How to read an SMTP reply
Take 535 5.7.8 Username and Password not accepted. It has three parts:
- The reply code (
535), defined by RFC 5321. The first digit tells you what to do:2worked,3means continue,4is temporary (retrying can work), and5is permanent (fix something first). - The enhanced status code (
5.7.8), from RFC 3463. The middle number is the area:1addressing,2mailbox,3mail system,4network and routing,5protocol,6message content,7security or policy. - The text, written by the provider. It’s usually the most useful part, so always log the whole line.
SMTP replies
| Reply | Meaning | Likely cause when sending from an app | Fix |
|---|---|---|---|
421, 421 4.7.0 | Service not available, closing the connection | The server is busy, throttling you, or distrusts your IP. Gmail uses 421 4.7.0 for low IP reputation, among others. | Retry later with a back-off. Send more slowly. |
450 | Mailbox unavailable, temporarily | Mailbox busy, or temporarily blocked by policy (including greylisting) | Retry. Most mail servers do this for you. |
451 | Aborted: local error in processing | A temporary problem on the receiving side | Retry later. |
452, 452 4.5.3 | Insufficient system storage, or too many recipients | Too many recipients in one message | Send to fewer recipients per message. |
454 4.7.0 | Temporary authentication failure | Too many login attempts, or a server-side glitch | Wait, then retry. Don’t hammer the login. |
530 5.7.0 Must issue a STARTTLS command first | The server requires TLS before anything else (RFC 3207) | Port 587 with STARTTLS disabled or ignored | Enable STARTTLS on 587, or use 465 with SSL on. |
530 5.7.0 Authentication required | You must log in to send (RFC 4954) | No username or password configured | Add the SMTP username and password. Microsoft 365 says 5.7.57 Client not authenticated to send mail. |
534 5.7.9 | Authentication mechanism too weak (RFC 4954) | Gmail: “Application-specific password required” | Use an App Password. See the Gmail fix. |
534 5.7.14 | Gmail: “Please log in through your web browser” | Google wants a browser sign-in before it accepts this login | Sign in to Gmail in a browser, then retry. |
535 5.7.8 | Authentication credentials invalid (RFC 4954) | Wrong username or password, or the provider wants an app password or SMTP key | See the Gmail fix or the settings for your provider. |
535 5.7.139, 535 5.7.3 | Microsoft 365 authentication unsuccessful | SMTP AUTH is disabled for the tenant or mailbox | See the Microsoft 365 fix. |
550 5.7.1 relaying denied | Rejected for policy; delivery not authorized | You didn’t log in, or the server doesn’t relay mail for you | Authenticate, and use your provider’s submission host on 587 or 465. |
550 5.7.26 | Gmail: unauthenticated email rejected due to the domain’s DMARC policy | The From domain fails SPF/DKIM alignment | See emails going to spam. |
550 5.7.60 | Microsoft 365: no permission to send as this sender | From address differs from the signed-in mailbox | Send from the same mailbox, or grant Send As. |
550 5.4.5 | Gmail: daily user sending limit exceeded | Over Gmail’s daily limit | Wait up to 24 hours, or use a sending service. |
553 5.7.1 sender address rejected | Mailbox name not allowed | The From address isn’t one your login may use | Send from the login address or a verified alias. |
554 5.7.1 | Transaction failed; delivery not authorized | Refused by policy or a spam filter, or your IP is on a blocklist | Read the text that follows. Check SPF, DKIM and the content. |
Library and connection errors
These come from your code or operating system, before the server says anything (or instead of it).
| Error | What happened | Fix |
|---|---|---|
ETIMEDOUT, Connection timeout | Nothing answered. A firewall dropped the connection. | The port is blocked. See SMTP connection timed out. |
Greeting never received (Nodemailer) | Connected, but no 220 greeting | Usually SSL off on port 465. Turn it on, or use 587. |
ECONNREFUSED | The host answered “no” on that port | Wrong host or port, or nothing listening there. |
ENOTFOUND, getaddrinfo ENOTFOUND | DNS couldn’t find the host name | A typo, or the wrong regional host (for example smtp.zoho.eu vs smtp.zoho.com). |
wrong version number (OpenSSL) | TLS handshake on a port that speaks plain text first | SSL is on for port 587. Turn it off (STARTTLS), or use 465. |
self-signed certificate in certificate chain | The certificate presented isn’t the provider’s | Something on the network intercepts TLS, or you’re connecting to the wrong host. Don’t disable verification to silence it. |
Invalid login: 535 … (EAUTH) | Nodemailer’s wrapper around a 535 | Fix the credentials, as for 535. |
SMTP AUTH extension not supported by server. (Python) | The server didn’t offer login. On 587, servers only offer it after STARTTLS. | Call starttls(), then ehlo(), then login(). Or use SMTP_SSL on 465. |
SMTP Error: Could not authenticate. (PHPMailer) | The server rejected the login, usually with a 535 | Turn on debug output (below) to see the real reply. |
SMTP connect() failed. (PHPMailer) | Couldn’t connect or start TLS | DNS, a firewall or a blocked port. Or the wrong mode: PHPMailer’s docs say SMTPS on 587 or STARTTLS on 465 “will not work”. |
See the whole conversation
Most of these errors are easy once you see the server’s exact words. Turn on protocol logging:
// Node.js (Nodemailer): print the whole SMTP conversation
nodemailer.createTransport({ host, port, secure, auth, logger: true, debug: true });
// PHP (PHPMailer)
$mail->SMTPDebug = SMTP::DEBUG_SERVER;
# Python (smtplib)
server.set_debuglevel(1)Remove debug logging when you’re done. It can print your credentials (base64-encoded, which is not encryption) to the logs.
Using FormSMTP? FormSMTP logs the provider’s full reply for every failed send under Logs, adds a plain-English hint, and Test connection runs the connect, TLS and login steps before you save. It only needs your provider’s SMTP host, port and login. Try it free, or look up any provider on the SMTP settings page.
Sources
Checked on the vendors’ own pages on November 2, 2026.
- RFC 5321: Simple Mail Transfer Protocol
- RFC 3463: Enhanced Mail System Status Codes
- RFC 4954: SMTP Service Extension for Authentication
- RFC 3207: SMTP Service Extension for Secure SMTP over TLS
- RFC 8314: Use of TLS for Email Submission and Access
- Google Workspace: Gmail SMTP errors and codes
- Microsoft Learn: Fix issues with printers, scanners, and LOB apps that send email
- Microsoft Learn: Set up a device or application to send email using Microsoft 365
- PHPMailer wiki: Troubleshooting
- Python docs: smtplib
FAQ
What’s the difference between 4xx and 5xx SMTP errors?
A 4xx reply is temporary: the same message may go through if you retry later. A 5xx reply is permanent: retrying won’t help until you change something, such as the password, the From address or the recipient.
What does 535 5.7.8 mean?
Authentication credentials invalid. The server rejected the username or password. With Gmail it usually means you need an App Password; with sending services it usually means you need an SMTP key instead of your account password.
What does 550 5.7.1 relaying denied mean?
The server won’t pass your message on to another domain for you, usually because you didn’t log in or you’re connected to a server that isn’t your provider’s submission host.
Why do I get “wrong version number” with Nodemailer?
secure: true is set on a STARTTLS port like 587. Use secure: true only with port 465, and secure: false with 587.