Cannot Authenticate (454 4.7.0 / 535): Mail App Fixes
Your mail app cannot authenticate, or the server says 454 4.7.0 or 535 5.7.8. Six causes in the order to check, with settings for Outlook, Apple Mail and Gmail.
"Cannot authenticate", "username and password not accepted", 535 5.7.8 and 454 4.7.0 are all the same conversation: your mail app connected to the outgoing server and the login was refused. The password is the obvious suspect and the least common cause. Most of the time the username is incomplete, the encryption setting is wrong for the port, or the app is still holding an old password. Check these six things in order and the error goes away at one of them.
Quick answer
For an OquMail mailbox the outgoing server is mail.oqumail.com on port 587 with STARTTLS, the username is your full email address, and the password is your webmail password. authentication (proof that email really comes from your company) must be turned on for outgoing mail, using the same login as incoming. If all of that is right, re-enter the password: apps keep an old one after a change and keep failing silently.
What the codes mean
- 535 5.7.8 Authentication credentials invalid, or ... Error: authentication failed: the server read a username and password and rejected them. Wrong username format, wrong password, or an old password.
- 454 4.7.0 Temporary authentication failure: the server could not check the login right now. Usually a brief backend hiccup; wait a minute and retry. If it persists, the login itself is wrong at a server that reports temporarily.
- 530 5.7.0 Must issue a STARTTLS command first, or ... authentication (proof that email really comes from your company) required: the app tried to log in or send before encrypting, which happens when STARTTLS is off or SSL is selected on port 587.
- SSL handshake failed, wrong version number, or a certificate warning: the encryption setting does not match the port. This is usually reported by the app before any 5xx code.
Check these six things, in order
- Username is the full address. you@yourdomain.com, not you. Both incoming and outgoing use the same one.
- Port and encryption match. Outgoing: port 587 with STARTTLS (Outlook calls it STARTTLS; Apple Mail "Use TLS/SSL" on with port 587 negotiates STARTTLS; the Gmail app lists STARTTLS by name). SSL/TLS on port 587 fails. Incoming: port 993 with SSL/TLS.
- Outgoing authentication is on. Outlook: "My outgoing server requires authentication" with "Use same settings as my incoming mail server". Apple Mail: Authentication set to Password with the username filled in. Thunderbird: Authentication method Normal password.
- The password is current. If it was changed in webmail, every app holding the old one fails from that moment. Re-enter it; the password change guide covers where each app hides it.
- The password works in webmail. Log in at the webmail address with the same username and password. If that fails too, the password is wrong or the mailbox is suspended; reset it from the admin dashboard.
- Nothing is in the way. A corporate firewall or a mobile network blocking 587, an antivirus "mail shield" intercepting the connection, or a VPN. Try the same settings on another network.
App-specific notes
- Outlook for Windows keeps a cached credential per account. If it still fails after a correct password, remove the account and add it again.
- Apple Mail on iPhone: if "Use SSL" is on with port 587, it uses STARTTLS and works. The failure case is choosing port 465.
- Gmail app (Android): under Outgoing server settings make sure "Require sign-in" is on and the username is the full address; the app sometimes pre-fills only the part before @.
- Thunderbird: Server Settings for incoming and Outgoing Server (SMTP) are separate screens; the SMTP one is where the username is most often missing.
Common questions
Do I need an app password?
No. OquMail mailboxes authenticate with the mailbox password in any app. Two-factor authentication protects the web login and admin dashboard; it does not change what the mail app sends.
Why does receiving work but sending fails?
Because incoming and outgoing are two connections with two sets of settings. The incoming one was set up correctly and the outgoing one has a missing username, authentication turned off, or SSL on port 587.
Could the mailbox be locked?
A suspended mailbox or workspace fails login everywhere, including webmail. If webmail also refuses the password, check the admin dashboard before changing any app settings.