ProbeKit
Sign inSign up

Gmail 534 5.7.9: application-specific password required

534 5.7.9Application-specific password requiredPermanent: retrying will not helpFrom Gmail and Google Workspace

Example
534-5.7.9 Application-specific password required. Learn more at https://support.google.com/mail/?p=InvalidSecondFactor - gsmtp

What it means

Your account has 2-Step Verification enabled, and the program trying to send through smtp.gmail.com used the regular password. Because a mail client cannot answer a second-factor prompt, Google asks for a 16-character app password instead. The reply code 534 with 5.7.9 corresponds to the RFC 4954 status “authentication mechanism is too weak”.

This error is more helpful than 5.7.8: it tells you the account was found and the password matched, but the method is not allowed. It affects only submission from apps and devices. Mail from other servers to your Gmail inbox is untouched.

Likely causes

  • The app is configured with the main Google password after 2-Step Verification was turned on.
  • An older app password was removed when you changed your Google password, which revokes all of them.
  • A device firmware that cannot store passwords longer than a set length truncated the app password.

How to fix it

  1. Go to myaccount.google.com, Security, and open App passwords.
  2. Create a new app password, name it after the device, and copy the 16 characters.
  3. Enter it as the SMTP password with the full address as username, server smtp.gmail.com, port 587 with STARTTLS or 465 with implicit TLS.
  4. Prefer apps that support Sign in with Google, so you do not have to manage app passwords at all.

Checks that apply

  • SMTP Diagnostics Verifies smtp.gmail.com answers and offers STARTTLS from your network before you retry the login.
  • TCP Port Test Checks that a firewall is not blocking 587 or 465 and producing a separate failure.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Is an app password less secure?
It gives full mailbox access, so treat it like a password. You can revoke each one individually without touching your main password.
Is 534 5.7.9 related to Yahoo’s 5.7.9 errors?
No. Yahoo uses 5.7.9 for policy rejections of inbound mail; this one is purely a Google login rule.

Google Postmaster Tools Google email sender guidelines

All 191 bounce codes