smtplib SMTP Sender Refused

smtplib.SMTPSenderRefused is a Python standard-library exception. Per the smtplib docs, it is raised when "the server didn't accept the from_addr" — that is, the SMTP server rejected the envelope sender (the MAIL FROM command) during sendmail() or send_message(). It is a subclass of SMTPResponseException, so it carries three attributes that tell you exactly why:

• smtp_code — the 3-digit SMTP reply code (e.g. 530, 553, 554)
• smtp_error — the server's text/enhanced status code (e.g. b'5.7.0 Authentication Required')
• sender — the address the server refused

This is distinct from SMTPRecipientsRefused (which is about RCPT TO, the recipient) and from SMTPAuthenticationError (raised by login()). SMTPSenderRefused is specifically the server saying "I will not accept mail from this address."

What causes smtplib.SMTPSenderRefused?

The exception itself is generic — the real cause is the smtp_code it carries. Always inspect it first:

import smtplib
try:
    server.send_message(msg)
except smtplib.SMTPSenderRefused as e:
    print(e.smtp_code, e.smtp_error, e.sender)

The most common codes and their causes:

• 530 5.7.0 Authentication Required — You connected but never authenticated (or auth silently failed), so the server refuses the sender. Very common with Gmail/Google Workspace (smtp.gmail.com). This response is defined by the SMTP AUTH extension in RFC 4954 §6. Note: Google removed "Less Secure Apps" for consumer accounts in May 2022 — a plain account password no longer works.
• 553 5.7.1 Sender address rejected: not owned by user / relay denied — You authenticated as one mailbox but set a From/MAIL FROM the server doesn't let that account send as. Documented by hosts running Postfix-style checks (example).
• 554 Message rejected: Email address is not verified — Provider-specific. On Amazon SES the From/Source/Return-Path identity isn't verified in that region, or the account is still in the sandbox.
• 550 — Rare at MAIL FROM (it's far more commonly seen at RCPT TO, where smtplib raises SMTPRecipientsRefused instead). When a server does refuse the sender with 550, it's almost always an SPF/DKIM/DMARC-alignment or IP-reputation block — not a check for whether the sender mailbox exists. See the domain-authentication fix below.

How do I fix smtplib.SMTPSenderRefused?

Match the fix to the smtp_code you printed above.

1. For 530 (authenticate before sending). Call login() after STARTTLS/TLS and confirm it succeeds:

import smtplib, ssl
server = smtplib.SMTP("smtp.gmail.com", 587)
server.starttls(context=ssl.create_default_context())
server.login("you@gmail.com", "abcdefghijklmnop")  # 16-char App Password
server.send_message(msg)

For Gmail/Google Workspace, enable 2-Step Verification and generate an App Password, or use OAuth2 (XOAUTH2). Both port 587 (STARTTLS) and 465 (implicit TLS, use smtplib.SMTP_SSL) are valid per RFC 8314 — neither is deprecated.

2. For 553/relay (use an authorized From). Set the envelope/From to an address the authenticated account is allowed to send as — usually the same mailbox as your SMTP username. If you must send as another address, enable that on the server side (e.g. "send as" / aliases) rather than spoofing it.

3. For 554 on a provider (verify the sender identity). On Amazon SES, verify the sending domain or email address in the correct region and move out of the sandbox; on SendGrid/Mailgun, complete domain authentication (SPF/DKIM) and use a verified sender.

4. Authenticate domain reputation for repeated rejections. If a receiving server refuses your sender on policy/reputation grounds (including the 550 case above), publish SPF (RFC 7208), DKIM (RFC 6376), and DMARC (RFC 7489) records so your envelope sender aligns with your signing domain.

If you route mail through Courier, the underlying provider's rejection (SES/SendGrid/etc.) surfaces in your logs — apply the provider-specific fix above to the configured channel.