SMTPKeepFix "535 5.7.3 Authentication unsuccessful" and "5.7.57 Client not authenticated"
Both errors mean Exchange Online did not accept the device's login. "5.7.57 Client not authenticated to send mail" often appears together with a 535 code that gives the reason.
Check these, in order
- SMTP AUTH is enabled for the mailbox:
Get-CASMailbox -Identity scanner@yourdomain.com | Format-List SmtpClientAuthenticationDisabled. See 535 5.7.139 to turn it on. - MFA is not required for the account: basic SMTP AUTH cannot complete an MFA prompt.
- Security defaults are off: Microsoft notes basic SMTP AUTH is not compatible with security defaults.
- No Conditional Access policy blocks legacy authentication for the account.
- The password is right: sign in to Outlook on the web with the same account to confirm.
- Credentials are actually sent: a device set to "no authentication" gets "Client was not authenticated to send anonymous mail during MAIL FROM".
Avoid weakening security for a scanner
Turning off MFA or security defaults for a mailbox so a copier can send is a real trade-off. With SMTPKeep the device logs in to SMTPKeep instead, and SMTPKeep sends through the mailbox with OAuth, so the mailbox needs no SMTP AUTH, no MFA exemption and no Conditional Access exception.
| SMTP server | smtp.smtpkeep.com |
| Port | 587 |
| Security | STARTTLS (may be labelled TLS, "Use SSL/TLS: STARTTLS" or "Secure connection") |
| Authentication | SMTP AUTH on, username and password from the SMTPKeep dashboard |
| From / device email address | The mailbox you chose for the device, for example scanner@yourdomain.com |
| Older devices | If the device only supports TLS 1.0 or 1.1, use port 2525 instead |