ProbeKit
Sign inSign up

530 5.7.57: Microsoft 365 SMTP client not authenticated

530 5.7.57Client not authenticated to send anonymous mailPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com

Example
530 5.7.57 SMTP; Client was not authenticated to send anonymous mail during MAIL FROM

What it means

You see this from smtp.office365.com on port 587 when a client sends MAIL FROM without first completing AUTH. That host is the client submission endpoint and never accepts anonymous mail, so it rejects the transaction straight away. The reply comes back to the device, app, or script, not as an NDR in a mailbox.

It is not a reputation or SPF problem. It means the client skipped authentication, or authentication silently failed and the client carried on anyway. A related answer, 535 5.7.139, appears when authentication is attempted but SMTP AUTH is disabled for the mailbox or the tenant.

Likely causes

  • A printer, scanner, or app is set to use smtp.office365.com with no username and password.
  • The client tried AUTH before STARTTLS, which Exchange Online does not allow, and fell back to sending without it.
  • Authenticated SMTP is disabled for the mailbox or the tenant, so the client never gets a working login.
  • The app uses basic credentials but the account requires MFA, so the login fails and the client proceeds anonymously.

How to fix it

  1. Configure the client with server smtp.office365.com, port 587, STARTTLS, and the full mailbox address as the username.
  2. Enable Authenticated SMTP for that mailbox in the Microsoft 365 admin center (Mail, Manage email apps).
  3. If the device cannot do modern SMTP AUTH, send instead to your MX endpoint (yourdomain-com.mail.protection.outlook.com) on port 25 with a connector that trusts your static IP.
  4. For an app, prefer OAuth for SMTP or the Microsoft Graph sendMail API rather than a stored password.

Checks that apply

  • SMTP Diagnostics Connects to the submission or MX host and shows the banner, STARTTLS, and the AUTH methods it offers.
  • TCP Port Test Checks that port 587 or 25 is reachable from your network before you blame credentials.
  • SPF Check If you switch to direct send or a connector, confirms your public IP is in SPF.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Why does it fail on MAIL FROM and not earlier?
The server lets the client connect and say EHLO, then refuses the first command that requires a login.
Is SMTP AUTH being retired?
Microsoft has been phasing out basic authentication for SMTP AUTH, so plan to move devices to OAuth, a connector, or another relay.

Microsoft 365 delist portal Outlook.com SNDS

All 191 bounce codes