535 5.7.8 "Username and Password Not Accepted": Fix Your SMTP Login

535 5.7.8 means the username or password your client offered was rejected. Typical texts are "Username and Password not accepted", "Error: authentication failed" and "Bad credentials". No mail was attempted, so this is not a bounce, and it says nothing about any address on your list.

The 535 5.7.8 code page has the quick answer.

Reading the code

Part	Value	Meaning
Reply code	535	Authentication failed
Class	5	Permanent failure
Subject	7	Security or policy status
Detail	8	Authentication credentials invalid

The reply code and detail come from RFC 4954, the SMTP authentication extension, and the class and subject from RFC 3463.

Why logins fail

• Wrong username or password for the sending account.
• The provider requires an app-specific password because two-factor authentication is enabled, and the account password was used instead.
• SMTP access is disabled on the account, or the credentials were rotated and not updated.
• Too many failed attempts triggered a temporary lockout.

Fix

1. Re-check the credentials against the provider's SMTP settings, including the exact username form. Some providers want the full email address, others just the local part. The SMTP settings lookup finds the host, port and security settings for an address.
2. Generate an app-specific password if the account has two-factor authentication.
3. Confirm SMTP or IMAP access has not been disabled by an administrator. For Microsoft mailboxes, Microsoft 365 SMTP auth explains the tenant setting.
4. Wait out a lockout if repeated attempts failed, then try once with the corrected details.
5. Update every app that uses the old credentials, including scripts and sequencers.

Related connection codes

530 5.7.57 is Microsoft's version when the client did not sign in at all. 530 5.7.0 asks for STARTTLS or authentication first. All of them are about the connection, not the recipient, so none of them is a reason to remove an address.

Where your list comes in

Once the login works, the sends go out, and then address quality starts to matter. The first sign of a bad list is bounces, not authentication errors. Remove bounced emails from a list covers the cleanup, and the syntax check vs SMTP verification guide shows what each check catches.

Keep the address side clean

This code does not come from your list, but every bounce still counts against your sending reputation, so the addresses you do send to should be real. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason such as "Mailbox not found" or "Accepts all addresses", and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.