ProbeKit
Sign inSign up

SMTP 530: authentication or STARTTLS required

530Authentication requiredPermanent: retrying will not help

Example
530 5.7.0 Must issue a STARTTLS command first.

What it means

Two RFCs use 530. RFC 4954 defines "530 5.7.0 Authentication required" for a server that will not accept the command (usually MAIL FROM) until the client has authenticated with AUTH. RFC 3207 uses 530 with text like "Must issue a STARTTLS command first" when the server insists on encryption before anything else.

You usually meet it on a submission server, when an app, printer, or website tries to send without logging in, or logs in on a plain connection. It can also appear on an MX that requires TLS from every sender.

It is permanent for that attempt, so the client must change how it connects. It differs from 535, where you did try to log in but the credentials were rejected, and from 538, where you tried an AUTH mechanism that is only allowed over TLS.

Likely causes

  • The client has authentication turned off or no username and password configured.
  • The client connects to port 587 but never sends STARTTLS, and the server requires it.
  • An application is pointed at a provider’s submission host when it should relay through a local server, or the other way round.
  • A scanner or appliance tries to send through Microsoft 365 or Gmail on port 25 without a connector or relay set up.

How to fix it

  1. Check the text: "Authentication required" means turn on SMTP AUTH; "STARTTLS" means enable TLS (STARTTLS on 587, or implicit TLS on 465).
  2. Set the client to port 587 with STARTTLS and enter the account’s full email address and password or app password.
  3. For devices that cannot authenticate, use a connector or relay that accepts mail by IP, such as a Microsoft 365 inbound connector or a local relay.
  4. Send a test message and check the log for the 235 reply that confirms a successful login.

Checks that apply

  • SMTP Diagnostics Shows whether the server offers STARTTLS and AUTH, and in which order, matching the requirement in the 530 reply.
  • TCP Port Test Tests whether ports 587 and 465 are reachable from your network, since some ISPs block them.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Why did sending work yesterday but gives 530 now?
Providers sometimes stop accepting unauthenticated or unencrypted submission. Check whether your client still has TLS and login enabled.
Is 530 the same as a wrong password?
No. A wrong password gives 535. 530 means the server did not see a login at all, or saw one before TLS.

All 191 bounce codes