ProbeKit
Sign inSign up

5.7.4 bounce: security features not supported

5.7.4Security features not supportedPermanent: retrying will not help

Typical wording
504 5.7.4 Unrecognized authentication type

What it means

RFC 3463 defines X.7.4 as “security features not supported”: the message or session asked for a security feature that this server does not offer. It often appears with reply 504 (command parameter not implemented).

In everyday mail you mostly meet 504 5.7.4 “Unrecognized authentication type” from Microsoft Exchange and similar servers. It means the client tried AUTH, or a specific AUTH mechanism, where the server does not offer it, for example on a receive connector with authentication switched off, or before TLS when AUTH is only offered over TLS.

A 4.7.4 is unusual, because missing features do not appear by waiting. The fix is to use what the server advertises, or to change the server configuration.

Likely causes

  • A client attempting AUTH on port 25 of a server that only accepts authentication on the submission port.
  • Choosing a mechanism such as CRAM-MD5 or NTLM when the server offers only PLAIN and LOGIN, or the reverse.
  • Authenticating before STARTTLS on a server that hides AUTH until the session is encrypted.
  • A printer, scanner or old device that only knows a security feature the server has disabled.

How to fix it

  1. Look at the EHLO reply and note which AUTH mechanisms are listed, before and after STARTTLS.
  2. Point the client at port 587 with STARTTLS (or 465 with implicit TLS) and choose a listed mechanism.
  3. For Exchange on-premises, confirm the receive connector has the right authentication options enabled.
  4. For devices that cannot meet the server’s security requirements, use a local relay that accepts them and forwards securely.

Checks that apply

  • SMTP Diagnostics Prints the EHLO extensions including AUTH mechanisms and STARTTLS, which is exactly what a 5.7.4 is about.
  • TCP Port Test Checks whether ports 587 and 465 are reachable, so you can switch to a submission port that supports authentication.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Does 5.7.4 mean my password is wrong?
No. Wrong credentials give 535 5.7.8. A 5.7.4 means the authentication method or feature itself is not available.
Why do I see it only from one office?
An inspecting firewall at that site may remove STARTTLS or AUTH from the server’s reply. Test from another network to compare.

All 191 bounce codes