My password is right; why 5.7.9?

The server is refusing the login method, not the password. With two-factor authentication on, use an app password or OAuth.

Is an app password safe?

It is a long random secret limited to mail access that you can revoke separately, which is safer than storing your main password in a device.

534 5.7.9: authentication mechanism is too weak

5.7.9Authentication mechanism is too weakPermanent: retrying will not help

Typical wording

534 5.7.9 Authentication mechanism is too weak

What it means

X.7.9 comes from RFC 4954, which pairs it with reply 534: “authentication mechanism is too weak”. The server understood your AUTH attempt but refuses the method itself, because policy requires a stronger one than the client chose.

Historically this meant using PLAIN or LOGIN where the server wanted a challenge-response mechanism. Today providers use it more broadly. Google, for example, answers 534 5.7.9 when an account with 2-Step Verification is used with a normal password, and tells you to use an application-specific password instead.

Do not confuse it with 5.7.8, where the credentials are simply wrong. With 5.7.9 the password may be correct, but the way you presented it is no longer allowed. There is no 4.7.9 in normal use.

Likely causes

Using the account password from a client on an account protected by two-factor authentication.
A client configured for PLAIN or LOGIN where the server policy requires OAuth 2.0 (XOAUTH2).
A device firmware too old to support the mechanisms the provider now requires.
An organisation policy that disables legacy authentication for SMTP.

How to fix it

Check the provider’s help for SMTP clients; it states whether app passwords or OAuth are required.
Generate an app password in the account security settings and use it in place of the normal password.
Where possible, switch the client to OAuth sign-in, which is the long-term supported method for most large providers.
For devices that cannot do either, send through a relay you control or a transactional mail service that supports API keys.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Lists the AUTH mechanisms the server advertises, which shows whether OAuth (XOAUTH2) or only legacy methods are on offer.
Google/Yahoo Compliance Useful if the device also sends to Gmail users, since the same sender then needs SPF, DKIM, and DMARC to land well.

FAQ

My password is right; why 5.7.9?: The server is refusing the login method, not the password. With two-factor authentication on, use an app password or OAuth.
Is an app password safe?: It is a long random secret limited to mail access that you can revoke separately, which is safer than storing your main password in a device.

All 191 bounce codes