535 5.7.8 — Username and Password not accepted
Your mailbox is misconfigured
SMTP error 535 5.7.8 means the mail server rejected your login credentials at the AUTH stage, before any recipient was named. It is a sender-side credential failure: the password or app password on the mailbox is wrong, revoked, or the account requires an app password that has not been created.
What the server actually says
Invalid login: 535-5.7.8 Username and Password not accepted. For more information, go to
535 5.7.8 https://support.google.com/mail/?p=BadCredentials d9443c01a7336-...66 - gsmtpWhat you see
Every send from the affected mailbox fails immediately. Nothing is queued and no bounce message ever arrives, because the server refused the connection before a message existed.
Why it happens
- The mailbox has 2-Step Verification on and is using the account password instead of a 16-character app password.
- An app password that was working has been revoked - changing the account password invalidates every app password at once.
- Google Workspace admin has disabled "Less secure app access" or blocked IMAP/SMTP for the organizational unit.
- The username is the alias rather than the primary address on the mailbox.
How to fix it
- Confirm which credential the mailbox is using. If 2-Step Verification is on, an app password is mandatory. The account password will always return 535 5.7.8.
- Generate a fresh app password. Google Account to Security to App passwords. Create one for "Mail", copy all 16 characters, and remove the spaces.
- Check IMAP/SMTP is enabled org-wide. In Google Admin, Apps to Google Workspace to Gmail to End User Access, confirm IMAP access is on for the user’s OU.
- Reconnect the mailbox and send one test. Re-authenticate rather than editing the stored password, so the new credential is validated before any warmup traffic resumes.
What not to do
- Do not blacklist or remove the recipient address. The error happened at AUTH, before MAIL FROM - the recipient is irrelevant and was never sent to the server.
- Do not treat it as a hard bounce. The 5.7.8 enhanced code looks like a permanent failure, and naive classifiers match the 5.x and permanently suppress whichever healthy recipient the sender happened to draw.
- Do not retry on a timer. A wrong credential never fixes itself, and repeated AUTH failures can get the IP temporarily throttled.
Frequently asked questions
Does 535 5.7.8 mean my email address is blocked?
No. It means authentication failed. The server never evaluated your recipient, your content, or your reputation - it rejected the login and closed the session.
Why did my app password stop working?
App passwords are invalidated whenever the account password changes, when 2-Step Verification is toggled, or when an admin revokes them. You need to generate a new one; the old string is permanently dead.
Is this the same as 534 5.7.9?
Related but distinct. 534 5.7.9 means an application-specific password is required and you supplied the account password. 535 5.7.8 means the credential you supplied was simply not accepted.
Can this damage my sender reputation?
Not directly - no mail is sent, so no recipient signal is generated. The indirect risk is a stalled warmup ramp: a mailbox that cannot send is not building reputation while its domain ages.
How MailPilot helps
MailPilot classifies this error automatically on every connected mailbox and tells you which side is at fault, so a throttle is never mistaken for a dead recipient and a credential failure never suppresses a healthy address. It also monitors real inbox placement and checks SPF, DKIM and DMARC on every mailbox, which is where most policy rejections start.
Related errors
- invalid_grant — OAuth token revoked or expired
- FAILED_PRECONDITION — Mail service not enabled
- 550 5.4.5 — Daily user sending limit exceeded
Last reviewed 2026-10-11 by the MailPilot team.