Fix SMTP 535 Incorrect Authentication Data Errors

You hit send, and instead of a delivered message you get "535 Incorrect authentication data" or "535 Authentication failed". Outlook keeps asking for the password, your phone's mail app shows a red badge, and your website's contact form has gone quiet. The mailbox works fine in webmail, which makes it even more confusing. Here's how we track this down on cPanel and VPS mail servers, in the order that usually saves the most time.

What a 535 error actually means

SMTP code 535 means the mail server received your login attempt and rejected it. That's different from a connection timeout (the server was never reached) or "relay access denied" (you didn't try to log in at all). So the server is reachable, and one of four things is wrong: the username, the password, the authentication method, or something blocking you after too many failed tries.

Symptoms you'll see

• Outlook or Thunderbird repeatedly prompts for the password even though it's correct.
• Phone mail apps say "Cannot send mail" or "Username or password incorrect" for outgoing only, while incoming works.
• WordPress SMTP plugins log SMTP Error: Could not authenticate.
• Exim's log shows 535 Incorrect authentication data or dovecot_login authenticator failed.

Fix 1: Use the full email address as the username

This is the single most common cause. On cPanel, the SMTP username is the entire email address, not just the part before the @.

• Wrong: info
• Right: info@yourdomain.com

Check both the incoming and outgoing server settings. Many clients keep them separate, and it's easy to fix one and forget the other.

Fix 2: Reset the mailbox password and retype it

Copy-pasted passwords often pick up a trailing space. Special characters can also be mangled by some plugins. In cPanel go to Email Accounts → Manage → Password, set a new strong password using letters and digits (a couple of safe symbols such as - or _ are fine), and type it in manually in the client. If webmail works with the new password but the client doesn't, the client is storing an old saved credential. Delete the account entry or clear the saved password in the OS keychain/credential manager and re-add it.

Fix 3: Match the port and encryption

A wrong port/encryption pairing can show up as an authentication failure in some clients. Use one of these combinations:

Port 25 is usually blocked by ISPs and often doesn't offer authentication, so avoid it for client sending.

Fix 4: Check whether you've been blocked by cPHulk or Fail2ban

After several wrong attempts, the server may temporarily block your IP. The tell-tale sign is that a correct password still fails, but the same login works from your phone on mobile data. On WHM, open Security Center → cPHulk Brute Force Protection → History Reports and look for your IP. Whitelist it if it's trusted. On a plain VPS with Fail2ban, check and unban:

fail2ban-client status
fail2ban-client status dovecot
fail2ban-client set dovecot unbanip YOUR.IP.ADDRESS

Also ask: is an old device (a phone, a forgotten office PC) still hammering the server with a stale password? That's often what triggered the block in the first place.

Fix 5: Read the log instead of guessing

If you have SSH access, the logs tell you exactly what failed:

grep "your@yourdomain.com" /var/log/exim_mainlog | tail -n 30
grep -i "auth failed" /var/log/maillog | tail -n 30

Look for the IP address in the failed line. If it isn't your IP, someone else is guessing passwords against that mailbox, so change the password to something long and unique right away.

Fix 6: WordPress and website forms

If only your site's contact form fails, the SMTP plugin settings are the culprit. In WP Mail SMTP, Post SMTP or FluentSMTP confirm that:

1. Host is mail.yourdomain.com (or your server hostname) and the port/encryption pair matches the table above.
2. "Authentication" is switched on and the username is the full address.
3. The "From" email uses the same domain as the mailbox you're authenticating with.
4. No security plugin or wp-config.php constant is overriding the saved password with an old one.

Fix 7: Certificate hostname problems that look like auth failures

If you connect using yourdomain.com rather than mail.yourdomain.com, and the certificate doesn't cover that name, some clients fail the handshake and report a generic login error. Point the client to mail.yourdomain.com and make sure its A record exists and AutoSSL has covered it.

Prevention

• Use one strong, unique password per mailbox and store it in a password manager.
• When you change a mailbox password, update every device and plugin the same day.
• Enable cPHulk notifications so you hear about blocks before customers do.
• Keep website sending on a dedicated mailbox, such as noreply@, so a staff password reset doesn't break your forms.

Frequently Asked Questions

Why does webmail work but my email app gives a 535 error?

Webmail logs in locally with its own session. Your app is sending credentials over SMTP, so a wrong username format, saved old password or wrong port/encryption will fail there while webmail is unaffected.

Is "535 Incorrect authentication data" the same as "relay access denied"?

No. 535 means the login was attempted and rejected. Relay denied means the server never saw a valid login and refused to forward your mail for a stranger.

Can an IP block cause a 535 even with the right password?

Yes. cPHulk or Fail2ban can reject logins from a blocked IP, so a correct password still fails. Test from another network and check the block lists.

Should I use port 465 or 587?

Either works on our servers. Use 465 with SSL/TLS if your client supports it, otherwise 587 with STARTTLS. Avoid port 25 for client sending.

My mailbox password keeps failing after I reset it. What now?

Remove the account from the client entirely and add it again. Stale credentials in the OS keychain are a very common reason a new password is ignored.