it
What "535 5.7.8 Username and Password not accepted", "535 5.7.0 authentication failed" and "535 5.7.139 SmtpClientAuthentication is disabled" mean, the six causes in order of likelihood, and the exact fix for Gmail, Office 365, Yahoo, cPanel and relay accounts.
What 535 means: The server understood your AUTH command and rejected the credentials, or refuses password authentication for this account entirely. It is never a network problem — the connection worked, the login did not.
Causes, most likely first — and the fix for each
- You used the account password where the provider requires an app password (Gmail, Yahoo, iCloud, AOL, Fastmail, Zoho with 2FA).
Fix: Generate an app-specific password in the provider's security settings and use it as the SMTP password. Gmail: "535-5.7.8 Username and Password not accepted"; Yahoo: "(#AUTH005)". - Password authentication is disabled for the account (Microsoft 365: "535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant"; Outlook.com personal accounts since 2024).
Fix: Microsoft 365: enable Authenticated SMTP on the mailbox in the admin center and check Security Defaults. Outlook.com: no fix for password clients — use an OAuth-capable app or a relay. - Username is not the full email address (cPanel, Zoho, Hostinger, Namecheap) — or is not the literal value the provider requires (SendGrid: apikey; SparkPost: SMTP_Injection; Resend: resend; Mailtrap sending: api).
Fix: Use the exact username format from the provider's settings page. - Wrong regional host for the account (Zoho: smtp.zoho.eu vs .com; Mailgun: smtp.eu.mailgun.org; GMX: smtp.gmx.net vs .com; SES: the region the credentials were created in).
Fix: Match the host to the account's data centre/region. - A relay/ESP account password used instead of the SMTP credential (Brevo SMTP key, Mailgun domain password, SMTP2GO SMTP user, SES-derived password, QueenSMTP SMTP credential).
Fix: Create/copy the SMTP credential in the provider dashboard; the dashboard login is a different secret. - AUTH sent before STARTTLS on port 587 — many servers reject or ignore plaintext AUTH ("530 5.7.0 Must issue a STARTTLS command first"), which some clients report as 535.
Fix: Enable STARTTLS/TLS in the client for 587, or use SSL on 465.
How to confirm which one you have
Test the credentials outside your application with the SMTP tester: it shows the server's exact AUTH reply and whether STARTTLS was negotiated.
Open the SMTP tester Check SPF / DKIM / DMARC
Still stuck? Use a relay that tells you why
QueenSMTP shows every message's exact server reply in the log, verifies your domain's SPF and DKIM before you send, and is not subject to mailbox-provider caps. $5/year plus $0.10 per 1,000 emails; 100 a day free to test.
Try it freeRelated errors
Questions about 535
Not usually. It means the credential was rejected. Repeated failures can trigger a temporary lock (Yahoo AUTH005, Gmail "Too many login attempts"), so stop retrying until the credential is fixed.
Because for most providers the SMTP password is not the login password: it is an app password, an API key or a generated SMTP credential.
Related Guides
Continue learning with these related articles