SMTP 502 Command Not Implemented vs 535 Authentication Failed
Both SMTP 502 (Command Not Implemented) and 535 (Authentication Failed) belong to the 5xx Permanent Negative category. 502 indicates that the command is recognized by the SMTP specification but is not implemented on this server. The server understands the command but has chosen not to support it. Meanwhile, 535 means that the authentication credentials provided are invalid. The username, password, or authentication mechanism was rejected by the server.
Description
The command is recognized by the SMTP specification but is not implemented on this server. The server understands the command but has chosen not to support it.
When You See It
When using optional SMTP commands like VRFY, EXPN, or TURN that the server administrator has disabled, often for security or anti-spam reasons.
How to Fix
Use an alternative approach — for example, if VRFY is disabled, send a test email instead of verifying the address. Check the server's EHLO response for supported extensions.
Description
The authentication credentials provided are invalid. The username, password, or authentication mechanism was rejected by the server.
When You See It
After submitting incorrect credentials via the AUTH command. The username or password does not match any account on the server.
How to Fix
Double-check your username and password. If using an app password (e.g., Gmail, Outlook), ensure it is current and has not been revoked. Also verify the correct SASL mechanism (PLAIN, LOGIN, etc.).
Key Differences
SMTP 502: The command is recognized by the SMTP specification but is not implemented on this server. The server understands the command but has chosen not to support it.
SMTP 535: The authentication credentials provided are invalid. The username, password, or authentication mechanism was rejected by the server.
You encounter 502 when when using optional SMTP commands like VRFY, EXPN, or TURN that the server administrator has disabled, often for security or anti-spam reasons.
You encounter 535 when after submitting incorrect credentials via the AUTH command. The username or password does not match any account on the server.
When to Use Which
For 502 (Command Not Implemented): Use an alternative approach — for example, if VRFY is disabled, send a test email instead of verifying the address. Check the server's EHLO response for supported extensions. For 535 (Authentication Failed): Double-check your username and password. If using an app password (e.g., Gmail, Outlook), ensure it is current and has not been revoked. Also verify the correct SASL mechanism (PLAIN, LOGIN, etc.).