Permanent failure — do not retry
SMTP 535 5.7.8
authentication credentials invalid
SMTP 535 5.7.8 means the username or password offered during authentication was rejected. It concerns your own connection to your sending server, not the recipient — no mail was attempted, so it is not a bounce and says nothing about the address.
How it appears
535 5.7.8 Username and Password not accepted
535 5.7.8 Error: authentication failed
535 5.7.8 Bad credentials
What causes it
- Wrong username or password for the sending account.
- The provider requires an app-specific password because two-factor authentication is enabled, and the account password was used instead.
- SMTP access is disabled on the account, or the credentials were rotated and not updated.
- Too many failed attempts have triggered a temporary lockout.
How to fix it
In order — try the first one first.
- Re-check the credentials against the provider's SMTP settings, including the exact username form — some providers want the full email address, others just the local part.
- If the account has two-factor authentication, generate an app-specific password. Gmail and Microsoft both require this.
- Confirm SMTP or IMAP access has not been disabled on the account by an administrator.
- Nothing about your recipient list is implicated here; do not suppress any addresses on the basis of a 535.
Common questions
- What does SMTP 535 5.7.8 mean?
- SMTP 535 5.7.8 means the username or password offered during authentication was rejected. It concerns your own connection to your sending server, not the recipient — no mail was attempted, so it is not a bounce and says nothing about the address.
- Should I retry a 535 5.7.8 error?
- No. 535 is a permanent failure, so the message will never be delivered no matter how many times you try. Remove the address — repeated sends to permanent failures are one of the main signals mailbox providers use to throttle a sender.
- How do I fix SMTP 535 5.7.8?
- Re-check the credentials against the provider's SMTP settings, including the exact username form — some providers want the full email address, others just the local part.
Last reviewed 2026-09-11