Is 535 5.7.8 a hard bounce or a soft bounce?

535 5.7.8 is a permanent failure (a hard bounce): the receiving server won't accept this message if you send it again unchanged. But the cause is not the recipient's address, so treat it differently from a 'user unknown' bounce.

535 5.7.8 Error: Meaning and Fix

Q: Should I remove the contact after a 535 5.7.8 bounce?

No. Don't suppress anyone; no message left your server. Fix the login, then resume the campaign.

What 535 5.7.8 means

535 means authentication failed and 5.7.8 is 'Authentication credentials invalid' (RFC 4954). This is about your own connection to your outgoing mail server, not about any recipient. Nothing was sent.

With Gmail it shows as '535 5.7.8 Username and Password not accepted'. Google no longer accepts a regular account password over SMTP for most accounts; you need an app password (which requires 2-Step Verification) or an OAuth connection.

What the bounce looks like

The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.

Gmail

535 5.7.8 Username and Password not accepted.

Why cold emailers see 535 5.7.8

Wrong username or password, or the username isn't the full email address.
Using your normal Google password over SMTP instead of an app password or OAuth.
The password changed, or an app password was revoked.
Copying an app password with spaces or extra characters.
An admin disabled SMTP access or app passwords for the account.

How to fix 535 5.7.8

Re-enter the credentials, using the full email address as the username.
For Google accounts, turn on 2-Step Verification and create an app password, or connect the inbox with Google OAuth instead of SMTP.
Check with your workspace admin that SMTP/IMAP access isn't blocked by policy.
Reconnect the inbox in your sending tool and send a test.

Retry or suppress?

Don't suppress anyone; no message left your server. Fix the login, then resume the campaign.

Reading the code

The basic code 535 means "Authentication credentials invalid" under RFC 5321. In 5.7.8, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 8 is registered in RFC 3463 / the IANA registry as "Authentication credentials invalid".

Class 5: Permanent failure; Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
Subject 7: Security or policy; A security or policy decision: spam filtering, authentication, blocklists, permissions.
Detail 5.7.8: Authentication credentials invalid

Check the rest of your setup

Paste the headers of a message that did get through into the email header analyzer to confirm SPF, DKIM and DMARC pass, and check your domain with the SPF, DKIM & DMARC checker. The deliverability checklist covers the rest of a healthy sending setup.

Got a different bounce? Paste it into the SMTP error code lookup to decode it.

535 5.7.8: Username and password not accepted