MailFixIt

Gmail SMTP delivery response

Understand Gmail 530 5.7.0: Authentication or STARTTLS required

Gmail will not accept this SMTP submission until the client starts TLS or authenticates, as stated in the full response.

Problem description

A representative response is:

530 5.7.0 Authentication or STARTTLS required.
Is this temporary or permanent?

The same submission will keep failing until the SMTP connection or authentication settings are corrected.

What this response means

Gmail uses 530 5.7.0 for two common submission failures: Authentication required and Must issue a STARTTLS command first. Read the words after the code before changing anything.

Fix it

  1. Confirm that the application is using Google’s documented SMTP submission host and port for your account type.
  2. If the response says Must issue a STARTTLS command first, enable STARTTLS and complete the TLS handshake before sending credentials or mail commands.
  3. If it says Authentication required, configure OAuth or another authentication method currently allowed for the account.
  4. Re-enter the full account address as the username and replace expired or revoked credentials.
  5. Send one controlled test and verify that authentication succeeds before the MAIL FROM command.

Do not weaken TLS or expose a normal account password to an old application. Update the client if it cannot use Google’s supported security method.

Who can fix it

The owner of the sending application and, for managed accounts, the Google Workspace administrator control this setup. Public DNS records are not the cause of this submission error.

Use the sender-requirements guide only after the application can establish an authenticated SMTP session.

Frequently asked questions

What does Gmail 530 5.7.0: Authentication or STARTTLS required mean?

The complete text says either that authentication is required or that the client must issue STARTTLS first; those are related but separate configuration failures.

Can MailFixIt prove this entire bounce from public DNS?

No. The current checker can evaluate selected public DNS configuration, but it cannot recreate recipient state, credentials, reputation, message content, or a historical provider SMTP decision.

Related email diagnostics

Gmail 550 5.7.26: This email has been blocked because the sender is unauthenticatedDiagnose Gmail 550 5.7.26 safely. Separate unauthenticated-mail, SPF hard-fail and DMARC-policy branches before changing email DNS. Gmail requirements for sending 5,000 or more messages per dayCheck Gmail bulk sender requirements for SPF, DKIM, DMARC alignment, PTR, TLS, spam rate and one-click unsubscribe using path-specific evidence.

Primary sources: Gmail SMTP errors and codes, Google email sender guidelines.