535 5.7.8: username and password not accepted

535 5.7.8 is a permanent SMTP reply: login rejected. This page is part of our SMTP error code reference, where every code links to the RFC and to what Gmail, Outlook and Yahoo publish about it.

Kind

Permanent: sending the same message again fails the same way

Retry by hand

No, fix the cause first

In Mailbay

bounced, address not suppressed

What 535 5.7.8 means#

RFC 4954 defines 535 5.7.8 Authentication credentials invalid: "the authentication failed due to invalid or insufficient authentication credentials" ^[1]. It is the answer to the AUTH command, so no message was sent.

What Gmail, Outlook and Yahoo say#

Gmail

Lists "Username and Password not accepted" for this case. Its page prints the code as "535 5.7.80", which looks like a typing slip for 5.7.8 ^[2].

Outlook and Microsoft 365 and Yahoo do not list 535 5.7.8 on the error pages we read, so we do not guess what they mean by it.

Common causes#

• A wrong or revoked password or API key, often an old value left in an environment variable.
• The wrong username: many sending services expect a fixed username with the key as the password.
• An account password where the server wants an app password or a key.
• A key that exists but is not allowed to send.

How to fix it#

1. Print the length and first characters of the secret your app actually loads, never the whole value, to rule out an empty or stale variable.
2. Check the username your provider documents for SMTP.
3. Create a new key or app password and try it from the command line before changing code.

How Mailbay reports it#

When a recipient's server answers 535 5.7.8 to mail you send through Mailbay, the recipient becomes bounced and you get a message.bounced event with the server's reply in response and permanent: false. The message statuses page lists every state.

A policy refusal says nothing about whether the address exists, so Mailbay does not suppress it, and it does not count toward the automatic pause, which only counts hard bounces and spam complaints.

Mailbay's submission server (smtp.mailbay.dev, ports 587 and 465) answers 535 5.7.8 with what it expects: the username mailbay with an API key that can send, or an inbox address with that inbox's app password. After repeated failures from one address it answers 454 4.7.0 for 15 minutes. The sending guide has working settings for Nodemailer and Supabase.

Related codes#

• 530 5.7.0: sign in first, permanent.
• 550 5.7.1: refused for a policy reason, permanent.
• 421 4.7.0: temporary refusal, connection closed, temporary.
• 552 5.3.4: message too big, permanent.
• 451 4.7.1: deferred: rate limit or policy, temporary.

Seeing an API error rather than an SMTP code? Mailbay's own errors, each with a fix, are on the errors page.