Django SMTP Sender Refused

"Django SMTP Sender Refused" is not a Django-specific error string. It is Python's standard-library exception smtplib.SMTPSenderRefused, which Django's SMTP email backend (django.core.mail.backends.smtp.EmailBackend) lets propagate when it calls the underlying connection. Understanding the exception is the key to fixing it.

What causes Django SMTP Sender Refused?

Python's smtplib raises SMTPSenderRefused from sendmail() when "The server didn't accept the from_addr" — that is, the SMTP server rejected the envelope sender during the MAIL FROM command (Python docs). In Django, from_addr is the message's from_email / DEFAULT_FROM_EMAIL.

The exception is a subclass of SMTPResponseException and carries three attributes you should always inspect:

• smtp_code — the 3-digit SMTP reply code (e.g. 530, 553, 554)
• smtp_error — the server's text/enhanced status (e.g. b'5.7.0 Authentication Required')
• sender — the exact address the server refused

The code is what tells you the real cause:

• 530 5.7.0 Authentication Required (the most common, especially with Gmail). The server refused MAIL FROM because the session was never authenticated. Per RFC 5321 the sender is rejected, but the underlying problem is missing/failed AUTH — Google's SMTP returns this when no valid login was presented. This is not a sender-name problem. (Per RFC 4954 §6, code 530 5.7.0 can be returned by any command that requires authentication, not only MAIL FROM — it surfaces here as SMTPSenderRefused specifically because Python's smtplib.sendmail() calls MAIL first, so an unauthenticated session fails at that step.)
• 553 / 5.7.1 — sender address not allowed / not owned by the authenticated user. You authenticated, but the From address differs from an address the account is permitted to send as.
• 554 Message rejected: Email address is not verified — Amazon SES specific: the From identity isn't a verified identity in that region (AWS SES docs).

How do I fix Django SMTP Sender Refused?

1. Print the code first. Wrap the send and look at the attached attributes so you stop guessing:

from smtplib import SMTPSenderRefused
from django.core.mail import send_mail

try:
    send_mail("Subject", "Body", "you@yourdomain.com", ["to@example.com"])
except SMTPSenderRefused as e:
    # note: smtp_error is bytes, e.g. b'5.7.0 Authentication Required'
    print(e.smtp_code, e.smtp_error, e.sender)

2. If the code is 530 (Authentication Required), fix your credentials and TLS. Your settings.py must actually log in:

EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
EMAIL_HOST = "smtp.gmail.com"
EMAIL_PORT = 587            # STARTTLS
EMAIL_USE_TLS = True        # use EMAIL_USE_SSL=True with port 465 instead
EMAIL_HOST_USER = "you@gmail.com"
EMAIL_HOST_PASSWORD = "your-app-password"
DEFAULT_FROM_EMAIL = "you@gmail.com"

Set either EMAIL_USE_TLS = True with port 587 (STARTTLS) or EMAIL_USE_SSL = True with port 465 (implicit TLS). Both ports are valid per RFC 8314 — never set both flags at once.

Gmail: Google disabled Less Secure Apps access for personal Gmail accounts on May 30, 2022, and fully retired the equivalent basic-auth/SMTP access for Google Workspace accounts by May 1, 2025. Any guide telling you to enable Less Secure Apps is obsolete on both account types today — generate a Gmail App Password (requires 2-Step Verification) at myaccount.google.com and use it as EMAIL_HOST_PASSWORD, or use OAuth2.

3. If the code is 553 (sender not allowed), align the From address with the authenticated account. Make sure DEFAULT_FROM_EMAIL (and any explicit from_email) is an address the logged-in account is authorized to send as. Many providers reject a From that doesn't match the authenticated mailbox or a verified sending identity.

4. If the code is 554 on Amazon SES, verify the identity. Confirm the From email/domain shows "verified" (not pending) in the SES console for the exact region your SMTP endpoint points to; verification is per-region.

5. Confirm host/port reachability. A wrong EMAIL_HOST/EMAIL_PORT or a blocked outbound port can mask the real handshake; verify with python -m smtplib or a manual openssl s_client -starttls smtp -connect smtp.gmail.com:587 before blaming the sender.