How to Fix SMTP Error: Could Not Authenticate (PHPMailer)

Updated: 12 October 2026 · Applies to: PHPMailer 7.1 on PHP 8.3 (WordPress sends mail through PHPMailer too), tested against Postfix 3.8 with Dovecot 2.3 SASL on Ubuntu 24.04; Gmail, Google Workspace and Microsoft 365 according to their documentation

SMTP Error: Could not authenticate. means the mail server did not accept your login. Check four things: the username (use the full email address), the password, the port and encryption pair (587 with STARTTLS, or 465 with SSL), and whether your provider still accepts a normal password from apps (Gmail and Google Workspace need an app password or OAuth; Microsoft 365 needs SMTP AUTH turned on, or OAuth). PHPMailer also shows this message when the server never offered a login at all, for example on port 25.

Settings that work with most mail servers:

$mail->isSMTP();
$mail->Host       = 'mail.example.com';      // the name on the server's certificate
$mail->SMTPAuth   = true;
$mail->Username   = 'info@example.com';      // the full email address
$mail->Password   = 'your-mailbox-password'; // in single quotes
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
$mail->Port       = 587;                     // or ENCRYPTION_SMTPS with port 465

1. Turn on debug output and read the server's answer

Add $mail->SMTPDebug = SMTP::DEBUG_SERVER; (with use PHPMailer\PHPMailer\SMTP; at the top) and send again. Lab example with a wrong password (timestamps removed, shortened):

SERVER -> CLIENT: 220 mail.example.com ESMTP Postfix (Ubuntu)
CLIENT -> SERVER: EHLO web.example.com
CLIENT -> SERVER: STARTTLS
SERVER -> CLIENT: 220 2.0.0 Ready to start TLS
CLIENT -> SERVER: EHLO web.example.com
SERVER -> CLIENT: 250-mail.example.com
                  250-AUTH PLAIN LOGIN
CLIENT -> SERVER: AUTH LOGIN
SERVER -> CLIENT: 334 VXNlcm5hbWU6
CLIENT -> SERVER: [credentials hidden]
SERVER -> CLIENT: 334 UGFzc3dvcmQ6
CLIENT -> SERVER: [credentials hidden]
SERVER -> CLIENT: 535 5.7.8 Error: authentication failed: (reason unavailable)
SMTP ERROR: Password command failed: 535 5.7.8 Error: authentication failed: (reason unavailable)
SMTP Error: Could not authenticate.

• A 535 reply after the password: the server refused the username or password. Go to step 2.
• No AUTH line in the EHLO answer, and PHPMailer never sends AUTH LOGIN: the server does not offer a login on this port or without encryption. Go to step 3.

Set SMTPDebug back to 0 when you are done, because the debug text is printed into your page.

2. Check the username and password

1. Use the full email address as the username. In our lab, info instead of info@example.com failed with the same error, and the server log said unknown user.
2. Reset the mailbox password in your control panel (in cPanel: Email Accounts, then Manage next to the address) and copy the new one into your script.
3. Write the password in single quotes. In double quotes, PHP reads $ as the start of a variable, so "Pa$word1" silently becomes Pa:

   $ php q.php
   PHP Warning:  Undefined variable $word1 in /root/t/q.php on line 5
   string(2) "Pa"

4. Test the same login outside PHP with swaks (sudo apt install swaks on Debian or Ubuntu). If swaks fails too, the problem is the account, not your code:

   swaks --server mail.example.com --port 587 --tls --auth LOGIN \
     --auth-user info@example.com --auth-password 'your-mailbox-password' \
     --from info@example.com --to you@example.org

   Lab output, wrong password and then the right one:

   <~* 535 5.7.8 Error: authentication failed: (reason unavailable)
   *** No authentication type succeeded
   
   <~  235 2.7.0 Authentication successful
   <~  250 2.0.0 Ok: queued as 6C38018002C

   The lines swaks prints after AUTH LOGIN are your username and password in Base64, which anyone can decode, so never post that output. More tests: How to test authentication and deliverability of your outgoing email?

3. Match the port and the encryption

• Port 587: PHPMailer::ENCRYPTION_STARTTLS (written 'tls' in older code).
• Port 465: PHPMailer::ENCRYPTION_SMTPS ('ssl').
• A mixed pair (465 with STARTTLS, or 587 with SMTPS) fails earlier, with SMTP Error: Could not connect to SMTP host.
• Port 25 is for server-to-server delivery, and many mail servers do not offer a login there. In our lab, PHPMailer then reported Could not authenticate. without sending a password at all. The same happened with encryption switched off (SMTPSecure = '' and SMTPAutoTLS = false) on a server that allows a login only after TLS.

Port 25 is open on all Ucartz servers, so a VPS or dedicated server can deliver mail directly, but scripts and mail apps should log in on 587 or 465. See SMTP Port Numbers Explained: 25, 587, 465 and 2525.

4. "Could not connect to SMTP host" with a certificate error

This is a different problem: the TLS check failed before any login. Lab example, connecting to 127.0.0.1 while the certificate was issued for another name (the name is a placeholder here):

SMTP Error: Could not connect to SMTP host. Connection failed. stream_socket_enable_crypto(): Peer certificate CN=`mail.example.com' did not match expected CN=`127.0.0.1'

Set Host to the exact name on the certificate (for example mail.example.com), not an IP address or localhost. Turning certificate checks off in SMTPOptions only hides the problem.

5. Gmail, Google Workspace and Microsoft 365

• Gmail: according to Google, an app password is a 16-digit passcode for apps, and it works only with 2-Step Verification turned on. Create one on the App passwords page of your Google Account and use it with smtp.gmail.com, port 587 (STARTTLS) or 465 (SSL), and the full address as the username. Google revokes all app passwords when you change the account password, which is a common reason a working script suddenly fails. The option does not appear when 2-Step Verification uses only security keys, with Advanced Protection, or for many work and school accounts.
• Google Workspace: according to Google, IMAP, SMTP and POP no longer work with only the account password. Use OAuth (PHPMailer supports XOAUTH2 through the league/oauth2-client package), an app password if your administrator allows it, or Google's SMTP relay service.
• Microsoft 365: according to Microsoft, SMTP AUTH is off when security defaults are on, and it can be off for the whole organisation. An administrator turns it on per mailbox under Users > Active users > the user > Mail > Manage email apps > Authenticated SMTP. Microsoft has also announced the retirement of Basic authentication (username and password) for SMTP AUTH, so plan for OAuth 2.0 or the Microsoft Graph API.

6. Outlook, Thunderbird or a phone says "authentication failed"

1. Check the same things: the full email address as the username, the current password, and the port and encryption your provider gives (cPanel's Set Up Mail Client page under Email Accounts lists them; secure SMTP there is port 465).
2. Make sure the outgoing (SMTP) server uses authentication with the same login as the incoming server.
3. If the settings are right and it still fails after many attempts, your IP address may be blocked by the server's brute-force protection: see Invalid login attempts through cPanel and IP address is blocked.

To find the right server name, see How to Find Your SMTP Server Name and IP Address (Outgoing and Incoming Mail Server).

7. On your own mail server: read the log

The server log shows why the login failed. Lab example from Postfix and from Dovecot (with auth_verbose = yes):

postfix/submission/smtpd[11531]: warning: localhost[127.0.0.1]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=info@example.com
auth: Info: passwd-file(info@example.com,127.0.0.1): Password mismatch
auth: Info: passwd-file(info,127.0.0.1): unknown user

Password mismatch is a wrong password, unknown user a wrong username. More codes: How to read Postfix logs and understand common SMTP error codes?

WordPress sends its mail through PHPMailer, so SMTP plugins show the same error and the same fixes apply: Set Up SMTP for WordPress Emails. For a full PHPMailer setup, see How to Send Email from PHP with SMTP (PHPMailer).

Official documentation: PHPMailer troubleshooting, Google app passwords, Microsoft SMTP AUTH.