# 535 5.7.8: authentication credentials invalid

URL: https://iblockspam.com/smtp-errors/535-5-7-8
Last updated: 2026-10-09

Code: 535 5.7.8 (permanent failure, the message bounced)
Provider: Standard (RFC)

The mail server rejected the sign-in your app or device sent. The username, password or sign-in method isn't accepted for this account.

RFC 4954 defines 535 5.7.8 "Authentication credentials invalid" as the reply to an AUTH command that failed because of invalid or insufficient credentials. It tells the client to ask the user for new credentials.

This error comes from the server you are sending through (your own provider), not from the recipient. It shows up in mail apps, scanners, websites and scripts. Gmail lists a similar rejection, "Username and Password not accepted", under its own enhanced code, 535 5.7.80.

A wrong or expired password is the obvious cause, but not the only one. Some providers refuse passwords from basic SMTP clients and require an app-specific password or a modern sign-in method. Accounts with multifactor sign-in often need an app password for devices. And the username may need to be the full email address. RFC 4954 also defines related replies: 534 5.7.9 when the sign-in mechanism is weaker than the server allows, and 454 4.7.0 for a temporary authentication failure, in which case the client should not ask for a new password.

## Common causes

- Wrong or expired password, or a username that should be the full email address.
- The provider requires an app password or a modern sign-in method for this client.
- SMTP sending is disabled for the account.
- The account is locked after too many failed attempts.

## How to fix it (sender)

- Re-enter the full email address and password, then test.
- Check your provider's instructions for SMTP clients: app passwords, sign-in methods and whether SMTP sending must be enabled.
- If sign-in works in the browser but not the device, create an app password where your provider supports it.

## How to fix it (recipient or admin)

- No action needed: the failure happens before any message is sent.

**Q: My password is correct. Why do I still get 535 5.7.8?**
Many providers block password sign-in from basic SMTP clients or require an app password when multifactor sign-in is on. Check your provider's SMTP settings page; the account may also need SMTP sending enabled.

**Q: Could a 535 error mean my account was attacked?**
Repeated 535 errors in your server logs from unknown addresses usually mean someone is guessing passwords. Use strong unique passwords and multifactor sign-in, and review sign-in logs.

Sources:
- RFC 4954: SMTP Service Extension for Authentication: https://www.rfc-editor.org/rfc/rfc4954
- IANA: SMTP Enhanced Status Codes registry: https://www.iana.org/assignments/smtp-enhanced-status-codes/smtp-enhanced-status-codes.xhtml
- Gmail SMTP errors and codes (Google Workspace Admin Help): https://knowledge.workspace.google.com/admin/support/troubleshooting/gmail-smtp-errors-and-codes

---

Source: iBlockSpam, https://iblockspam.com/smtp-errors/535-5-7-8 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt