SMTP code 235 is the server's confirmation that the AUTH command succeeded. After receiving 235, the client is authorized to send mail through the server as a relay. This response follows the completion of an authentication mechanism such as PLAIN, LOGIN, CRAM-MD5, or XOAUTH2. The authentication step is required on submission ports (587) and is what distinguishes authenticated relaying from open relaying. If you do not receive 235 after AUTH, the credentials are wrong, the mechanism is not supported, or the account is locked.
The client supplied a correct username and password (or OAuth token) using a supported authentication mechanism. The server verified the credentials against its user database and granted relay access.
Modern mail providers like Gmail and Microsoft 365 use XOAUTH2 for authentication. A valid OAuth2 access token was presented and the server confirmed the identity. This is increasingly common as providers deprecate plain password authentication.
Some enterprise mail servers accept TLS client certificates as an authentication method. The server verified the client certificate during the TLS handshake and returned 235 to confirm the identity.
Connect to the submission port and attempt AUTH LOGIN or AUTH PLAIN with base64-encoded credentials to verify the server accepts them.
openssl s_client -connect mail.example.com:587 -starttls smtp
Send EHLO and look for the AUTH line in the server's capabilities response. The server will list supported mechanisms (PLAIN, LOGIN, CRAM-MD5, XOAUTH2). Your client must use one that the server supports.
Providers like Gmail, Yahoo, and iCloud require app-specific passwords when two-factor authentication is enabled. Using the account's regular password will fail even if the password is correct.
Most servers require STARTTLS before accepting AUTH commands. Sending AUTH over an unencrypted connection will be rejected with a 530 or 538 error. Always upgrade to TLS first.
The SMTP command was successfully processed. Used for EHLO responses, MAIL FROM, RCPT TO, and DATA completion.
The SMTP authentication credentials were rejected. The username, password, or token is incorrect.
The command is recognized but a specific parameter or extension used is not implemented.