535 Authentication Failed - Nodemailer

Nodemailer raises this as an EAUTH error whose response contains the raw SMTP reply, typically 535 5.7.8 Authentication failed (or a provider variant like Gmail's 535 5.7.8 Username and Password not accepted or Microsoft 365's 535 5.7.139 Authentication unsuccessful). The error object also reports the command that failed — AUTH PLAIN, AUTH LOGIN, or AUTH XOAUTH2 — which tells you which auth method the server rejected.

What causes "535 Authentication failed" in Nodemailer?

535 is a permanent SMTP reply defined for the AUTH extension. Per RFC 4954, 535 5.7.8 means "Authentication credentials invalid" — "this response to the AUTH command indicates that the authentication failed due to invalid or insufficient authentication credentials." It is the server, not Nodemailer, rejecting you. Nodemailer's own error reference lists the common triggers behind an EAUTH:

• The username or password is simply wrong, or has whitespace/newline characters pasted in.
• You are sending a regular account password where the provider now requires an app password or OAuth2 token.
• The account has 2-Step Verification / MFA enabled, which blocks plain-password SMTP.
• SMTP AUTH is disabled on the account or tenant.
• The server does not support the auth method Nodemailer negotiated (check the failed command).

Note this is distinct from connection-level failures (ECONNECTION, ETIMEDOUT) — a 535 means you reached the server and the login handshake itself was refused.

How do I fix "535 Authentication failed" in Nodemailer?

1. Confirm the credentials and transport are correct. Set host, port, and secure to match your provider, and pass the exact user/pass. Use secure: true with port 465 (implicit TLS) or secure: false with port 587 (STARTTLS) — both are valid per RFC 8314; neither port is deprecated.

const transporter = nodemailer.createTransport({
  host: "smtp.example.com",
  port: 587,        // 587 = STARTTLS, or 465 with secure:true
  secure: false,
  auth: {
    user: "you@example.com",
    pass: process.env.SMTP_PASSWORD, // keep secrets out of source
  },
});

// Verify the login before sending
await transporter.verify();

transporter.verify() performs the auth handshake and surfaces a 535 immediately, so you can debug without sending a message.

2. Gmail / Google Workspace — use an App Password or OAuth2, NOT "less secure apps". Google removed the "Less Secure Apps" toggle in 2022, so that advice no longer works. With 2-Step Verification enabled, generate a 16-character App Password and use it as pass against smtp.gmail.com. For production, prefer OAuth2 with auth: { type: "OAuth2", ... }.

const transporter = nodemailer.createTransport({
  service: "gmail",
  auth: {
    user: "you@gmail.com",
    pass: process.env.GMAIL_APP_PASSWORD, // 16-char app password, no spaces
  },
});

3. Microsoft 365 / Outlook — Basic auth is being retired. A 535 5.7.139 ... SmtpClientAuthentication is disabled means SMTP AUTH is off for the tenant or the mailbox. Microsoft is retiring Basic auth for SMTP AUTH Client Submission: under the timeline Microsoft revised in January 2026, Basic auth for SMTP AUTH stays available through 2026 and is disabled by default for existing tenants at the end of December 2026 (admins can re-enable), with new tenants created from January 2027 unable to use it and a final removal date to be announced in the second half of 2027. Either way the durable fix is to move to OAuth2 (XOAUTH2). If you still rely on Basic auth short-term, an admin must explicitly enable SMTP AUTH for the mailbox.

4. Other providers — use the right credential type. Zoho and many others require an app-specific password when 2FA is on. SendGrid expects the literal username apikey with your API key as the password. Always confirm the correct host/port for your account's region/data center in the provider's docs.

5. Stop disabling firewalls/antivirus for a 535. A firewall or AV product blocks the connection (producing a timeout, not a 535). Because 535 is an authentication rejection from the server, disabling security software will not fix it — focus on the credentials and auth method instead.