530 5.7.0: authentication required (or STARTTLS first)
The server won't take the command until your client signs in (SMTP AUTH) or starts an encrypted session with STARTTLS. It's a client setting problem, not a block.
530 5.7.0 Must issue a STARTTLS command first.
Gmail's text when a client tries to send before starting TLS, as listed in Google's SMTP errors reference.
What 530 5.7.0 means
Two standards define this reply. RFC 4954, the SMTP authentication extension, defines 530 5.7.0 "Authentication required": the server returns it for any command other than AUTH, EHLO, HELO, NOOP, RSET or QUIT when its policy requires authentication and the client hasn't authenticated. RFC 3207, the STARTTLS extension, defines "530 Must issue a STARTTLS command first" for a server that requires TLS, and says the enhanced code should be 5.7.0.
You almost always see this when setting up a mail app, printer, scanner or website to send through a provider's submission server. Gmail lists both forms: "Authentication required" and "Must issue a STARTTLS command first".
The fix is in the client's settings: turn on authentication with a valid username and password (or the provider's required sign-in method), and turn on TLS or STARTTLS on the submission port your provider documents. Many providers no longer accept passwords from basic clients, so check whether they need an app password or a different sign-in method.
Likely causes
- SMTP authentication is turned off in the app or device.
- The client didn't start TLS before trying to sign in or send.
- The client is connecting to a port or server that requires a different security setting.
How to fix it
If you sent the message
- Turn on SMTP authentication and enter the account's credentials.
- Turn on TLS or STARTTLS and use the submission port your provider documents.
- Check whether your provider requires an app password or modern sign-in for this kind of client.
If you're the recipient or their admin
- No action needed: this reply comes from the server you are sending through, not from the final recipient.
Frequently asked questions
Why does my printer or scanner get 530 5.7.0?
The device is connecting to a mail server that requires sign-in or TLS, and one of those is turned off in the device's email settings. Enable authentication and TLS/STARTTLS, and use the server and port your mail provider documents.
Is 530 5.7.0 a spam block?
No. It comes from the server you are submitting mail to, before any message is sent. It means the connection isn't authenticated or encrypted yet.
Sources
- RFC 4954: SMTP Service Extension for Authentication
- RFC 3207: SMTP Service Extension for Secure SMTP over TLS
- Gmail SMTP errors and codes (Google Workspace Admin Help)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
Is my email encrypted in transit? STARTTLS, MTA-STS and DANE explained
What STARTTLS does for email, why opportunistic TLS can be downgraded, how MTA-STS and DANE enforce it, what Gmail's lock icons mean, and where TLS stops.
9 min read SPF, DKIM & DMARCMTA-STS and TLS-RPT explained: how to set them up safely
What MTA-STS and TLS-RPT protect against, the DNS records and policy file you need, testing vs enforce mode, and safe rollout behind a filtering gateway.
9 min read Running email day to dayHow to read email headers
Read email headers step by step: the Received chain from the bottom up, Authentication-Results, ARC, Return-Path, Message-ID and Microsoft 365 anti-spam fields.
10 min read