ProbeKit
Sign inSign up

5.7.10 bounce: encryption needed

5.7.10Encryption neededPermanent: retrying will not help

Typical wording
523 5.7.10 Encryption needed

What it means

RFC 5248 registered X.7.10 as “encryption needed”, with reply 523. It tells the client that an external strong privacy layer, in practice TLS, is required before the requested authentication mechanism can be used. It is aimed mainly at clear-text mechanisms such as PLAIN and LOGIN.

The idea is simple: the server will not let a password travel over an unencrypted session. You fix it by starting TLS with STARTTLS or by connecting to an implicit-TLS port, then authenticating again.

It sits close to 5.7.11 (RFC 4954, reply 538), which says encryption is required for the requested mechanism. Many servers use one or the other, or simply 530 5.7.0 “Must issue a STARTTLS command first”. All three point at the same fix. A 4.7.10 form is not in common use.

Likely causes

  • A mail client set to “no encryption” on port 587 or 25.
  • An application library that does not call STARTTLS automatically.
  • A firewall that removes STARTTLS from the server’s EHLO reply, so the client thinks TLS is unavailable.
  • A device whose TLS versions are all disabled on the server, so it falls back to plain text and gets refused.

How to fix it

  1. Set the client to STARTTLS on port 587, or SSL/TLS on port 465.
  2. In code, enable TLS explicitly (for example `secure: false, requireTLS: true` on port 587 in Nodemailer).
  3. Confirm from the same network that the server advertises STARTTLS; if it does not, look for SMTP inspection on your firewall.
  4. For old devices, check that they support TLS 1.2 or later, or route them through a local relay that does.

Checks that apply

  • SMTP Diagnostics Shows whether STARTTLS is offered and completes, plus the certificate and TLS version, the core of any 5.7.10.
  • TCP Port Test Checks that port 465 or 587 is open from your network, so you can switch to an encrypted submission port.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Is 5.7.10 the same as 5.7.11?
They are close cousins. 5.7.10 is the general “encryption needed” code from RFC 5248; 5.7.11 from RFC 4954 says the chosen mechanism specifically requires encryption.
Can I disable the requirement?
You should not. Sending passwords over plain text exposes them, and most providers no longer allow it at all.

All 191 bounce codes