A 530 reply is one of the few SMTP errors that points directly at your own configuration. It says that the server needs something from you before it will accept a message, and you did not provide it. In practice it comes in two forms. The first is 530 5.7.0 Must issue a STARTTLS command first, which means the server insists on an encrypted connection and your client tried to continue in clear text. The second is 530 5.7.0 Authentication Required (or the similar 530 5.7.1 Client was not authenticated), which means the server wants a user name and password and your client did not log in. Both are permanent for that session, and both are fixed in settings, not by retrying. This guide explains what is happening on the wire, shows the setting to change in the most common clients, and gives a manual test that shows you exactly which step fails.
How an SMTP session is supposed to go
An SMTP session starts with the client connecting to the server and the server sending a greeting. The client says EHLO and the server replies with a list of the features it supports. On a submission port, the list normally includes STARTTLS and, after encryption starts, the AUTH mechanisms. The client then sends STARTTLS, the two sides negotiate encryption, and the client says EHLO again. Only then does it authenticate with AUTH and send the message with MAIL FROM, RCPT TO and DATA. Servers that require encryption refuse any of the later commands until STARTTLS has succeeded, and servers that require authentication refuse MAIL FROM until AUTH has succeeded. A 530 reply is that refusal. The specifications are RFC 3207 for STARTTLS and RFC 4954 for authentication.
Form 1: Must issue a STARTTLS command first
This appears when a client connects to a port that expects encryption and then tries to authenticate or send without it. The usual reasons are:
- The security setting in the application is "None" or "Off" while the server requires TLS.
- The client is configured for implicit TLS (often labelled SSL) but connects to port 587, or it uses STARTTLS but connects to 465. The port and the mode must match.
- The client is set to "STARTTLS if available" and the server's offer was removed by a firewall or proxy on the path, so the client quietly continued in clear text.
- An old library does not support the TLS version the server requires.
- A script written years ago still uses port 25 with no encryption, and the server was changed to require it.
The fix is to enable encryption and to use the right port for it. Use port 587 with STARTTLS, or port 465 with implicit TLS. Our guide to choosing an SMTP port explains the difference, and how email encryption in transit works gives the background. Prefer "STARTTLS required" over "STARTTLS if available" wherever your client offers the choice, because the optional setting can silently send your password in clear text.
Form 2: Authentication required
This appears when a client reaches MAIL FROM without having logged in. Typical causes:
- The "SMTP authentication" option is off. Many plugins and applications ship with it off by default.
- The user name or password field is empty, because an environment variable or a configuration value did not load in this environment.
- The client tried to authenticate before encryption started, and the server does not advertise
AUTHuntil TLS is active, so the client concluded that login is not supported and went ahead without it. - The client uses a mechanism the server does not offer. Most servers accept
PLAINandLOGINafter TLS; a client set to a different mechanism will fail. - The message is being sent through the wrong server, for example a relay that requires login when the application expected an open internal relay.
Turn authentication on, enter the credentials from your SMTP provider's dashboard and make sure the secure connection starts first. If the credentials are then rejected, you will see a different error, 535; that is covered in SMTP error 535. Moving from a 530 to a 535 is progress: it means the server is now willing to look at your login.
Test the session by hand
A manual test separates the client from the server. The command below opens a STARTTLS session on port 587 and prints the server's replies.
openssl s_client -starttls smtp -crlf -connect smtp.example.com:587
EHLO test.example.com
AUTH LOGIN
QUITRead the output in order. After the first EHLO, check that the server lists AUTH (for example 250-AUTH PLAIN LOGIN); if it does not, the server hides authentication until encryption starts, and this command has started it, so a missing list means the account type or port is wrong. After AUTH LOGIN the server sends a base64 prompt for the user name, which proves the login stage is reachable. For a full test with credentials, use swaks, which prints each step and its reply; the commands are in how to test an SMTP connection. Never paste real passwords into a shared terminal log or a support ticket, and rotate any password you exposed.
Settings by client
| Client | Setting to check | Correct value for port 587 | Correct value for port 465 |
|---|---|---|---|
| WordPress SMTP plugins | Encryption and Authentication | TLS (STARTTLS), authentication on | SSL, authentication on |
| PHPMailer | SMTPSecure, SMTPAuth, Port | PHPMailer::ENCRYPTION_STARTTLS, true, 587 | PHPMailer::ENCRYPTION_SMTPS, true, 465 |
| Nodemailer | secure, requireTLS, auth | secure: false, requireTLS: true, auth set | secure: true, auth set |
| Python smtplib | Class and calls | SMTP then starttls() then login() | SMTP_SSL then login() |
| Postfix as a client | smtp_tls_security_level, smtp_sasl_auth_enable | encrypt, yes | smtp_tls_wrappermode = yes with encrypt |
| Mail clients (Outlook, Thunderbird) | Connection security and Authentication method | STARTTLS, normal password | SSL/TLS, normal password |
If you maintain Postfix, the walk-through in configuring Postfix to relay with authentication shows the full set of parameters. For application code, our guides for PHPMailer, Python and Nodemailer have complete examples.
Related variants you may meet
| Reply | Meaning | Fix |
|---|---|---|
530 5.7.0 Authentication Required (Gmail style) | Login is required before sending on a submission port | Enable authentication and use an app password or an approved sign-in method |
530 5.7.1 Client was not authenticated (Exchange style) | The sender must authenticate for this connector or mailbox | Authenticate, or use a connector that allows your IP |
534 5.7.9 Application-specific password required | The account needs an app-specific password, not the normal password | Create one in the account security settings |
535 5.7.8 Authentication credentials invalid | Login was attempted and refused | Check credentials; see the 535 guide |
554 5.7.1 Relay access denied | The server does not relay for you | Authenticate or send from an allowed network |
Several of these overlap with settings of the sending account itself. If you use Microsoft 365, the right option depends on whether you use authenticated submission or a connector; which Microsoft 365 option to use compares them. For Google accounts, see Gmail SMTP settings.
Why the error appears "after it used to work"
A configuration that worked for years can start failing with a 530 without any change on your side. Providers tighten their rules over time: they begin to require encryption on ports that used to allow clear text, they disable weak authentication, or they close an open relay. A server upgrade can also change the default TLS versions, leaving an old client unable to negotiate. Look at the date when the failures began and check the provider's announcements. Update the client library, enable current TLS, and replace any use of port 25 for client submission with 587 or 465. If a device such as a printer or scanner cannot support modern TLS, put a local relay in between that accepts the device's simpler connection on your network and forwards the mail securely.
Secure submission, ready to use Port 587 with STARTTLS and port 465 with TLS, with the exact settings shown in your dashboard.
References and further reading
Frequently asked questions
What does "530 5.7.0 Must issue a STARTTLS command first" mean?
The server requires an encrypted connection and your client tried to authenticate or send before starting TLS. Enable STARTTLS on port 587 or use implicit TLS on port 465.
What does "530 5.7.0 Authentication Required" mean?
The server requires you to log in before sending and your client did not authenticate. Turn on SMTP authentication and enter the correct credentials.
Which port should I use to avoid a 530 error?
Use 587 with STARTTLS, or 465 with implicit TLS. The security mode in your client must match the port.
Is "STARTTLS if available" safe?
It is weaker than requiring STARTTLS, because a network device that removes the offer can cause the client to continue without encryption. Require STARTTLS where possible.
Why do I get a 530 after it worked before?
Providers tighten their rules over time and may now require encryption or authentication. Update the client, use a current port and enable both.