Step by Step Guide to solve n8n SMTP Node Authentication Error
Quick Diagnosis
If the n8n SMTP node returns “Authentication failed”:
- Confirm credentials – test the same username/password with an external mail client (e.g., Thunderbird, Outlook, or
openssl s_client). - Match port & security – use the provider’s recommended port (465 SSL, 587 STARTTLS, 25 plain) and set the Secure toggle accordingly.
- Enable “Less secure apps” / App‑specific password for Gmail, Outlook, etc.
- Whitelist n8n’s IP in the mail provider’s console.
- Save & re‑run the workflow; the error should disappear.
Who this is for – Developers and DevOps engineers who run automated email workflows in n8n and encounter SMTP authentication failures. We cover this in detail in the n8n Node Specific Errors Guide.
1. Why the SMTP Node Fails
If you encounter any n8n google sheets node auth failure resolve them before continuing with the setup.
| Symptom | Typical Root Cause |
|---|---|
535 5.7.8 Authentication credentials invalid |
Wrong username/password, or an app‑password is required. |
530 5.7.0 Must issue a STARTTLS command first |
Port/security mismatch (STARTTLS on a port that expects plain text or vice‑versa). |
550 5.1.1 Recipient address rejected |
Often mis‑interpreted; the server rejects the MAIL FROM after auth failure. |
451 4.3.0 Temporary authentication failure |
Provider rate‑limits or blocks the originating IP. |
The node simply forwards the SMTP server’s response, so troubleshooting focuses on credentials, connection security, and provider policies.
2. Debugging Workflow
If you encounter any n8n mysql node authentication error resolve them before continuing with the setup.
2.1 Verify Credentials Outside n8n
# OpenSSL test for STARTTLS on port 587 openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf # After the TLS handshake, type: AUTH LOGIN # Then send base64‑encoded username & password: # echo -n "your.email@gmail.com" | base64 # echo -n "your_app_password" | base64
Successful reply: 235 2.7.0 Accepted.
EEFA tip – Never store plain passwords in the n8n environment. Use n8n Credentials with encrypted storage or a secret manager (AWS Secrets Manager, HashiCorp Vault, etc.).
2.2 Align Port & Security Settings
| Provider | Port | Secure toggle in n8n | Extra note |
|---|---|---|---|
| Gmail (SSL) | 465 | SSL | Use an App Password if 2FA is enabled. |
| Gmail (STARTTLS) | 587 | TLS (STARTTLS) | Same app‑password requirement. |
| Outlook | 587 | TLS | Enable “Authenticated SMTP” in Exchange admin. |
| SendGrid | 587 | TLS | Use API key as password; set Username to apikey. |
| Amazon SES | 465 / 587 | SSL / TLS | Verify the sending domain in SES. |
EEFA – When using port 465 (implicit SSL), the Secure toggle must be SSL. Selecting TLS on this port forces a STARTTLS upgrade that the server does not support, leading to a 530 error.
2.3 Update the SMTP Node in n8n
- Open the workflow → click the SMTP node.
- Fill the fields (example for Gmail‑SSL):
| Field | Example value |
|---|---|
| Host | smtp.gmail.com |
| Port | 465 |
| Secure | SSL |
| User | my.email@gmail.com |
| Password | *App‑password* (stored via n8n Credentials) |
| From Email | my.email@gmail.com |
| Reply‑To | (optional) |
| Additional Headers | X-Entity-Ref-ID: {{ $node[“Trigger”].json[“id”] }} (if needed) |
- Click Save → Execute Node.
If the node still fails, move to the advanced checklist.
3. Advanced Troubleshooting Checklist
- App‑specific password generated (Google, Microsoft, Yahoo).
- Two‑factor authentication disabled for SMTP or app‑password used.
- IP allow‑list includes the server where n8n runs (common for corporate SMTP).
- TLS version compatibility – providers reject TLS 1.0/1.1; ensure Node.js ≥ 14 (TLS 1.2+).
- Rate limits – inspect provider dashboard for “SMTP blocked” or “Too many login attempts”.
- Environment variables – verify secret references (
{{ $env.SMTP_PASSWORD }}) resolve correctly. - Outbound firewall – ports 465/587 must be open from the n8n host.
4. Real‑World Example: Sending a Daily Report via Gmail
If you encounter any n8n slack node permission denied resolve them before continuing.
4.1 SMTP Node Definition
{
"parameters": {
"fromEmail": "my.email@gmail.com",
"toEmail": "team@example.com",
"subject": "Daily Sales Report – {{ $today }}",
"text": "Hi team,\n\nPlease find the attached sales report.\n\nBest,\nAnalytics Bot",
"attachments": [
{
"binaryPropertyName": "data"
}
]
},
"name": "Send Gmail",
"type": "n8n-nodes-base.smtp",
"typeVersion": 1,
"position": [400, 300],
"credentials": {
"smtp": "Gmail_SMTP"
}
}
Note – The credential “Gmail_SMTP” must be created under Settings → Credentials → SMTP with the App Password, SSL, and port 465.
4.2 Workflow Skeleton (connections)
{
"nodes": [
/* SMTP node from above */
],
"connections": {}
}
Running this workflow after completing the steps in Section 2 resolves authentication errors.
5. Capture Detailed SMTP Logs
Add a Set node before the SMTP node to store the raw server response:
{
"parameters": {
"values": [
{
"name": "smtpResponse",
"value": "={{ $json[\"response\"] }}",
"type": "string"
}
]
},
"name": "Capture SMTP Response",
"type": "n8n-nodes-base.set",
"typeVersion": 1,
"position": [250, 300]
}
Enable debug mode in the n8n UI; the captured smtpResponse will show the exact SMTP error code (e.g., 535 5.7.8). This is invaluable for provider‑specific troubleshooting.
6. EEFA (Experience, Evidence, Fix, Advice) Summary
| Situation | Why it Happens | Fix | Production‑grade Advice |
|---|---|---|---|
| Wrong password | Typo or provider requires app‑password. | Regenerate app‑password, update n8n credentials. | Rotate app‑password every 90 days; store in a secret manager. |
| Port/security mismatch | Using TLS on port 465 or SSL on 587. | Align Port + Secure per provider table. | Document the configuration in a version‑controlled repo. |
| IP blocked | Provider blocks unknown IPs for security. | Whitelist n8n server IP in provider console. | Use a static outbound IP (e.g., NAT gateway) for reproducibility. |
| TLS version too low | Legacy Node.js/OpenSSL rejects TLS 1.2+. | Upgrade Node.js to ≥ 14, keep OpenSSL up‑to‑date. | Pin NODE_OPTIONS=--tls-min-v1.2 in the container runtime. |
| Rate limiting | Too many auth attempts in a short window. | Back‑off, use exponential retry, or request higher quota. | Add a Retry node (maxAttempts: 5, waitTime: 30s). |
8. Next Steps
- Using OAuth2 with the SMTP node – for providers that no longer support password‑based auth.
- Batch email sending with n8n – scaling beyond single‑message workflows.
- Monitoring SMTP node health – integrating with Prometheus or n8n’s built‑in execution logs.
Conclusion
Authentication failures in the n8n SMTP node boil down to three pillars: correct credentials, matching port & security, and provider‑specific policies (app passwords, IP allow‑lists, TLS versions). By validating credentials externally, configuring the node exactly as the provider recommends, and ensuring the n8n host complies with network and security rules, you eliminate the common error codes (535, 530, 451) and achieve reliable email delivery in production pipelines. Apply the EEFA checklist, keep secrets in a vault, and document the configuration for repeatable, maintainable workflows.
