SMTP 535 5.7.3 indicates that the server rejected authentication. Verify the submission endpoint, TLS mode, username format, authentication policy and account state before resetting passwords or enabling legacy authentication globally.
Step-by-step checks
Confirm the client is using the intended SMTP submission hostname, port and STARTTLS/TLS mode rather than an MX endpoint that does not accept authenticated submission.
Verify the exact username identity and whether the account is enabled, licensed and permitted to use SMTP AUTH under the tenant/server policy.
Check conditional-access, security-default, MFA/app-password and legacy-authentication restrictions that can reject otherwise correct credentials.
Correlate the timestamp with mail-provider sign-in or SMTP logs and distinguish bad credentials from authentication-method-not-allowed responses.
Useful verification commands
Use commands only on systems you administer and capture the read-only output before making a configuration change.
The client must authenticate over the supported encrypted submission method with the intended account and send a controlled test message without weakening tenant-wide authentication policy.
Evidence to keep
Keep SMTP hostname/port/TLS mode, username format, sanitized server response, account SMTP-AUTH policy and matching provider sign-in/message trace entries.
Frequently asked question
Should I enable legacy SMTP AUTH for the whole organization?
No. If SMTP AUTH is genuinely required, scope it to the necessary account and supported method. Prefer modern/OAuth-capable submission where the service supports it.