SMTP: 535 5.7.139 Authentication unsuccessful
Microsoft 365 accepted your username and password but refused the login because authenticated SMTP submission is turned off for the tenant or the mailbox. It is off by default in newer tenants and when security defaults are enabled. The password is not wrong, so resetting it will not help; a printer, scanner or old app sending through smtp.office365.com is the typical victim.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Check the tenant-wide and per-mailbox settings (Exchange Online PowerShell)
Connect-ExchangeOnline
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -Identity [email protected] | Format-List SmtpClientAuthenticationDisabled
# Enable it for just the one mailbox that needs it
Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false
# Security defaults block basic SMTP AUTH regardless of the above.
# Better long term: OAuth for SMTP, or a connector-based relay
# for devices that cannot do OAuth
# Test the login
# openssl s_client -starttls smtp -connect smtp.office365.com:587# Exchange Online PowerShell
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline
# Tenant-wide setting, then the specific mailbox
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -Identity [email protected] | Format-List SmtpClientAuthenticationDisabled
# Enable authenticated SMTP only where it is needed
Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false
# Test the port is reachable
Test-NetConnection smtp.office365.com -Port 587How to diagnose Email errors
SMTP errors follow a strict convention: a 4xx code is temporary and will be retried, a 5xx is permanent and will not. Beyond delivery mechanics, most modern email problems are authentication problems (SPF, DKIM and DMARC alignment) which cause silent filtering into spam rather than an explicit bounce, and therefore need to be checked proactively.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Read the full bounce message. The enhanced status code (for example
5.7.1) is far more specific than the three-digit code and usually names the exact policy that rejected the message. - Test the SMTP conversation manually with
swaks --to [email protected] --server smtp.example.com --tls. It shows each command and response. - Verify SPF, DKIM and DMARC records with
dig TXT example.com,dig TXT selector._domainkey.example.comanddig TXT _dmarc.example.com. - Check DMARC alignment, not just presence: the domain in the
From:header must align with the SPF or DKIM domain, or DMARC fails even when both pass individually. - Confirm the sending IP is not on a blocklist and has valid reverse DNS. Missing PTR records cause rejection by many large providers.
Tools worth reaching for
swaksdig TXTopenssl s_client -starttls smtppostfix mail logsDMARC aggregate reports
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related Email errors
- DKIM: Signature verification failedThe DKIM signature on the email does not match. The DNS public key record may be wrong, or…
- DMARC: dmarc=fail (p=reject) in Authentication-ResultsSPF or DKIM passed on its own but neither aligned with the domain in the From header, and…
- Postfix: 450 4.1.8 Sender address rejected: Domain not foundThe receiving Postfix has reject_unknown_sender_domain enabled and could not find an A or MX…
- Postfix: connect to mx1.example.net[203.0.113.25]:25: Connection timed outYour server never got a TCP connection to the recipient's mail server on port 25, so the…
- Postfix: SASL authentication failure: No worthy mechs foundPostfix tried to log in to the relay and Cyrus SASL could not find a mechanism the relay…
- SMTP: 421 4.7.28 Our system has detected an unusual rate of unsolicited mailGmail is temporarily deferring mail from your IP or domain because recent volume looks like…
- SMTP: 421 Too many connectionsThe mail server is rate limiting connections. Too many simultaneous connections from the same…
- SMTP: 451 4.7.1 Greylisted, please try again laterThe receiving server deliberately rejected a first delivery attempt from an unknown sender…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.