MailFixIt

Gmail SMTP delivery response

Understand Gmail 534 5.7.90: App password or browser login required

Google rejected the login because the application needs an account-specific sign-in step, not because the domain has a DNS error.

Problem description

A representative response is:

534 5.7.90 App password or browser login required.
Is this temporary or permanent?

Retry after correcting the account sign-in method; repeated attempts with the same credential can trigger additional security controls.

What this response means

Gmail uses 534 5.7.90 when the account requires another sign-in step. The response normally asks you to sign in through a browser or says that an application-specific password is required.

Fix it

  1. Sign in to the same Google account in a browser and resolve any security alert, disabled account, or policy prompt.
  2. Update the mail application and use OAuth if it supports Google sign-in.
  3. If the exact response requires an app password, create one only if two-step verification and your account policy make that option available.
  4. Replace the old credential in the application; do not put the app password in DNS or share it with a third party.
  5. Retry once. If a managed Workspace account still blocks access, ask its administrator which authentication methods are allowed.

An app password is not available for every account, and repeatedly entering the normal account password will not solve this response.

Who can fix it

The Google account owner or Workspace administrator must resolve this. MailFixIt cannot inspect account security settings or credentials.

After sign-in works, use the Gmail sender guidance for separate SPF, DKIM, DMARC, and delivery requirements.

Frequently asked questions

What does Gmail 534 5.7.90: App password or browser login required mean?

Google is asking for an account security step: either browser sign-in or an application-specific password, depending on the exact response and account policy.

Can MailFixIt prove this entire bounce from public DNS?

No. The current checker can evaluate selected public DNS configuration, but it cannot recreate recipient state, credentials, reputation, message content, or a historical provider SMTP decision.

Related email diagnostics

Gmail 550 5.7.26: This email has been blocked because the sender is unauthenticatedDiagnose Gmail 550 5.7.26 safely. Separate unauthenticated-mail, SPF hard-fail and DMARC-policy branches before changing email DNS. Gmail requirements for sending 5,000 or more messages per dayCheck Gmail bulk sender requirements for SPF, DKIM, DMARC alignment, PTR, TLS, spam rate and one-click unsubscribe using path-specific evidence.

Primary sources: Gmail SMTP errors and codes, Google email sender guidelines.