{"$comment":["Machine-readable source for the per-error pages under docs/errors/,","generated by tools/build-error-pages.py and checked in CI.","","These exist because an error string is the highest-intent search query","this project can rank for. Somebody pasting '535 5.7.139' into Google is","broken right now and is looking for exactly this. docs/ERROR-MESSAGES.md","stays as the overview; each error also gets a page of its own, because a","page covering six distinct strings loses each of them to a page covering","one.","","Every entry must state honestly whether the cause is still reversible.","Three of the four causes are, until the end of December 2026, and telling","somebody to migrate when a setting would have fixed it is bad advice even","though it happens to suit us.","","kind values:","  auth-refused    the server refused username/password authentication","  no-credentials  the client never authenticated","  wrong-sender    authentication worked; the From address did not"],"updated":"2026-08-16","entries":[{"slug":"535-5-7-139-basic-authentication-is-disabled","code":"535 5.7.139","message":"Authentication unsuccessful, basic authentication is disabled","kind":"auth-refused","scope":"tenant or mailbox","meaning":"Microsoft 365 refused username-and-password authentication. The credentials are almost certainly fine — the authentication *method* is switched off. Retyping the password, generating a new one, or recreating the mailbox will not change anything.","wrappers":["Python `smtplib` raises `SMTPAuthenticationError: (535, b'5.7.139 ...')`. The numeric code is split off into its own field and the rest arrives as a bytes literal, so searching for the message with `535` still in front of it returns nothing.","`curl` prints only `curl: (67) Login denied` and discards the server's text entirely. There is nothing in that line about the tenant, the mailbox or Basic authentication, which is why it is usually mistaken for a wrong password. Add `-v` to see what the server actually said.",".NET - `System.Net.Mail.SmtpClient`, and therefore PowerShell's `Send-MailMessage` - throws `SmtpException` with the server's text discarded entirely and the message translated into the operating system's language. Measured on a Polish system it reads \"Uwierzytelnianie nie powiodlo sie\"; on an English one, \"Authentication failed\". Either way there is no 535, no 5.7.139 and nothing to search for, which is why this failure is usually reported as a wrong password."]},{"slug":"535-5-7-139-smtpclientauthentication-is-disabled-for-the-tenant","code":"535 5.7.139","message":"SmtpClientAuthentication is disabled for the Tenant","kind":"auth-refused","scope":"tenant","meaning":"The same refusal, reported at tenant level: the block applies to every mailbox that inherits the tenant setting, not just the one you are testing. Switching to a different mailbox will produce the same error, which is the fastest way to confirm you are in this case rather than the per-mailbox one.","wrappers":["Python `smtplib` raises `SMTPAuthenticationError: (535, b'5.7.139 ...')`. The numeric code is split off into its own field and the rest arrives as a bytes literal, so searching for the message with `535` still in front of it returns nothing.","`curl` prints only `curl: (67) Login denied` and discards the server's text entirely. There is nothing in that line about the tenant, the mailbox or Basic authentication, which is why it is usually mistaken for a wrong password. Add `-v` to see what the server actually said.",".NET - `System.Net.Mail.SmtpClient`, and therefore PowerShell's `Send-MailMessage` - throws `SmtpException` with the server's text discarded entirely and the message translated into the operating system's language. Measured on a Polish system it reads \"Uwierzytelnianie nie powiodlo sie\"; on an English one, \"Authentication failed\". Either way there is no 535, no 5.7.139 and nothing to search for, which is why this failure is usually reported as a wrong password."]},{"slug":"535-5-7-139-smtpclientauthentication-is-disabled-for-the-mailbox","code":"535 5.7.139","message":"SmtpClientAuthentication is disabled for the Mailbox","kind":"auth-refused","scope":"mailbox","meaning":"The same refusal, reported for this one mailbox. Either an admin disabled it explicitly here, or it inherits a tenant-wide block and Microsoft is naming the mailbox rather than the tenant. Common on personal Outlook.com accounts and on single mailboxes that have been locked down deliberately — worth asking why before undoing it.","wrappers":["Python `smtplib` raises `SMTPAuthenticationError: (535, b'5.7.139 ...')`. The numeric code is split off into its own field and the rest arrives as a bytes literal, so searching for the message with `535` still in front of it returns nothing.","`curl` prints only `curl: (67) Login denied` and discards the server's text entirely. There is nothing in that line about the tenant, the mailbox or Basic authentication, which is why it is usually mistaken for a wrong password. Add `-v` to see what the server actually said.",".NET - `System.Net.Mail.SmtpClient`, and therefore PowerShell's `Send-MailMessage` - throws `SmtpException` with the server's text discarded entirely and the message translated into the operating system's language. Measured on a Polish system it reads \"Uwierzytelnianie nie powiodlo sie\"; on an English one, \"Authentication failed\". Either way there is no 535, no 5.7.139 and nothing to search for, which is why this failure is usually reported as a wrong password."]},{"slug":"535-5-7-3-authentication-unsuccessful","code":"535 5.7.3","message":"Authentication unsuccessful","kind":"auth-refused","scope":"tenant or mailbox","meaning":"A generic refusal with the same set of causes as 5.7.139, but without the sub-code that tells you which. Because it names nothing, it is the one most often mistaken for a wrong password. Check the four causes before touching the credentials.","wrappers":["Python `smtplib` raises `SMTPAuthenticationError: (535, b'5.7.3 ...')`. The numeric code is split off into its own field and the rest arrives as a bytes literal, so searching for the message with `535` still in front of it returns nothing.","`curl` prints only `curl: (67) Login denied` and discards the server's text entirely. There is nothing in that line about the tenant, the mailbox or Basic authentication, which is why it is usually mistaken for a wrong password. Add `-v` to see what the server actually said.",".NET - `System.Net.Mail.SmtpClient`, and therefore PowerShell's `Send-MailMessage` - throws `SmtpException` with the server's text discarded entirely and the message translated into the operating system's language. Measured on a Polish system it reads \"Uwierzytelnianie nie powiodlo sie\"; on an English one, \"Authentication failed\". Either way there is no 535, no 5.7.139 and nothing to search for, which is why this failure is usually reported as a wrong password."]},{"slug":"535-5-7-57-client-was-not-authenticated-to-send-anonymous-mail","code":"535 5.7.57","message":"SMTP; Client was not authenticated to send anonymous mail","kind":"no-credentials","scope":"client","meaning":"A different problem from the ones above: the client sent no credentials at all, or sent them after `MAIL FROM` instead of before. Usually a device or script configured for anonymous internal relay that is now pointed at an endpoint requiring authentication. Check whether the SMTP settings have an authentication checkbox that is switched off, before assuming Basic auth is the issue.","wrappers":[]},{"slug":"550-5-7-60-client-does-not-have-permissions-to-send-as-this-sender","code":"550 5.7.60","message":"SMTP; Client does not have permissions to send as this sender","kind":"wrong-sender","scope":"client","meaning":"Authentication succeeded. This is not the Basic auth shutdown. The `From` address in the message does not belong to the mailbox that authenticated, and Microsoft 365 will not let one send as the other without an explicit Send As permission. Common after pointing a device at a shared or service mailbox while leaving the old From address in its settings.","wrappers":[]},{"slug":"5-7-136-sender-was-not-authenticated","code":"5.7.136","message":"Sender was not authenticated","kind":"no-credentials","scope":"client","meaning":"The connection reached Exchange Online and sent the message without ever authenticating. This is the general form of the same fault as 5.7.57: a device or script set up for anonymous internal relay, now pointed at an endpoint that will not take anonymous mail. It is not the Basic auth shutdown - no credentials were refused, because none were offered. Look for an authentication checkbox that is switched off before assuming December 2026 is involved.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-134-sender-was-not-authenticated-for-mailbox","code":"5.7.134","message":"Sender was not authenticated for mailbox","kind":"no-credentials","scope":"mailbox","meaning":"The recipient mailbox accepts mail only from authenticated senders, and this connection was not one. The refusal is about the destination's rule rather than anything wrong with your tenant, so it will follow you to any unauthenticated sender and will not follow you to a different recipient. Worth checking before changing anything on the sending side.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-133-sender-not-authenticated-for-group","code":"5.7.133","message":"Sender not authenticated for group","kind":"no-credentials","scope":"recipient group","meaning":"The same rule as 5.7.134, applied by a group or distribution list rather than a mailbox. Groups very often carry 'only authenticated senders' by default, which is why a scanner that mails individuals happily will fail the moment somebody points it at a team address. The device did not change; the recipient did.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-12-sender-was-not-authenticated-by-organization","code":"5.7.12","message":"Sender was not authenticated by organization","kind":"no-credentials","scope":"recipient organisation","meaning":"The receiving organisation, not yours, refused the message because the sender was not authenticated to it. You cannot fix this from your own tenant settings, and trying to is where the time goes: the change has to happen at the destination, or the mail has to arrive by a route that organisation accepts.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-64-tenantattribution-relay-access-denied","code":"5.7.64","message":"TenantAttribution; Relay Access Denied","kind":"wrong-sender","scope":"connector","meaning":"Authentication is not the problem here - the message was accepted and then could not be attributed to a connector that permits relay. Classic after a device's public IP changes, after a certificate on an inbound connector is replaced, or when a smart-host setup is moved to a new network. Check which connector should be matching this traffic and what it matches on, rather than the mailbox credentials.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-367-remote-server-returned-not-permitted-to-relay","code":"5.7.367","message":"Remote server returned not permitted to relay","kind":"wrong-sender","scope":"remote server","meaning":"A server further along the path refused to relay the message onward. The refusal is being reported back to you but was not made by Exchange Online, so the setting that needs changing belongs to whoever runs that host. Read the whole line: it usually names the server that said no.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-4-1-relay-access-denied","code":"5.4.1","message":"Relay Access Denied","kind":"wrong-sender","scope":"recipient","meaning":"The recipient address is not one this server is willing to accept and forward on behalf of. Most often a typo in the domain, a mailbox that has been removed, or a device still sending to an address that moved to another tenant. It is a recipient problem wearing the language of a permissions problem.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"530-5-7-1-delivery-not-authorized","code":"530 5.7.1","message":"Delivery not authorized","kind":"wrong-sender","scope":"client","meaning":"Authentication is required and was not completed, or the authenticated account is not allowed to send as the address in the From field. The reply code 530 is the useful part and Microsoft does document it for this one: 530 is sent before the message body is accepted, so the refusal happened at the envelope rather than over the content.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-232-trial-tenant-daily-sending-limit","code":"5.7.232","message":"Trial tenant has exceeded its daily limit for sending email","kind":"throttled","scope":"trial tenant","meaning":"A trial tenant carries a much lower daily ceiling than a paid one, and hitting it during a migration test is common enough to be worth naming: the setup looks broken when it is merely capped. Nothing about the SMTP configuration is wrong. Confirm which tenant the device authenticates against before changing anything, because trial and production tenants are easy to mix up mid-cutover.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-233-tenant-daily-limit-external-recipients","code":"5.7.233","message":"Tenant exceeded its daily limit for sending email to external recipients","kind":"throttled","scope":"tenant","meaning":"The ceiling here is on external recipients specifically, so internal mail keeps working while everything leaving the organisation stops. That split is the useful diagnostic: if a scanner can still mail colleagues but not customers, this is the reason, and it is not the device.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"},{"slug":"5-7-236-tenant-daily-limit-per-recipient","code":"5.7.236","message":"Tenant has exceeded its daily limit for sending email","kind":"throttled","scope":"tenant","meaning":"The tenant-wide ceiling. Most often reached by something automated rather than by people: a monitoring system alerting on every event, a nightly report fanned out to a large list, or a device retrying a failed send in a tight loop. Find the sender before adjusting limits, because a retry loop will exhaust any ceiling you raise.","wrappers":[],"source":"https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online"}]}