Amazon SES SMTP "535 Authentication Credentials Invalid": fix it

What it means

Your app, plugin or mail server connected to the Amazon SES SMTP endpoint, tried to log in, and SES refused the username or password:

535 Authentication Credentials Invalid

A 5xx code means a permanent error: retrying with the same settings will fail again. The connection itself works, so this is not a firewall problem.

Why it happens

• You used IAM access keys directly. The SES SMTP password is not your AWS secret access key. The SMTP username looks like an access key ID (AKIA...), but the password is derived from the secret key with a special algorithm.
• Wrong Region. SMTP credentials are unique to each AWS Region. Credentials created for eu-west-1 do not work on email-smtp.us-east-1.amazonaws.com.
• Deleted or deactivated user or key. SMTP credentials belong to an IAM user. If that user or its access key was deleted or made inactive (for example during a security cleanup), the login fails.
• Temporary credentials. SMTP passwords cannot be derived from temporary credentials (roles, STS session keys).
• Copy and paste mistakes: extra spaces, a truncated password, or special characters (+, /, =) broken when placed in a URL or a .env file without quotes.
• An old username/password stored by a plugin, while you changed the values somewhere else.

Other codes mean other problems: 530 Authentication required means your client did not try to log in at all; 535 Account not subscribed to SES means the AWS account is not signed up for SES; 554 Access denied: User ... is not authorized to perform ses:SendRawEmail means the login worked but the IAM user lacks permission.

How to check

1. In the SES console, open SMTP settings in the Region you use and note the exact endpoint, for example email-smtp.eu-west-1.amazonaws.com. Ports are 25, 587 or 2587 with STARTTLS, and 465 or 2465 with TLS from the start.
2. In IAM, find the SMTP user and check that its access key is Active.
3. Test the login outside your app with swaks:

swaks --server email-smtp.eu-west-1.amazonaws.com --port 587 --tls \
  --auth LOGIN --auth-user 'AKIAEXAMPLE' --auth-password 'YOUR_SMTP_PASSWORD' \
  --from sender@yourdomain.com --to you@example.com

If swaks gets 235 Authentication successful, the credentials are good and the problem is in your app's configuration. If you cannot connect at all, see SMTP port 25 blocked or connection timed out (port 25 is restricted on EC2; use 587 or 465).

How to fix it

1. Create SMTP credentials the easy way. SES console, correct Region, SMTP settings, Create SMTP credentials. SES creates an IAM user with the right sending permission and shows the SMTP username and password once. Download the .csv file.
2. Or derive them from an existing IAM user's secret key using the script in the AWS documentation, giving it the Region where you will send. The user needs ses:SendRawEmail permission.
3. Put the values in your app with the endpoint of the same Region. Example for nodemailer:

const transporter = nodemailer.createTransport({
  host: 'email-smtp.eu-west-1.amazonaws.com',
  port: 587,
  secure: false, // STARTTLS
  auth: { user: process.env.SES_SMTP_USER, pass: process.env.SES_SMTP_PASS },
});

For Postfix, in /etc/postfix/sasl_passwd:

[email-smtp.eu-west-1.amazonaws.com]:587 AKIAEXAMPLE:YOUR_SMTP_PASSWORD

Then run postmap /etc/postfix/sasl_passwd, set relayhost = [email-smtp.eu-west-1.amazonaws.com]:587, smtp_sasl_auth_enable = yes, smtp_tls_security_level = encrypt, and reload Postfix.

If you use PHPMailer or WordPress, the same causes produce "Could not authenticate"; see PHPMailer SMTP Error: Could not authenticate. To change an SMTP password, AWS recommends deleting the SMTP user and creating new credentials. If your credentials were created before January 10, 2019, replace them: they use an older signature version.

Check that it is fixed

Send a message from your app through SES to the unique address on the Delivmail home page. If it arrives, authentication works; read the report for SPF, DKIM and DMARC. If you now get 554 Message rejected: Email address is not verified, the login is fine and the next step is in Amazon SES "Email address is not verified".