SMTP error 432
Recipient incoming mail queue stopped (Exchange).
Updated Jul 1, 2026
SMTP 432 is a temporary authentication failure. Per RFC 4954 the full code "432 4.7.12 A password transition is needed" means the account must re-authenticate before the chosen login mechanism works again. Authenticate once with a fresh credential (often PLAIN over STARTTLS), then update the stored password in your client.
Retry later; the recipient admin resumes the queue.
What it means
432 is a transient reply, so the condition is temporary and can be retried after you fix it. Its meaning comes from RFC 4954, the SMTP authentication extension: "432 4.7.12 A password transition is needed" is returned during the AUTH handshake, not during recipient delivery. The server is telling the client that its stored credential or authentication state is stale and has to be refreshed before the chosen mechanism works. A separate Exchange convention maps a bare 432 to "the recipient's Exchange Server incoming mail queue has been stopped", which is a halted receive queue, not an auth problem. Read the enhanced code and text to tell the two apart.
Common causes
The account password was reset, so the mechanism needs a one-time re-authentication to re-sync.
The sending client holds a credential that no longer matches the server.
Some servers require you to authenticate once with PLAIN over an encrypted channel before a stronger mechanism works in later sessions.
A bare 432 on some Exchange servers means a paused receive queue (maintenance, too many connections, or admin work), not authentication.
How to fix it
- Re-authenticate with a current credential
Reset or regenerate the password, API key, or SMTP credential at your provider, and update it everywhere your client stores it.
- Make sure the session is encrypted before AUTH
RFC 4954 requires servers to refuse plaintext mechanisms unless STARTTLS is negotiated. Use STARTTLS on port 587 or implicit TLS on port 465 so PLAIN and LOGIN are permitted.
- Do the PLAIN bootstrap if required
Authenticate once with AUTH PLAIN over TLS, then retry the originally selected mechanism in a later session.
S: 250 AUTH CRAM-MD5 PLAIN LOGIN C: AUTH CRAM-MD5 S: 432 4.7.12 A password transition is needed C: AUTH PLAIN <base64 over TLS> S: 235 2.7.0 Authentication successful - For the Exchange queue variant
This is the recipient server, not your credentials. Retry later. If you run that server, check Queue Viewer (Get-Queue / Resume-Queue) for a stopped queue and resume it.
Paired code
A real bounce often shows both a 3-digit code and an enhanced code together. This one commonly pairs with:
Common questions
Is 432 permanent or temporary?
Temporary. It is a transient reply, so it clears after you re-authenticate or after a stopped queue resumes.
What is the difference between 432 4.7.12 and 454 4.7.0?
432 4.7.12 means your account needs a one-time re-authentication. 454 4.7.0 is a broader temporary auth failure the client should not re-prompt for.
Does 432 mean the recipient could not receive my email?
Not in the RFC sense. 4.7.12 is about your authentication. Only the Exchange queue-stopped variant is about the receiving side.