3-digit reply code Permanent

SMTP error 530

Authentication required.

Updated Jul 1, 2026

The short answer

SMTP 530 means the server refused your command because authentication is required and you have not authenticated. Per RFC 4954, "530 5.7.0 Authentication required" is returned to MAIL FROM when no valid AUTH has taken place. Enable SMTP AUTH and supply valid credentials over TLS (port 587 with STARTTLS, or 465), issuing STARTTLS first if the server demands it.

Quick fix

Enable SMTP authentication (username/password or API key) in your client.

5 - Permanent. The server will not try again. Fix the cause before you resend.

What it means

530 is a permanent refusal that means the server will not accept your command until you authenticate. RFC 4954 defines "530 5.7.0 Authentication required" as the response any command other than AUTH, EHLO, HELO, NOOP, RSET, or QUIT should get when policy requires authentication and none is in force. In practice it almost always fires at MAIL FROM. It is about missing or impossible authentication, not wrong credentials: if you authenticate and the password is rejected, you get 535 instead. It is also not a blocklist error.

Common causes

You never logged in

"530 5.7.0 Authentication Required": your client sent MAIL FROM without a successful AUTH exchange. This is what Gmail returns for unauthenticated submission.

You tried to authenticate on a cleartext channel

"530 5.7.0 Must issue a STARTTLS command first": the server requires the session to be encrypted before it accepts AUTH, so a plaintext attempt is rejected.

Microsoft 365 with SMTP AUTH disabled

"530 5.7.57 ... not authenticated to send anonymous mail during MAIL FROM": SMTP AUTH is off by default tenant-wide and must be enabled on the mailbox.

How to fix it

Turn on SMTP authentication and supply valid credentials

The session must complete an AUTH LOGIN or AUTH PLAIN exchange before MAIL FROM.
Connect over TLS on a submission port

Use 587 with STARTTLS or 465 with implicit TLS. Do not authenticate on port 25 to a server that requires encryption, and issue STARTTLS first if you see the "Must issue a STARTTLS command first" variant.
Use a provider-correct credential

For Gmail and Google Workspace, use an App Password (with 2-Step Verification) or OAuth2, not your normal account password; Less Secure Apps was removed (personal 2022, Workspace by May 2025).
For Microsoft 365, enable Authenticated SMTP on the mailbox

Admin center, Active users, the mailbox, Manage email apps, Authenticated SMTP. Direct Send only reaches recipients in your own tenant and is being locked down, so for external mail enabling Authenticated SMTP is the correct fix.

Example with Nodemailer

Note auth plus a secure port; requireTLS refuses to send if the channel cannot be encrypted.

const transport = nodemailer.createTransport({
  host: "smtp.example.com",
  port: 587,
  secure: false,
  requireTLS: true,
  auth: { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS },
});

Paired code

A real bounce often shows both a 3-digit code and an enhanced code together. This one commonly pairs with:

Common questions

What is the difference between 530 and 535?

530 means the server never reached an authenticated state (you never attempted AUTH, or it was rejected before credentials were evaluated, such as missing STARTTLS). 535 means credentials were submitted and then rejected as invalid.

Why do I get "530 5.7.0 Must issue a STARTTLS command first"?

You tried to authenticate or send on an unencrypted channel. The server requires TLS first. Connect on 587 with STARTTLS or 465 with implicit TLS, and issue STARTTLS before AUTH.

Does 530 mean my IP is blocklisted?

No. 530 is about authentication, not reputation. Blocklist rejections surface as 550 or 554.

Related codes

All SMTP error codes