Tag: email deliverability

Your transactional emails have stopped sending. OTP codes are not reaching users. Password reset emails are failing silently. Your application looks broken to every new visitor trying to sign up. And somewhere in your error logs, there is a line that reads: 535 Authentication Failed or Username and Password not accepted.

SMTP authentication errors are one of the most disruptive email failures a developer or website owner can face. They block critical communication, damage user trust, and are often caused by something as simple as a missing app password or a disabled SMTP setting. This guide explains exactly why SMTP authentication errors happen and how to fix them permanently, step by step.

---

Why SMTP Authentication Error Happens (Quick Answer)

An SMTP authentication error occurs when the mail server rejects the login credentials provided during the email sending process. The most common causes are wrong username or password, using an account password instead of an app-specific password, two-factor authentication blocking the login, SMTP access being disabled on the email account, or incorrect SMTP host and port settings in the application configuration.

---

What Is SMTP Authentication?

SMTP authentication (often called SMTP AUTH) is the process by which an email client or application proves its identity to a mail server before being permitted to send emails. When your application calls an SMTP server, the server asks for a username and password. If those credentials are verified, the server allows the email to be sent. If authentication fails, the server returns an error code and the email is not delivered. Most SMTP authentication errors occur due to incorrect credentials or missing app password configuration.

---

Common SMTP Authentication Error Messages

Recognizing the exact error message helps narrow down the cause quickly. The most frequent SMTP authentication error messages include:

• 535 Authentication Failed – The server rejected the login attempt entirely.
• 535 5.7.8 Username and Password not accepted – Common with Gmail; usually means an app password is needed.
• SMTP Login Failed – Generic error from many mail clients and plugins.
• Authentication Unsuccessful – Common in Microsoft and Office 365 environments.
• 534-5.7.9 Please log in with your web browser and then try again – Google flagging a suspicious or blocked login attempt.
• 530 5.7.0 Must issue a STARTTLS command first – Encryption mismatch between client and server.

---

Main Causes of SMTP Authentication Error

1. Wrong Username or Password

The most straightforward cause is entering the wrong email address or password in the SMTP configuration. This happens during initial setup, after a password change, or when migrating servers. Even a single misplaced character in the password field will cause a 535 error.

Example: You recently changed your Gmail password but forgot to update the password in your WordPress SMTP plugin. Every email attempt now fails with a login error.

2. Using Account Password Instead of App Password

Google, Microsoft, and other providers no longer allow applications to use your main account password for SMTP access. You must generate a dedicated app password from your account security settings and use that in your application instead.

Example: A developer configures Nodemailer with their Gmail address and regular password. Gmail blocks the login because it requires an app-specific password for third-party SMTP access.

3. Two-Factor Authentication Issues

When two-factor authentication (2FA) is enabled on your email account, logging in via SMTP using your regular password is blocked by design. The provider expects you to use an app password that bypasses the 2FA prompt for machine-to-machine connections.

Example: An Office 365 account has MFA enforced by the administrator. A PHP application trying to send emails via that account’s SMTP credentials keeps receiving an authentication failure until an app password or OAuth token is configured.

4. SMTP Access Disabled

Many email providers disable SMTP access by default or after detecting suspicious activity. If SMTP sending has not been explicitly enabled in your email account settings, all authentication attempts will fail regardless of whether the credentials are correct.

Example: A newly created Gmail account has IMAP enabled but SMTP relay not configured. The application cannot send emails until SMTP access is turned on from the Google Admin Console or account settings.

5. Incorrect SMTP Settings

Using the wrong SMTP host, port, or encryption protocol causes the connection to reach the wrong endpoint, leading to authentication failures. Mixing up port 465 (SSL) with port 587 (TLS) is a common configuration mistake.

Example: A WordPress site is configured with smtp.gmail.com on port 25 with no encryption. Gmail does not accept unauthenticated SMTP on port 25, so every email fails.

6. Hosting Restrictions

Shared hosting providers frequently block outgoing connections on SMTP ports (25, 465, 587) to prevent spam abuse. Your application may have perfect credentials, but the firewall on the server-side will silently drop the connection before authentication can even occur.

Example: A Laravel application on a shared cPanel host cannot connect to an external SMTP server because the host blocks outbound port 587. The error appears as a connection timeout or authentication failure depending on how the client handles it.

---

How to Fix SMTP Authentication Error (Step-by-Step)

Quick Fix – Most Common Solution:

• Enable 2-Step Verification on your Google or Microsoft account
• Generate a dedicated app password from your account security settings
• Replace your regular account password with the app password in your SMTP config
• Verify SMTP host, port, and encryption match your provider’s requirements

Step 1: Verify Credentials

Start with the basics. Open your SMTP configuration file, plugin settings, or environment variables and confirm that:

• The username is the full email address, not just the username part (e.g., you@yourdomain.com, not you)
• The password is current and has not been changed recently
• There are no extra spaces, hidden characters, or encoding issues in the password field

Try logging into the email account manually through a browser to confirm the credentials work at the account level before debugging the application layer.

Step 2: Use an App Password

If your email provider supports or requires app passwords, generate one and use it in place of your main account password. This is mandatory for Gmail when 2-Step Verification is enabled, and strongly recommended for Microsoft 365 accounts with MFA.

For Gmail: Go to your Google Account > Security > 2-Step Verification > App passwords. Select “Mail” and your device, then copy the generated 16-character password. Use this in your SMTP configuration. Refer to Google’s official app password guide for the most current steps.

For Microsoft 365: Navigate to your Microsoft account > Security > Advanced security options > App passwords. Microsoft’s official app password documentation walks through the full process.

Step 3: Enable SMTP Access on Your Email Account

Verify that SMTP sending is enabled on your email account, not just IMAP or POP access.

• Gmail: Go to Settings > See all settings > Forwarding and POP/IMAP. Enable IMAP (which also unlocks SMTP sending).
• Google Workspace: In Google Admin Console, go to Apps > Google Workspace > Gmail > End User Access and enable SMTP relay.
• Microsoft 365: Go to Microsoft 365 Admin Center > Active users > Select user > Mail > Manage email apps. Enable Authenticated SMTP.

Step 4: Check SMTP Configuration

Cross-reference your application’s SMTP settings against your provider’s official documentation. Misconfiguration is one of the leading causes of authentication failures. Here is a reference for the most common providers:

Provider	SMTP Host	Port (TLS)	Port (SSL)
Gmail	smtp.gmail.com	587	465
Outlook / Hotmail	smtp-mail.outlook.com	587	N/A
Microsoft 365	smtp.office365.com	587	N/A
Yahoo Mail	smtp.mail.yahoo.com	587	465
PhotonConsole	smtp.photonconsole.com	587	465

Step 5: Fix Port and Encryption Settings

Using the wrong port or encryption method is a silent configuration error. The mail server will either refuse the connection or fail authentication because the handshake does not match expectations.

• Port 587 + STARTTLS (TLS) – The recommended modern configuration for most providers.
• Port 465 + SSL/TLS – Used by providers that require implicit SSL from the start of the connection.
• Port 25 – Reserved for server-to-server communication. Do not use for authenticated client SMTP sending.

Always match the encryption setting in your application (TLS vs SSL) to the port number. Mismatching these two values is a very common cause of authentication failures that appear identical to credential errors in the logs.

Step 6: Use a Reliable SMTP Service

Here is where most people reach a breaking point: personal and business email accounts like Gmail and Outlook were not designed for high-volume application email sending. They have sending limits, rate restrictions, security blocks, and deliver poor results for transactional email at scale.

Switching to a dedicated SMTP relay service like PhotonConsole eliminates most authentication errors permanently because:

• Credentials are stable and specifically designed for application use
• No 2FA complications or app password requirements
• SMTP access is always enabled and monitored
• Infrastructure is purpose-built for transactional and bulk email delivery
• SPF, DKIM, and DMARC are pre-configured for high deliverability

---

SMTP Authentication Error in Different Platforms

Gmail

Gmail is the most common source of SMTP authentication errors for developers. The 535 5.7.8 error almost always means you are using your regular account password instead of a generated app password. Google requires app passwords for all third-party SMTP clients when 2-Step Verification is active. Additionally, Google may temporarily block access if it detects a login from an unrecognized application or location, showing the “Please log in with your web browser” error.

Fix: Enable 2-Step Verification, generate an app password, and use that 16-character password in your SMTP settings.

WordPress

WordPress sends emails through PHP’s built-in mail() function by default, which bypasses SMTP authentication entirely and relies on the server’s sendmail binary. This setup has poor deliverability and frequently fails on managed hosting. The fix is to use an SMTP plugin (WP Mail SMTP, FluentSMTP, or Post SMTP) and configure it with proper credentials.

Quick Fix for WordPress SMTP Authentication Error:

• Install WP Mail SMTP or Post SMTP plugin
• Enter your SMTP host, port, username, and app password
• Set encryption to TLS and port to 587
• Send a test email from the plugin dashboard
• Check plugin logs if the test fails for the exact error code

If your hosting provider blocks outgoing SMTP ports, switching to a dedicated SMTP relay service is the most reliable solution, as it typically operates over alternative ports or HTTPS-based APIs that bypass hosting restrictions.

PHPMailer

PHPMailer is one of the most widely used PHP libraries for sending email. Authentication errors in PHPMailer are usually caused by incorrect credentials, missing SMTPAuth flag, or wrong encryption settings.

A correct PHPMailer configuration for Gmail looks like this:

$mail = new PHPMailer(true);
$mail->isSMTP();
$mail->Host       = 'smtp.gmail.com';
$mail->SMTPAuth   = true;
$mail->Username   = 'you@gmail.com';
$mail->Password   = 'your-app-password';
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
$mail->Port       = 587;

Set SMTPAuth to true and always use an app password, not your regular Gmail password. Enable SMTP debugging with $mail->SMTPDebug = 2; to see the full server response during troubleshooting.

Nodemailer

For Node.js applications using Nodemailer, SMTP authentication errors typically surface as Invalid login or 535 Authentication credentials invalid. The most common fix is identical to PHPMailer: use an app password and verify the service and port.

const transporter = nodemailer.createTransport({
  host: 'smtp.gmail.com',
  port: 587,
  secure: false,
  auth: {
    user: 'you@gmail.com',
    pass: 'your-app-password'
  }
});

Set secure: false when using port 587 with STARTTLS. Set secure: true when using port 465 with SSL. Mixing these values will cause a TLS handshake failure that looks like an authentication error.

---

When to Use a Dedicated SMTP Service

If you are repeatedly dealing with SMTP authentication errors, hitting Gmail sending limits, or watching emails land in spam, these are infrastructure problems — not configuration problems. No amount of credential tweaking will fix a Gmail account that was never designed to send thousands of transactional emails per day.

A dedicated email delivery service like PhotonConsole is built specifically for this use case. It provides stable SMTP credentials that never expire, a high-deliverability relay infrastructure with pre-configured SPF and DKIM, email logs and delivery tracking, and a pay-as-you-use pricing model that scales with your business. You can review available plans on the PhotonConsole pricing page.

Unlike Gmail or Outlook, a purpose-built SMTP relay does not have the security restrictions, 2FA complications, or account-level sending limits that cause most authentication errors in the first place.

---

SMTP Authentication Error – Quick Fix Summary Table

Error Message	Most Likely Cause	Fix
535 Authentication Failed	Wrong username or password	Verify credentials, use app password
535 5.7.8 Username and Password not accepted	Regular password used instead of app password	Generate and use a Google app password
SMTP Login Failed	Wrong credentials or SMTP disabled	Enable SMTP access, verify login
Authentication Unsuccessful	MFA blocking access (Microsoft 365)	Create an app password or use OAuth
534 Please log in via your browser	Google security block	Use app password, review security alerts
530 Must issue STARTTLS first	Encryption mismatch	Set encryption to TLS, port to 587
Connection Timeout	Hosting blocking outbound SMTP ports	Use a dedicated SMTP relay service

---

Pro Tips to Avoid SMTP Authentication Errors

• Never use your main account password for SMTP. Always generate an app password or use API-based authentication when available.
• Store credentials in environment variables. Hardcoding SMTP passwords in source code leads to accidental exposure and makes credential rotation painful.
• Test your email configuration before deploying. Use tools like Mail Tester or MXToolbox Email Health to verify SMTP connectivity and authentication before going live.
• Set up SPF, DKIM, and DMARC records. Authentication failures sometimes happen at the DNS level, not just the SMTP credential level. Missing or misconfigured email authentication records can cause delivery failures that look like SMTP errors.
• Monitor SMTP logs regularly. Most frameworks and SMTP plugins provide logs. Checking them proactively catches credential expiration or rate-limit issues before they become outages.
• Rotate app passwords periodically. If you suspect a credential has been exposed or if you receive unexpected authentication failures, regenerate the app password immediately and update all dependent applications.
• Use a dedicated sending domain. Sending transactional email from your primary domain’s Gmail account puts your entire email reputation at risk. A dedicated subdomain (e.g., mail.yourdomain.com) with a reliable SMTP relay keeps business and application email separate.

---

Related SMTP Issues You Might Face

SMTP authentication errors are often part of a broader set of email delivery problems. Once authentication is resolved, you may still encounter the following:

• SMTP Not Working: The connection never establishes. Usually a firewall, wrong host, or blocked port issue rather than a credentials problem.
• SMTP Connection Error: The client times out before authentication can begin. Often caused by hosting providers blocking outbound SMTP ports.
• SMTP Server Not Sending Emails: Authentication succeeds but emails do not arrive. The cause is usually deliverability issues, a full queue, or DNS misconfiguration.
• Emails Going to Spam: A deliverability issue caused by missing SPF/DKIM records, sending from a low-reputation IP, or email content triggering spam filters.
• SMTP Rate Limiting: The server accepts authentication but throttles or rejects messages after a daily quota is reached. Common when using Gmail for application sending.

Quick Fix – If Authentication Passes But Emails Still Fail:

• Check SPF and DKIM DNS records using MXToolbox
• Verify the sender address matches the authenticated account
• Review SMTP server logs for bounce or rejection messages
• Test deliverability with mail-tester.com before sending in volume

---

Frequently Asked Questions

What does SMTP error 535 mean?

SMTP error 535 means the mail server rejected the authentication attempt. The server received the username and password but could not verify them. This usually means the credentials are wrong, an app password is required, or SMTP access is disabled on the account.

How do I fix “Username and Password not accepted” in Gmail?

Enable 2-Step Verification on your Google account, then go to Security > App passwords and generate a new app password for mail. Use that 16-character password in your SMTP configuration instead of your regular Gmail password.

Why does my SMTP authentication keep failing even with the correct password?

If credentials are correct but authentication still fails, the most likely cause is that your email provider requires an app password (not your account password) for SMTP access, or that SMTP access has not been enabled on the account. Two-factor authentication and hosting-level firewall blocks are also common culprits.

Is port 465 or 587 better for SMTP?

Port 587 with STARTTLS is the recommended modern standard for client SMTP submission. Port 465 with implicit SSL is also widely supported and acceptable. Avoid port 25 for application-level sending, as it is reserved for server-to-server mail transfer and is frequently blocked by hosting providers.

Can I use Gmail SMTP for sending application emails?

Gmail SMTP can be used for low-volume application email sending, but it has a 500-emails-per-day limit for regular accounts and 2,000 for Workspace accounts. It also requires app passwords, has security restrictions, and is not designed for reliable transactional email delivery at scale. A dedicated SMTP relay service is a better long-term choice for production applications.

What is the difference between SMTP authentication and email authentication?

SMTP authentication refers to the login process when your application connects to the SMTP server (username and password). Email authentication refers to DNS-level protocols (SPF, DKIM, DMARC) that prove the email was sent from an authorized server. Both are necessary for reliable email delivery.

How do I test if my SMTP settings are correct?

Use a tool like MXToolbox SMTP diagnostics or send a test email through your application with SMTP debug logging enabled. PHPMailer supports SMTPDebug = 2 and Nodemailer supports a debug: true option that prints the full server conversation to the console.

---

Conclusion

SMTP authentication errors are not random. They are almost always caused by a specific, fixable configuration issue: wrong credentials, a missing app password, a disabled SMTP setting, or a port mismatch. Authentication failures are one of the most common causes of email delivery issues in web applications, and they can be resolved systematically by following the steps in this guide.

For developers and businesses sending critical transactional email, the real long-term solution is to stop relying on consumer email accounts as your SMTP backend. Gmail and Outlook impose daily sending limits, require complex security workarounds, and are not designed for production application email. Every hour of downtime caused by an SMTP authentication failure is a user who did not receive their OTP, a customer who never got their order confirmation, and revenue that was silently lost.

A purpose-built email delivery service like PhotonConsole solves this at the infrastructure level. Stable SMTP credentials, pre-configured SPF and DKIM, a high-deliverability relay network, and email tracking logs that make debugging fast and simple. If you are ready to stop chasing authentication errors and start sending reliably, explore the PhotonConsole SMTP relay and review the pricing options that scale with your sending volume.

---

Read More

• SMTP Not Working? 10 Common Errors and How to Fix Them (Step-by-Step Guide)