Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
SMTP error code · Standard (RFC)

534 5.7.9: authentication mechanism is too weak

534 5.7.9 Permanent failure (5xx): the message bounced
By iBlockSpam Team Checked against sources 3 sources How we check our content
What it means

The server you send through refused the sign-in method your app or device tried. The account may be fine; the server wants a stronger method, such as OAuth or an app password.

What the bounce says
534 5.7.9 Authentication mechanism is too weak

The reply as defined in RFC 4954. Gmail lists the same situation as 534 with the texts "Application-specific password required" and "Please log in with your web browser and then try again".

What 534 5.7.9 means

RFC 4954, the SMTP authentication standard, defines 534 5.7.9 "Authentication mechanism is too weak" as the reply to an AUTH command when the chosen sign-in mechanism is weaker than the server's policy allows for that user. The client should retry with a different mechanism. Unlike 535 5.7.8, it doesn't say the password is wrong: it says the way you signed in isn't accepted.

This error comes from your own outgoing server, during sign-in, before any message is sent. Gmail is the most common source. Google's SMTP error reference lists two 534 replies: "Application-specific password required", which links to Google's app password help, and "Please log in with your web browser and then try again". Google explains that when 2-Step Verification is on, some less secure apps and devices are blocked from the account, and an app password, a 16-digit passcode, lets a blocked app or device sign in. Google also says app passwords aren't recommended where the app offers "Sign in with Google".

The lasting fix is to move the app, plugin or device to OAuth ("Sign in with Google" or modern authentication) if it supports it. If it doesn't, an app password is the usual workaround for a personal account. Google revokes app passwords when the account password changes, so a device that worked for months can start failing with 534 after a password reset.

Likely causes

  • The app signs in with a plain password, and the account has 2-Step Verification turned on.
  • The app passwords that a device used were revoked after the account password was changed.
  • The server requires OAuth or another stronger mechanism for this account.
  • Google wants the user to complete a browser sign-in before it accepts the app again.

How to fix it

If you sent the message

  1. Use the app's "Sign in with Google" or OAuth option if it has one.
  2. If it doesn't, create an app password for that device in your Google Account and use it instead of your normal password.
  3. After a password change, create a new app password for every device that sends mail.
  4. For printers, scanners and line-of-business apps in an organization, ask your admin about the SMTP relay service instead of personal sign-ins.

If you're the recipient or their admin

  1. No action needed: the failure happens at the sender's own server, before any message is sent.
Email Health Check Email Header Analyzer

Frequently asked questions

Is 534 5.7.9 the same as a wrong password?

No. A wrong password usually returns 535 5.7.8. RFC 4954 defines 534 5.7.9 as a sign-in method that's weaker than the server allows. The password may be right, but the app has to use OAuth or an app password.

Why did 534 errors start after I changed my Google password?

Google revokes app passwords when you change the Google Account password. Every device or app that used one, such as a scanner or a website plugin, needs a new app password, or better, a switch to Sign in with Google.

Sources

  1. RFC 4954: SMTP Service Extension for Authentication
  2. Gmail SMTP errors and codes (Google Workspace Admin Help)
  3. Sign in with app passwords (Google Account Help)

Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.

Related codes

Related guides

Setup guides

What are the Gmail SMTP server settings, and how do app passwords work?

Gmail SMTP settings that work: smtp.gmail.com, ports 465 and 587, app passwords and 2-Step Verification, sending limits, and fixes for 535 and 534 errors.

9 min read Setup guides

How do you set up the Google Workspace SMTP relay service?

Set up Google Workspace's SMTP relay (smtp-relay.gmail.com) for printers, apps and servers: Admin console options, ports, limits and relay error fixes.

10 min read Setup guides

How do you enforce 2-Step Verification in Google Workspace without locking people out?

How to enforce 2-Step Verification in Google Workspace without lockouts: enrollment periods, security key and passkey only mode, backup codes, and admin rules.

10 min read Email security basics

SMTP ports 25, 587, 465 and 2525: which one should you use?

Which SMTP port to use: 25 for server-to-server relay, 587 with STARTTLS or 465 with implicit TLS for sending from apps, and why port 25 is often blocked.

10 min read