530 5.7.0 Must issue a STARTTLS command first
The server requires TLS before it accepts mail
Seen in Gmail SMTP, Postfix (smtpd_tls_security_level = encrypt), Exchange
The client tried to log in or send over a plain-text connection, but the server only accepts commands after STARTTLS has encrypted the session.
Common causes
- TLS or STARTTLS is disabled in the mail client, app or library.
- The app uses port 25 or 587 without upgrading the connection.
- A firewall or antivirus is stripping STARTTLS from the server greeting.
How to fix it
- Enable STARTTLS in the client and use port 587 (or implicit TLS on port 465).
- In code, call starttls() before login, e.g. smtplib.SMTP(host, 587) then s.starttls().
- If STARTTLS is missing from the EHLO reply, check for SMTP inspection on your firewall.
Got a different message? Paste it into the error explainer.
Related errors
- 550 5.4.1 Recipient address rejected: Access denied · Microsoft 365 rejected an unknown recipient at the edge
- 550 5.7.708 Service unavailable. Access denied, traffic not accepted from this IP · Microsoft 365 blocked the tenant's outbound mail
- 530 5.7.57 Client not authenticated to send anonymous mail during MAIL FROM · The app sent to smtp.office365.com without logging in
- 535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant · Microsoft 365 refused the SMTP AUTH login
- 550 5.7.520 Access denied, Your organization does not allow external forwarding · Automatic forwarding to an outside address is blocked
- 550 5.1.8 Access denied, bad outbound sender · The sending account was blocked for spam
- 451 4.7.500 Access denied, please try again later · Microsoft 365 is temporarily throttling the sending IP
- 552 5.2.2 The recipient's inbox is out of storage space · The recipient's mailbox is full
- 552 5.3.4 Your message exceeded Google's message size limits · The message is larger than the server accepts
- 535 5.7.8 Username and Password not accepted · The SMTP login was rejected
- 450 4.2.0 <user@example.com>: Recipient address rejected: Greylisted · The message was greylisted; it will be accepted on retry
- 553 5.7.1 <user@example.com>: Sender address rejected: not owned by user · You logged in as one user but sent as another address