5.7.8Authentication credentials invalid

Authentication failed because the credentials were invalid or insufficient. Do not retry the same unchanged attempt.

The standard X.7.8 pattern is a response to the AUTH command and means that authentication failed because the credentials were invalid or insufficient. Code 5.7.8 applies this detail in permanent class 5; the client should ask the user to supply new credentials.

The leading digit 5 denotes a permanent failure of the current attempt. The code concerns client authentication, but by itself it does not identify which credentials were invalid or insufficient, and it does not establish that the recipient address is invalid.

Class

Permanent failure

Retry

Do not retry unchanged

Suppression

Check the full context

Operational guidance: stop automatic and manual retries with the same credentials. Consider a new AUTH attempt only after obtaining new credentials or confirming a correction to identity, authorization, or configuration; check suppression again before the attempt.

Operational guidance: do not automatically suppress the recipient address or domain based on 5.7.8 alone. Inspect the complete response, authentication context, event history, and applicable policy, then make the suppression decision in that context.

• The credentials supplied in the AUTH attempt were invalid or insufficient.

1. Inspect the raw SMTP response and confirm that the enhanced code is exactly 5.7.8 and that the basic reply is in the 5xx class; retain the complete response without recording secrets.
2. Correlate the response with the specific AUTH attempt, time, identity used, authentication mechanism, and system that returned the code; use safe logs to determine whether the credentials were invalid or insufficient.
3. Stop unchanged retries; before a controlled new attempt, confirm new credentials or a material configuration correction and check suppression again.

The accepted Yahoo Mail SMTP submission (OAuth2) example reads exactly: “535 5.7.8 Error: authentication failed: authentication failure”. The source notes that the response is subject to change; the example does not establish wording or practice for AOL.

535 5.7.8 Error: authentication failed: authentication failure

Compare 2.7.0 and 4.7.0 as general security statuses in the success and temporary-failure classes, respectively, 4.7.1 for temporary unauthorized delivery, and 4.7.12 for a required authentication-mechanism transition. None denotes the same permanent refusal of invalid or insufficient AUTH credentials.

• 2.7.0Other or undefined security status (success)
• 4.7.0Other or undefined temporary security status
• 4.7.1Delivery not authorized, message temporarily refused
• 4.7.12Authentication mechanism transition required

The standard X.7.8 meaning and the permanent class of code 5.7.8 were verified against the IANA registry and RFC 2034, RFC 4954, and RFC 5248 as of July 17, 2026. The exact Yahoo example comes from accepted evidence yahoo-aol-ph03-001. Diagnostic, remediation, retry, and suppression recommendations are separate operational guidance.

• iana-smtp-enhanced-status-codesT0 source

  Enumerated Status Codes / X.7.8

• rfc5248T0 source

  Section 2.1: registry fields and non-exclusive Associated Basic Status Code

• rfc2034T0 source

  Section 4: enhanced status class agrees with SMTP reply class

• rfc4954T0 source

  IANA registry reference for X.7.8

• yahoo-aol-ph03-001T1 source

  Yahoo SMTP Protocol Exchange using OAUTHBEARER > Authentication > Error Response (#smtp-authentication-error-response); bold server response; adjacent footnote says the current 535 response is subject to change

Last verified: 17 July 2026