SMTP Error “530 5.7.0 Must issue STARTTLS”

When sending an email from an automated script, web form, network copier, or custom application, your transmission may fail immediately with the SMTP response:

530 5.7.0 Must issue a STARTTLS command first.
530-5.7.0 Must issue a STARTTLS command first. g21sm1285324pfa.24 - gsmtp

Quick Answer

The error 530 5.7.0 Must issue a STARTTLS command first means your client attempted to send authentication credentials or message data over an unencrypted connection to a server that requires TLS encryption. To fix it, enable STARTTLS in your client’s settings on port 587, or switch to implicit SSL/TLS on port 465.

---

What the Error Means

SMTP (Simple Mail Transfer Protocol) was originally designed to operate in plain text. Modern email providers—including Google Workspace, Gmail, and Microsoft 365—require transport encryption to safeguard user credentials and message contents against interception.

The 530 5.7.0 response is an explicit security refusal:

1. Your email client established a plain TCP socket connection to the server on port 25 or port 587.
2. The server answered the initial connection with an EHLO response that included 250-STARTTLS in its list of supported features.
3. Rather than issuing the STARTTLS command to negotiate a secure tunnel, your client immediately attempted an authentication command (AUTH LOGIN) or tried to send mail data (MAIL FROM:).
4. The server rejected the unencrypted command and closed the session to prevent your credentials from being exposed in plain text.

---

Technical Causes

SMTP 530 5.7.0 Error
│
├── What port are you using?
│   ├── Port 25 or 587 ──► TLS is disabled in client settings. Turn on STARTTLS.
│   └── Port 465       ──► Client is sending plain text to an implicit SSL port.
│
├── Is this coming from a coded application (Node.js, Python, PHP)?
│   ├── YES ──► Missing TLS library configuration or CA trust mismatch.
│   └── NO  ──► Firmware on hardware device (printer/scanner) lacks modern TLS 1.2+ support.

1. Unencrypted Port 587 Submission: The client is using port 587 without enabling the TLS setting. Port 587 allows a plaintext greeting, but the server will not accept any authentication or message data until the client issues STARTTLS.
2. Implicit vs. Explicit Configuration Mismatches: The client is configured to connect to port 465, but the software’s internal engine is sending commands using the explicit STARTTLS sequence rather than establishing an implicit TLS connection from the start.
3. Outdated TLS Protocol Support: Google no longer supports TLS 1.0 or TLS 1.1. If an older network appliance (such as a legacy office scanner or embedded IoT device) can only negotiate TLS 1.0, Google’s mail transfer agent rejects the TLS handshake, falls back to plain text, and returns error 530.
4. Invalid or Missing SSL Certificates on Local Relays: If an application relies on a local proxy or internal relay server that lacks a valid TLS certificate, modern destination servers will reject the unencrypted handoff.

---

Step-by-Step Resolution

Step 1: Update Application and Client Settings

Ensure your outgoing mail settings match Google’s standard connection parameters:

• SMTP Host: smtp.gmail.com
• SMTP Port: 587
• Security / Encryption: STARTTLS (or TLS)
• Authentication: Required (User and Password / App Password)

Alternatively, if your client software only provides a simple “Use SSL” checkbox without a STARTTLS option:

• Set the SMTP Port to 465.
• Check the Use SSL (or Use SSL/TLS) box.

To understand why using the wrong port-and-security combination leads to connection timeouts, see How to Fix Gmail Port 587 vs. 465 Timeouts.

---

Step 2: Code Configurations (Python, PHP, Node.js)

If you are developing custom software, make sure your code explicitly calls the STARTTLS method before attempting to authenticate.

Python Example (smtplib)

A common mistake in Python is calling login() immediately after creating an SMTP object on port 587 without calling starttls() first:

import smtplib

# INCORRECT (Triggers 530 5.7.0):
# server = smtplib.SMTP('smtp.gmail.com', 587)
# server.login('user@domain.com', 'password')

# CORRECT:
server = smtplib.SMTP('smtp.gmail.com', 587)
server.ehlo()
server.starttls()  # Upgrades the connection to TLS
server.ehlo()      # Re-identify over the secure channel
server.login('user@domain.com', 'app_password_here')

PHPMailer Example

$mail = new PHPMailer(true);
$mail->isSMTP();
$mail->Host       = 'smtp.gmail.com';
$mail->SMTPAuth   = true;
$mail->Username   = 'user@domain.com';
$mail->Password   = 'app_password_here';
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS; // Enables STARTTLS
$mail->Port       = 587;

---

Step 3: Resolving TLS Issues on Legacy Scanners and Hardware

If your multi-function printer or network device cannot establish a modern TLS 1.2+ connection:

1. Check the manufacturer’s support site to see if a firmware update adds TLS 1.2 support.
2. If the device cannot be updated, do not connect it directly to smtp.gmail.com. Instead, use Google Workspace’s SMTP Relay Service via public IP whitelisting:
   • In the Google Admin Console, go to Apps > Google Workspace > Gmail > Routing.
   • Configure the SMTP relay service to accept unencrypted transmissions from your office’s public static IP address.
   • Point the legacy device to smtp-relay.gmail.com on port 25 with authentication disabled.

If your device authenticates but is still rejected by the relay, review the routing rules in Troubleshooting SMTP Relay: “550 5.7.1 Relaying Denied”.