What 534 5.7.9 means
534 means the authentication mechanism is too weak, and 5.7.9 is registered as 'Authentication mechanism is too weak'. Gmail returns it with 'Application-specific password required' when the account has 2-Step Verification on and your tool tried to log in with the regular password.
Like 535 5.7.8, this is about your own login. No email was sent.
What the bounce looks like
The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.
534 5.7.9 Application-specific password required.Why cold emailers see 534 5.7.9
- Logging in to smtp.gmail.com with your Google account password while 2-Step Verification is enabled.
- An app that doesn't support OAuth and was never given an app password.
- A mail client or script set up before 2-Step Verification was turned on, still using the old password.
How to fix 534 5.7.9
- Create an app password in your Google Account security settings and use it in place of your password.
- Or connect the inbox with Google OAuth, which avoids passwords entirely.
- If app passwords aren't available, your Workspace admin may have disabled them; ask them, or use OAuth.
- Google has been retiring password-based sign-in for third-party apps, so OAuth is the option that keeps working long term.
Retry or suppress?
Don't suppress anyone. Fix the login and resend.
Reading the code
The basic code 534 means "Authentication mechanism is too weak" under RFC 5321. In 5.7.9, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 9 is registered in RFC 3463 / the IANA registry as "Authentication mechanism is too weak".
- Class 5
- Permanent failure
- Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
- Subject 7
- Security or policy
- A security or policy decision: spam filtering, authentication, blocklists, permissions.
- Detail 5.7.9
- Authentication mechanism is too weak
Check the rest of your setup
Paste the headers of a message that did get through into the email header analyzer to confirm SPF, DKIM and DMARC pass, and check your domain with the SPF, DKIM & DMARC checker. The deliverability checklist covers the rest of a healthy sending setup.
Got a different bounce? Paste it into the SMTP error code lookup to decode it.