Mailybox
check dmarcdiagnose a bounce
Home / Email errors / exchange-online
exchange-online error

Exchange Online 530 5.7.1 — Client Was Not Authenticated

The SMTP client attempted to send through an endpoint that requires authentication without authenticating first, or its credentials were not accepted.

Diagnose your exact bounce Email Dependency Discovery

What the bounce says

Exact wording as it appears in the rejection or NDR. Placeholders such as x.x.x.x and example.com stand for your own address and domain.

530 5.7.1 Client was not authenticated

530 5.7.57 Client was not authenticated to send anonymous mail during MAIL FROM

A 530 response means the server will not proceed until the client authenticates. The client either never sent an AUTH command, or its credentials were refused and it continued anyway. Nothing about DNS or the recipient is involved.

Reviewed 2026-09-08. Provider wording and requirements change; the provider reference below is authoritative.

Most common causes

  • The device or application connects to smtp.office365.com without SMTP AUTH
  • Basic authentication is disabled for the tenant or the mailbox and the client cannot use OAuth
  • Stored credentials expired or the password was rotated
  • The client sends MAIL FROM before completing the AUTH exchange

What to verify next

  1. Confirm whether SMTP AUTH is enabled for the mailbox
  2. Check the authentication method the client uses against what the tenant allows
  3. Capture the SMTP conversation to see whether AUTH was attempted and what the server answered
  4. Move the client to connector-based relay if it cannot authenticate

Why authentication did not happen

The most common cause since Microsoft retired basic authentication: the device is configured for username and password, SMTP AUTH is disabled for the mailbox or tenant, and the client silently falls back to sending anonymously. The server refuses at MAIL FROM.

Other causes are a rotated password stored in an appliance, a client that only supports LOGIN or PLAIN when the server requires OAuth, or a client connecting to port 25 (which does not offer authentication) instead of 587.

  • Check SMTP AUTH is enabled for the specific mailbox.
  • Use port 587 with STARTTLS; port 25 has no AUTH.
  • Rotated passwords break stored device credentials.

Capture the conversation

A transcript shows exactly what the client did: whether it sent EHLO, whether the server advertised AUTH, whether the client attempted it, and what came back. Most appliances can log this, and the SMTP Conversation Analyzer reads the transcript.

If the server advertises AUTH and the client never attempts it, the client configuration is wrong. If the client attempts and receives 535, the credentials or the authentication method are wrong.

Pick the right relay method

Microsoft documents three paths: client submission (authenticated, port 587), direct send (unauthenticated, internal recipients only) and connector relay (unauthenticated, trusted by IP or certificate). Devices that cannot do modern authentication belong on connector relay.

After changing the method, send one test message and read the result before moving other devices.

Best diagnostic path

Live analysis

Mail Failure Doctor

Classify the complete rejection and preserve provider-specific diagnostic context.

Open analysis → Live analysis

Email Dependency Discovery

Map applications and devices that depend on a relay or submission path before changing it.

Open analysis → Live analysis

Email Infrastructure Digital Twin

Map the domain’s public mail infrastructure and provider relationships before remediation.

Open analysis →

Known limits

  • The NDR does not identify which device or application connected; correlate timestamps with logs.
  • Microsoft continues to retire legacy authentication; configurations that work today may need updating.

Common questions

Is 530 5.7.1 the same as 530 5.7.57?

Both mean the client was not authenticated. 5.7.57 is the Exchange Online wording for anonymous MAIL FROM; the fix is identical.

The password is definitely right.

Then SMTP AUTH is probably disabled for that mailbox, or basic authentication is blocked tenant-wide. Check both before changing the device.

Can I use a shared mailbox for the device?

Only if it is licensed and SMTP AUTH is enabled on it. Unlicensed shared mailboxes cannot authenticate.

Why the exact message matters

The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.

Provider reference

For the provider-defined meaning and current requirements, review Microsoft: SMTP relay options for devices and applications.