Gmail 530 5.7.0: must issue a STARTTLS command first
530 5.7.0Must issue a STARTTLS command firstPermanent: retrying will not helpFrom Gmail and Google Workspace
530 5.7.0 Must issue a STARTTLS command first. - gsmtp
What it means
Google’s submission server requires an encrypted session before it accepts AUTH or MAIL FROM. Your client connected on port 587 (or 25) and tried to proceed in plain text, so the server answered 530 with 5.7.0, the generic security status from RFC 3463. RFC 3207 defines the STARTTLS command that upgrades the connection.
Few situations are as simple to fix: it is a client setting, not an account problem. If your client uses port 465, it needs implicit TLS (often labelled SSL); on 587 it needs STARTTLS (often labelled TLS). Mixing the two gives this error or a hang.
Likely causes
- Encryption is set to “None” in the mail client, printer, or application.
- Port 587 used with an implicit-SSL setting the library does not apply on that port.
- An old library that does not support STARTTLS at all.
- A security appliance stripping STARTTLS from the server’s EHLO response.
How to fix it
- Set the server to smtp.gmail.com, port 587, encryption STARTTLS, with authentication on.
- Alternatively use port 465 with SSL/TLS (implicit).
- Update the library or firmware if it lacks TLS 1.2 support.
- If a firewall inspects SMTP, disable that feature for outbound connections to Google.
Checks that apply
- SMTP Diagnostics Connects to smtp.gmail.com and shows whether STARTTLS is advertised from your network, exposing appliances that strip it.
- TCP Port Test Checks that both 587 and 465 are reachable so you can pick a working port.
FAQ
- Should I use port 465 or 587 for Gmail?
- Either works. 587 uses STARTTLS after connecting; 465 encrypts from the first byte. Match the encryption setting to the port.
- Does this affect inbound mail to Gmail?
- No. This message comes from the submission server for authenticated sending.