# 530 5.7.0: authentication required (or STARTTLS first)

URL: https://iblockspam.com/smtp-errors/530-5-7-0
Last updated: 2026-10-09

Code: 530 5.7.0 (permanent failure, the message bounced)
Provider: Standard (RFC)

The server won't take the command until your client signs in (SMTP AUTH) or starts an encrypted session with STARTTLS. It's a client setting problem, not a block.

What the bounce says:

```
530 5.7.0 Must issue a STARTTLS command first.
```
Gmail's text when a client tries to send before starting TLS, as listed in Google's SMTP errors reference.

Two standards define this reply. RFC 4954, the SMTP authentication extension, defines 530 5.7.0 "Authentication required": the server returns it for any command other than AUTH, EHLO, HELO, NOOP, RSET or QUIT when its policy requires authentication and the client hasn't authenticated. RFC 3207, the STARTTLS extension, defines "530 Must issue a STARTTLS command first" for a server that requires TLS, and says the enhanced code should be 5.7.0.

You almost always see this when setting up a mail app, printer, scanner or website to send through a provider's submission server. Gmail lists both forms: "Authentication required" and "Must issue a STARTTLS command first".

The fix is in the client's settings: turn on authentication with a valid username and password (or the provider's required sign-in method), and turn on TLS or STARTTLS on the submission port your provider documents. Many providers no longer accept passwords from basic clients, so check whether they need an app password or a different sign-in method.

## Common causes

- SMTP authentication is turned off in the app or device.
- The client didn't start TLS before trying to sign in or send.
- The client is connecting to a port or server that requires a different security setting.

## How to fix it (sender)

- Turn on SMTP authentication and enter the account's credentials.
- Turn on TLS or STARTTLS and use the submission port your provider documents.
- Check whether your provider requires an app password or modern sign-in for this kind of client.

## How to fix it (recipient or admin)

- No action needed: this reply comes from the server you are sending through, not from the final recipient.

**Q: Why does my printer or scanner get 530 5.7.0?**
The device is connecting to a mail server that requires sign-in or TLS, and one of those is turned off in the device's email settings. Enable authentication and TLS/STARTTLS, and use the server and port your mail provider documents.

**Q: Is 530 5.7.0 a spam block?**
No. It comes from the server you are submitting mail to, before any message is sent. It means the connection isn't authenticated or encrypted yet.

Sources:
- RFC 4954: SMTP Service Extension for Authentication: https://www.rfc-editor.org/rfc/rfc4954
- RFC 3207: SMTP Service Extension for Secure SMTP over TLS: https://www.rfc-editor.org/rfc/rfc3207
- Gmail SMTP errors and codes (Google Workspace Admin Help): https://knowledge.workspace.google.com/admin/support/troubleshooting/gmail-smtp-errors-and-codes

---

Source: iBlockSpam, https://iblockspam.com/smtp-errors/530-5-7-0 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt