SMTP Error 535 - Authentication failed. | Warmup Inbox

The short answer

SMTP 535 5.7.8 means the server rejected your AUTH credentials. It is a permanent authentication failure, not a delivery problem. Fix it by supplying correct credentials: for Gmail or Workspace use an App Password or OAuth2, for SendGrid use the literal username "apikey" plus the full API key, and for Amazon SES use SES-generated SMTP credentials (not IAM keys) in the right Region.

Quick fix

Re-check credentials — many providers require an app-specific password or API key rather than your normal login.

5 - Permanent. The server will not try again. Fix the cause before you resend.

What it means

535 is the server's response to the AUTH command. RFC 4954 defines it as "535 5.7.8 Authentication credentials invalid": the username, password, API key, or token you presented was not accepted, and the client should ask for new credentials. It is a permanent failure and is not a recipient, DNS, or content problem. You usually see it as "535-5.7.8 Username and Password not accepted" (Gmail) or "535 Authentication failed" (SendGrid, SES).

Common causes

Wrong or stale credentials
Credentials are case-sensitive, and the username is usually the full email address, not the local part.
Basic password auth no longer allowed

Google removed Less Secure Apps for personal Gmail in 2022 and phased out legacy password auth for Workspace (full enforcement by March 2025), so a raw account password returns 535 even when correct.

Wrong credential type for the provider

Using an AWS IAM key with SES, or your real password instead of an API key with SendGrid, fails even though the value is valid elsewhere.

2-Step Verification without an App Password or OAuth2

With 2SV on, the account password will not work over SMTP.

Whitespace, Region, or TLS problems

A stray newline inside a base64 key breaks the exchange; SES credentials only work in the Region that created them; and some providers require TLS 1.2 or newer.

How to fix it

Gmail or Google Workspace
Enable 2-Step Verification, create an App Password, and use it with your full address as the username. If App Passwords are disabled by an admin, use OAuth2. Host smtp.gmail.com, port 587 or 465.
SendGrid
Set the username to the literal string "apikey" and the password to the full API key. Ensure no whitespace or newlines crept into a base64 key and that your client negotiates TLS 1.2 or newer.
Amazon SES
Use credentials generated in the SES console ("Create SMTP credentials"), not your IAM access key, and connect to the same Region the credentials were created in.
Verify the credential manually
Reproduce the AUTH exchange to isolate the credential from your app. A "235 Authentication Succeeded" means the credential is good and the problem is your app config; a repeat 535 means the credential itself is rejected.

openssl s_client -connect smtp.example.com:587 -starttls smtp
EHLO test
AUTH LOGIN
<base64 username>
<base64 password>

Paired code

A real bounce often shows both a 3-digit code and an enhanced code together. This one commonly pairs with:

X.7.8Authentication credentials invalid

Common questions

Is 535 a real RFC code?
Yes. RFC 4954 defines 535 with enhanced status 5.7.8 as "Authentication credentials invalid", the negative reply to the AUTH command. It is a permanent authentication failure.
Why do I get 535 with Gmail even though my password is correct?
Gmail no longer accepts a raw account password over SMTP. Use an App Password with 2-Step Verification, or OAuth2.
What username and password should I use for SendGrid?
The username is the literal string "apikey" and the password is your full API key, not your email and account password.

Ready when you are

Most rejections come back to sender reputation.

Blocklists, auth failures, and policy blocks are what warmup prevents. Warm up your domain so your mail is trusted before you hit send.