SMTP error 454
Temporary authentication failure, or TLS not available.
Updated Jul 1, 2026
SMTP 454 is a temporary failure. It most often means a temporary authentication problem (454 4.7.0: too many login attempts, Exchange clock or SPN issues, SES rate throttling, or TLS unavailable) or relay access denied (454 4.7.1). Back off and retry, fix credentials or the App Password, or resolve TLS.
Retry; verify TLS is available and credentials are correct.
What it means
454 is a transient reply. Per RFC 5321, any code starting with 4 means the command was refused but the condition is temporary, so the client should retry later. That reframes most 454 troubleshooting: unlike a permanent 5xx, a well-behaved client should back off and retry rather than treat it as a hard failure. It is used for two temporary conditions, told apart by the enhanced code.
Common causes
The server accepted the AUTH format but could not complete login now. Google returns "454 4.7.0 Too many login attempts" when an account exceeds its login-frequency or connection limits.
Amazon SES replies "454 Throttling failure: Maximum sending rate exceeded" past your rate, and a separate "454 Throttling failure: Daily message quota exceeded" when you hit the 24-hour limit (which needs a different fix: wait or request an increase).
On Exchange, "454 4.7.0 Temporary authentication failure" (Event ID 1035) is usually clock skew over 5 minutes, AD replication lag, missing or duplicate SPNs, or blocked Kerberos ports, not your client credentials.
The STARTTLS extension defines "454 TLS not available due to temporary reason", for example an invalid or temporarily unavailable certificate.
"454 4.7.1 Relay access denied" means the server requires authentication before it accepts the recipient.
How to fix it
- Retry with backoff first
For SES throttling, AWS advises waiting 5s, then 10s, then 30s, and if the third retry fails, 20 minutes before repeating. For Google "too many login attempts", pause and reduce the number of tools connected to the mailbox.
- Verify credentials the right way
For Gmail, do not look for "Less Secure Apps"; Google removed it (personal accounts in 2022, Workspace fully by September 30, 2024). Use an App Password with 2-Step Verification, or OAuth2.
- Fix TLS for a TLS-unavailable 454
Ensure the server certificate is valid and current, connect on a TLS-capable port, and issue STARTTLS only once. Both 587 (STARTTLS) and 465 (implicit TLS) are valid.
- Fix relay denial for 454 4.7.1
Authenticate before sending, or confirm your IP or account is authorized to relay through that server.
- Server operators (Exchange 454 4.7.0)
Sync clocks to within 5 minutes, force AD replication, verify and deduplicate the SMTP SPNs, open Kerberos ports, and confirm Exchange authentication is enabled on the receive connector.
Paired code
A real bounce often shows both a 3-digit code and an enhanced code together. This one commonly pairs with:
Common questions
Is 454 permanent?
No. It is a transient reply; the command was refused but the condition is temporary and the sender should retry later.
What is the difference between 454 4.7.0 and 454 4.7.1?
4.7.0 is a temporary auth or TLS failure (retry, fix credentials, or fix TLS). 4.7.1 is relay access denied (authenticate or get your IP authorized).
Why does Gmail return 454 4.7.0 Too many login attempts?
The account exceeded its login-frequency or concurrent-connection limit, often from repeated bad passwords or too many tools polling the same mailbox. Pause and reduce connections.