Does 504 mean my password is wrong?

No. The server did not even try your credentials; it does not support the mechanism you asked for. A wrong password produces 535.

Which AUTH mechanism should I use?

Whatever the server lists after STARTTLS. PLAIN over TLS is widely supported; some providers require OAuth instead.

SMTP 504: command parameter not implemented

504Command parameter not implementedPermanent: retrying will not help

Typical wording

504 5.5.4 Unrecognized authentication type

What it means

RFC 5321 defines 504 as "Command parameter not implemented". The command itself is fine, but the argument names something this server does not support.

By far the most common case is AUTH. RFC 4954 specifies "504 5.5.4 Unrecognized authentication type" when the client asks for a SASL mechanism the server does not offer, for example CRAM-MD5 or NTLM on a server that only lists PLAIN and LOGIN. Postfix also uses 504 for HELO or address arguments that fail certain restrictions, such as a HELO hostname that is not fully qualified.

It differs from 502 (the whole command is unsupported) and from 555 (an unknown MAIL FROM or RCPT TO extension parameter). The enhanced code is normally 5.5.4, "Invalid command arguments".

Likely causes

The client is hard coded to a SASL mechanism that the server does not advertise.
The server only offers AUTH after STARTTLS, so the mechanism list before TLS is empty or shorter.
A Postfix server with `reject_non_fqdn_helo_hostname` or `reject_non_fqdn_sender` rejects a short HELO name or sender domain with 504 5.5.2.
The client asks for a mechanism like XOAUTH2 on a server that never implemented it.

How to fix it

Compare the AUTH line in the server’s EHLO reply with the mechanism your client uses, and choose one that appears there.
Run STARTTLS first; many servers only advertise mechanisms over an encrypted connection.
If the 504 mentions HELO or a sender, use a fully qualified name such as `mail.example.com` and a sender address with a full domain.
For modern providers that require OAuth, use a client that supports their OAuth flow rather than a password mechanism.

Checks that apply

Your domain or sending IP (fills in the checks below)

SMTP Diagnostics Shows the AUTH mechanisms the server advertises before and after STARTTLS, so you can set the client to a supported one.
A Record Verifies that your HELO hostname resolves, which strict Postfix setups check when they return 504 for HELO.

FAQ

Does 504 mean my password is wrong?: No. The server did not even try your credentials; it does not support the mechanism you asked for. A wrong password produces 535.
Which AUTH mechanism should I use?: Whatever the server lists after STARTTLS. PLAIN over TLS is widely supported; some providers require OAuth instead.

All 191 bounce codes