ProbeKit
Sign inSign up

538 5.7.11: encryption required for AUTH mechanism

5.7.11Encryption required for requested authentication mechanismPermanent: retrying will not help

Typical wording
538 5.7.11 Encryption required for requested authentication mechanism

What it means

X.7.11 is defined in RFC 4954 together with reply 538: “encryption required for requested authentication mechanism”. The client asked to authenticate with a mechanism that this server will only accept inside an encrypted session, and the session is not encrypted yet.

The server is protecting the credentials. PLAIN and LOGIN send the password in a form anyone on the path could read, so most servers allow them only after STARTTLS. With 538 5.7.11 the server tells you exactly that.

Compare 5.7.10 (a general “encryption needed” from RFC 5248) and 530 5.7.0 (STARTTLS required before anything). In practice, servers that hide AUTH until TLS is up rarely send 5.7.11, because the client never sees AUTH offered in the first place. A 4-class version does not exist in normal use.

Likely causes

  • A client that sends AUTH PLAIN or AUTH LOGIN right after EHLO without STARTTLS.
  • A STARTTLS attempt that failed silently, after which the client carried on in plain text.
  • An application configured for port 25 or 587 with encryption turned off.
  • TLS stripped by a middlebox, leaving the client unaware the server wanted encryption.

How to fix it

  1. Enable STARTTLS in the client, or use port 465 with implicit TLS.
  2. Make the client fail closed: if STARTTLS does not succeed, stop rather than authenticate in plain text.
  3. Check the server certificate is valid for its hostname, so TLS completes and AUTH becomes available.
  4. Re-test and confirm the server now answers 235 to AUTH.

Checks that apply

  • SMTP Diagnostics Shows the AUTH mechanisms advertised before and after STARTTLS, confirming that encryption unlocks the login.
  • TCP Port Test Checks that port 465 is reachable, so you can switch to implicit TLS if STARTTLS keeps failing on 587.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Why does the server allow AUTH at all without TLS then?
Some servers advertise AUTH early for compatibility but refuse clear-text mechanisms until TLS is active, which is when 5.7.11 appears.
Does 5.7.11 affect incoming mail?
No. It only concerns clients logging in to send. Server-to-server delivery on port 25 does not use AUTH.

All 191 bounce codes