5.7.12: password transition or unauthenticated sender
5.7.12A password transition is neededPermanent: retrying will not help
432 4.7.12 A password transition is needed
What it means
RFC 4954 defines X.7.12, “a password transition is needed”, with reply 432 (class 4). The user’s account needs a password change, for example after an administrator reset or the first use of a new authentication mechanism, before SMTP AUTH can succeed. The user must sign in through another channel, set the password, and try again.
In bounces you are far more likely to meet 550 5.7.12 from Microsoft Exchange and Exchange Online. Microsoft uses it for “the sender was not authenticated by organization”: the recipient is a group or mailbox set to accept mail only from authenticated internal senders, and your message arrived from outside.
The two uses share a number but not a cause. The 4.7.12 form is a login matter on the submission server. The Microsoft 5.7.12 form is a recipient restriction and the bounce reaches you after sending. Read the text to tell which one you have.
Likely causes
- An account flagged “must change password at next sign-in” that is used for SMTP before the change.
- An administrator reset that issued a temporary password the mail client cannot transition.
- An external sender writing to a Microsoft 365 group or distribution list limited to internal senders.
- Mail from your own organisation that arrives as external because it was sent through a third-party service without authentication.
How to fix it
- For 4.7.12 on login, sign in to webmail or the account portal, set a new password, and update it in the mail client.
- For a Microsoft 5.7.12 bounce, ask the recipient’s admin to allow external senders on that group, or to add your address as an allowed sender.
- If you are the admin, in the Exchange admin center open the group’s delivery management and allow senders inside and outside the organisation.
- If internal mail is being treated as external, route it through an authenticated connector rather than direct delivery.
Checks that apply
- MX Lookup Confirms the recipient domain is on Microsoft 365 (protection.outlook.com MX), which tells you the Microsoft meaning of 5.7.12 applies.
- Microsoft Compliance Checks your domain against Microsoft’s sender requirements, useful when your own internal mail arrives as unauthenticated.
FAQ
- Is the Microsoft 5.7.12 something I can fix as the sender?
- Not directly. The group’s owner or admin has to allow your address or external senders in general.
- Does 4.7.12 retry by itself?
- The client can retry, but it will keep failing until the password is changed, so act on it rather than waiting.