Why does my script get 5.7.0 but Outlook works?

Outlook upgrades the connection with STARTTLS automatically. Your script probably does not, so enable TLS in its SMTP settings.

Is 4.7.0 the same problem?

It shares the family but is temporary. Greylisting and transient TLS failures use it, and a normal retry usually succeeds.

5.7.0 bounce: other or undefined security status

5.7.0Other or undefined security statusPermanent: retrying will not help

Example

530 5.7.0 Must issue a STARTTLS command first

What it means

X.7 in RFC 3463 is the “security or policy status” subject, and detail 0 is its unclassified member. The server is refusing for a security or policy reason but does not give a narrower code, so the free text after 5.7.0 carries the real explanation.

The best-known form is 530 5.7.0 “Must issue a STARTTLS command first”, which Postfix and many other servers send when they require encryption before MAIL FROM or AUTH. Gmail and others also use 5.7.0 for assorted policy refusals, for example suspicious attachments or unauthenticated submission.

Expect 4.7.0 too. That form means a temporary policy hold, such as greylisting, a TLS negotiation failure, or a reputation check the server wants to repeat later. Your MTA retries 4.7.0 on its own; 5.7.0 comes straight back as a bounce.

Likely causes

Connecting to a submission port that requires STARTTLS and sending MAIL FROM or AUTH over plain text.
A firewall or proxy stripping STARTTLS from the EHLO reply, so your client never upgrades.
A provider policy decision (attachment type, suspicious content, sending pattern) reported with the generic 5.7.0.
An expired or untrusted certificate that makes your client abandon TLS, after which the server refuses the plain-text session.

How to fix it

Read the text after 5.7.0; if it mentions STARTTLS, enable TLS on the client (STARTTLS on 587, implicit TLS on 465).
Test the server and confirm STARTTLS appears in its EHLO response from your network. If it is missing only from your network, look for an inspecting firewall.
If the text describes a content or policy reason, follow that lead: remove the flagged attachment, or check your authentication and reputation.
For a 4.7.0 deferral, let your queue retry for a few hours before you change anything.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Connects to the server, shows whether STARTTLS is offered and whether the certificate is valid, which covers the most common 5.7.0 case.
MTA-STS Check Shows whether the recipient domain publishes an MTA-STS policy that requires TLS for inbound mail.
Domain Health Grades SPF, DKIM, DMARC and reverse DNS together when the 5.7.0 text hints at a policy rather than TLS.

FAQ

Why does my script get 5.7.0 but Outlook works?: Outlook upgrades the connection with STARTTLS automatically. Your script probably does not, so enable TLS in its SMTP settings.
Is 4.7.0 the same problem?: It shares the family but is temporary. Greylisting and transient TLS failures use it, and a normal retry usually succeeds.

All 191 bounce codes