What this code means
The server permanently refused the AUTH attempt because the selected authentication mechanism may be used only over an encrypted SMTP connection. Do not retry the same unchanged attempt.
Technical meaning
The standard X.7.11 pattern is a historical response to the AUTH command. It means that the selected authentication mechanism may be used only when the underlying SMTP connection is protected by an encryption layer of sufficient strength. A modern implementation should not advertise such a mechanism without an active, sufficient encryption layer; code 5.7.11 applies this detail in class 5.
Delivery status
The leading digit 5 denotes a permanent failure of the current attempt. Repeating AUTH with the connection in the same state does not remove the stated obstacle; the code alone does not specify the required encryption configuration or establish that the credentials or recipient address are invalid.
- Class
- Permanent failure
- Retry
- Do not retry unchanged
- Suppression
- Check the full context
Retry decision
Operational guidance: stop automatic and manual retries of the same unchanged attempt. Consider a new, controlled attempt only after confirming sufficient connection encryption or selecting a mechanism permitted in the current state; check suppression again before the attempt.
Suppression decision
Operational guidance: do not automatically add an address or domain to a suppression list based on 5.7.11 alone. Inspect the complete response, encryption state, AUTH mechanism, event history, and applicable policy, then make the suppression decision in that context.
Common causes
- The client selected an AUTH mechanism that requires encryption while the underlying SMTP connection lacked a sufficient encryption layer.
- The server advertised a mechanism that was not permitted in the current encryption state, although modern implementations should not do so.
Diagnostic steps
- Inspect the raw SMTP response and confirm that the enhanced code is exactly 5.7.11, that the basic reply is in the 5xx class, and that the code was returned to the AUTH command; retain the complete response text.
- Correlate the response with the attempt time, client, server endpoint, selected AUTH mechanism, and the state and strength of the encryption layer; determine these details from configuration and safe logs instead of inferring them from the code alone.
- Stop unchanged retries; before a controlled new attempt, confirm sufficient encryption or a permitted mechanism, check suppression again, and compare the result.
Actions by owner
Sender
- Do not manually repeat the same attempt; give the administrator the complete response, attempt time, and account used without disclosing credentials.
Sender administrator
- Inspect the client configuration, endpoint, AUTH mechanism, and the encryption state and strength for the specified attempt.
- After a verified correction to encryption or the mechanism, check suppression again and make one controlled attempt instead of repeating the unchanged AUTH request.
Recipient administrator
- If you manage the server that returned the code, inspect its logs, AUTH policy, and the mechanisms advertised in the encryption state applicable to the specified attempt.
- Correct a confirmed mismatch between advertised mechanisms and encryption policy, or give the sender administrator safe information about the required connection method.
Provider
- If you operate a service involved in the attempt, inspect its encryption and AUTH logs and give the administrator safe context needed to identify the required correction.
- Correct a confirmed problem in managed configuration or identify the owner of the correction; do not trigger automatic suppression from the code alone.
Sources and verification
The canonical Tier-0 meaning of X.7.11, its historical status, its relationship to the AUTH command, and the class-5 application of code 5.7.11 were verified against the IANA registry and RFC 2034, RFC 4954, and RFC 5248 as of July 17, 2026. Diagnostic, remediation, retry, and suppression recommendations are separate operational guidance; this record contains no provider-specific practice.
- iana-smtp-enhanced-status-codesT0 source
Enumerated Status Codes / X.7.11
- rfc5248T0 source
Section 2.1: registry fields and non-exclusive Associated Basic Status Code
- rfc2034T0 source
Section 4: enhanced status class agrees with SMTP reply class
- rfc4954T0 source
IANA registry reference for X.7.11
Last verified:
