535 5.7.8: authentication credentials invalid
The mail server rejected the sign-in your app or device sent. The username, password or sign-in method isn't accepted for this account.
What 535 5.7.8 means
RFC 4954 defines 535 5.7.8 "Authentication credentials invalid" as the reply to an AUTH command that failed because of invalid or insufficient credentials. It tells the client to ask the user for new credentials.
This error comes from the server you are sending through (your own provider), not from the recipient. It shows up in mail apps, scanners, websites and scripts. Gmail lists a similar rejection, "Username and Password not accepted", under its own enhanced code, 535 5.7.80.
A wrong or expired password is the obvious cause, but not the only one. Some providers refuse passwords from basic SMTP clients and require an app-specific password or a modern sign-in method. Accounts with multifactor sign-in often need an app password for devices. And the username may need to be the full email address. RFC 4954 also defines related replies: 534 5.7.9 when the sign-in mechanism is weaker than the server allows, and 454 4.7.0 for a temporary authentication failure, in which case the client should not ask for a new password.
Likely causes
- Wrong or expired password, or a username that should be the full email address.
- The provider requires an app password or a modern sign-in method for this client.
- SMTP sending is disabled for the account.
- The account is locked after too many failed attempts.
How to fix it
If you sent the message
- Re-enter the full email address and password, then test.
- Check your provider's instructions for SMTP clients: app passwords, sign-in methods and whether SMTP sending must be enabled.
- If sign-in works in the browser but not the device, create an app password where your provider supports it.
If you're the recipient or their admin
- No action needed: the failure happens before any message is sent.
Frequently asked questions
My password is correct. Why do I still get 535 5.7.8?
Many providers block password sign-in from basic SMTP clients or require an app password when multifactor sign-in is on. Check your provider's SMTP settings page; the account may also need SMTP sending enabled.
Could a 535 error mean my account was attacked?
Repeated 535 errors in your server logs from unknown addresses usually mean someone is guessing passwords. Use strong unique passwords and multifactor sign-in, and review sign-in logs.
Sources
- RFC 4954: SMTP Service Extension for Authentication
- IANA: SMTP Enhanced Status Codes registry
- Gmail SMTP errors and codes (Google Workspace Admin Help)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
Is my email encrypted in transit? STARTTLS, MTA-STS and DANE explained
What STARTTLS does for email, why opportunistic TLS can be downgraded, how MTA-STS and DANE enforce it, what Gmail's lock icons mean, and where TLS stops.
9 min read Phishing & threatsHow to prevent business email compromise (BEC)
What business email compromise is, what the FBI's 2025 IC3 figures show, and the payment checks and technical controls that stop BEC fraud at small firms.
9 min read Running email day to dayEmail security checklist for small businesses in 2026
A practical 2026 email security checklist for small businesses: MFA, SPF, DKIM and DMARC, filtering, backups, staff training and an incident plan.
9 min read Phishing & threatsMicrosoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?
Fix 550 5.1.8 Access denied, bad outbound sender: why Microsoft 365 restricts users, how to check for compromise, unblock on Restricted entities, prevent it.
9 min read Phishing & threatsSigns your business email account has been compromised, and what to do
The warning signs of a hacked business mailbox, from hidden inbox rules to MFA prompts, and the step-by-step response for Microsoft 365 and Google Workspace.
10 min read