Why does webmail work but SMTP fails with 5.7.8?

Many providers block basic SMTP authentication when multi-factor authentication or security defaults are on. You then need an app password, OAuth, or SMTP AUTH enabled for the mailbox.

Will the message be retried?

No. Authentication failed before the message was accepted, so your client still holds it and you must send it again after fixing the login.

535 5.7.8: authentication credentials invalid

5.7.8Authentication credentials invalidPermanent: retrying will not help

Typical wording

535 5.7.8 Error: authentication failed: authentication failure

What it means

RFC 4954 (SMTP Service Extension for Authentication) registered X.7.8 as “authentication credentials invalid”, sent with reply 535. Your client offered AUTH, the server tried the credentials, and they did not match an account it accepts for sending.

This is a submission error. You see it in the client or application that sends through a provider (port 587 or 465), not in a bounce from a recipient. The message never left, so there is no NDR from the far end, only an error dialog or a log line.

It is not the same as 5.7.9 (the mechanism is too weak, often meaning the provider wants an app password or OAuth) or 5.7.4 (the mechanism is not supported at all). A temporary 454 4.7.0 during authentication points at a server-side problem rather than wrong credentials.

Likely causes

A wrong password, or a password changed on the account but not in the device or application.
A username in the wrong form, for example “jane” where the server expects the full address jane@example.com.
Multi-factor authentication on the account, so the normal password is no longer accepted for SMTP and an app password or OAuth token is needed.
SMTP AUTH disabled for the mailbox or tenant by the provider’s security defaults.
An account locked after repeated failed logins from a brute-force attempt.

How to fix it

Sign in to the provider’s webmail with the same username and password to confirm they work there.
Use the full email address as the username unless the provider documents otherwise.
If the account uses multi-factor authentication, create an app password or switch the application to OAuth, as the provider documents.
Check that SMTP authentication is enabled for that mailbox in the provider’s admin settings.
After several failures, wait for any lockout to clear before testing again, so you do not extend it.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Shows which AUTH mechanisms the submission server offers after STARTTLS, so you can match the client setting to it.
TCP Port Test Confirms that the submission port (587 or 465) is reachable from where the application runs.

FAQ

Why does webmail work but SMTP fails with 5.7.8?: Many providers block basic SMTP authentication when multi-factor authentication or security defaults are on. You then need an app password, OAuth, or SMTP AUTH enabled for the mailbox.
Will the message be retried?: No. Authentication failed before the message was accepted, so your client still holds it and you must send it again after fixing the login.

All 191 bounce codes