Basic SMTP reply code · RFC 5321
535 Authentication credentials invalid
A reply to AUTH: the user name, password or other credential is wrong (RFC 4954).
- Class: 5yz · Permanent failure
5yz: a permanent failure. The same request should not be repeated; something must change first, such as the address (RFC 5321 §4.2.1). - Source
How 535 appears at providers
The exact text from the provider's documentation, as you see it in the bounce, and what it means.
Gmail
-
535 5.7.80
Username and Password not accepted.
The user name or password was not accepted.
Microsoft 365 / Exchange Online
-
535 5.7.142
XOAUTH2 authentication failed. Token will expire soon.
The OAuth token was close to expiry and was refused; the client must request a new one.
-
535 5.7.143
XOAUTH2 authentication failed. Expired token.
The OAuth token has expired.
-
535 5.7.144
XOAUTH2 authentication failed. Invalid API permissions.
The OAuth token lacks the right permissions for the HVE application.
Have the whole error message?
Sources: RFC 5321 · RFC 3463 · RFC 3464 · IANA · Gmail · Microsoft 365 · read on 26 September 2026