SMTP error 5.5.1 Invalid command

What SMTP error 5.5.1 means

The client sent an SMTP command the server would not accept, either out of sequence or one it does not offer at all. In a UK business the sender is usually a device rather than a person: a scanner, a copier, an alarm panel or an old line-of-business application trying to send through Microsoft 365 and being told 530 5.5.1 because it has not authenticated. The registry lists a range of reply numbers for it, including 430 where the same refusal is reported as temporary. Nothing here is wrong with the address, the network or the message.

Mail delivery protocol status
Sent by The receiving server, refusing a command the client had just sent
Common

What SMTP error 5.5.1 Invalid command actually means

SMTP is a conversation with a fixed order: the greeting, then EHLO, then optionally STARTTLS and AUTH, then the sender, then the recipients, then the data. Step outside that order and the server answers with this code alongside a 500-series reply. The single most common instance in practice is a device attempting to relay through Exchange Online without authenticating: the connection succeeds, the device names a sender, and the server refuses because unauthenticated relay is not something it offers. The refusal is entirely deterministic, so a device configured this way fails identically on every attempt rather than intermittently.

A mail transaction protocol command was issued which was either out of sequence or unsupported. This is useful only as a permanent error.
— RFC 3463

How 5.5.1 appears in a bounce

A server reporting this condition sends it alongside a three-digit reply code, and a bounce prints the two together. The registry lists these pairings for this status: 500 5.5.1, 501 5.5.1, 503 5.5.1, 530 5.5.1, 550 5.5.1, 554 5.5.1, 555 5.5.1. Which one you get depends on the point in the conversation at which the server refused. The registry also lists 430 for this condition, but that belongs with 4.5.1 rather than with this code, because a reply code and the status beside it always agree on whether the failure is temporary or permanent.

The leading 5 is the server's verdict rather than part of the code's identity: it marks this as a permanent failure, which means the sending server has given up and returned the message. The same condition reported as 4.5.1 is the other verdict on the identical problem, so a log showing that form has not produced a bounce yet.

What causes SMTP error 5.5.1 on a business phone system

A device relaying without authenticatingMultifunction printers and scanners set up years ago against an on-premise server simply point at whatever host they were given and send. Hosted platforms will not relay for an anonymous client, so the first message after a migration fails and every one after it.
SMTP authentication disabled on the mailbox or the tenantClient submission is switched off by default on newer Microsoft 365 tenants and can be disabled per mailbox. The device offers credentials, the server declines to discuss authentication, and the session stops there.
Commands issued in the wrong orderNaming recipients before the sender, or starting the data transfer before any recipient has been accepted, are classic failures in hand-written SMTP code. The server rejects the command that arrived at the wrong point.
Authentication attempted before the connection is encryptedServers commonly advertise authentication only after the session is secured. A client that tries first, or one that cannot negotiate a current TLS version, never sees the option and is refused when it asks.
A firewall stripping the server's capability listWhere SMTP inspection rewrites the response to EHLO, the client never learns what the server supports and falls back to something unsupported. The device is behaving correctly on the information it was given.

How to fix SMTP error 5.5.1

Find out which command was refusedThe device log or a manual session shows whether the refusal followed the sender, the recipient or the authentication attempt. Each points somewhere different, and guessing between them wastes an afternoon.
Choose the right relay method for the deviceAuthenticated submission on port 587 with a licensed mailbox suits devices that can handle credentials and current TLS. Direct send to your tenant works for devices that only need to reach colleagues. A relay connector scoped to your public address covers devices that can do neither.
Enable SMTP authentication on the one mailbox that needs itTurn it on for the specific account the device uses rather than across the whole tenant. That keeps the exception small and documented, which matters when the next security review asks about it.
Set the device to port 587 with STARTTLS and modern TLSMany older machines cannot manage current TLS versions at all, and discovering that early saves a long argument with the manufacturer. If it cannot, it needs to sit behind a relay rather than talk to the platform directly.
Put an internal relay in front of equipment that cannot be updatedA small relay on the local network, or a hosted SMTP relay service, accepts the device's simple session and speaks properly to the platform on its behalf. This is the standard answer for older machinery that still has years of service in it.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SMTP error 5.5.1

Our scanner stopped emailing after we moved to Microsoft 365. Is this why?

Almost certainly. It was relaying anonymously through a server that allowed it, and the hosted platform will not. Decide between authenticated submission with a dedicated mailbox, direct send for internal recipients only, or a relay connector, then reconfigure the device to match.

Is 530 5.5.1 a password problem?

No. It means authentication was required and was not offered, or the client asked to authenticate at a point where the server would not entertain it. Credentials that are genuinely wrong produce 5.7.8 instead, which is a useful distinction when a device offers no detail of its own.

Can we still send on port 25 from anything?

Yes, for direct send, where a device connects to your tenant's own mail host and sends only to recipients in your own domains. It needs no credentials but cannot reach outside addresses, so it suits scan-to-email and internal alerts and nothing else.

Related SMTP status codes

Source. SMTP error 5.5.1 Invalid command is defined in RFC 3463 and registered in the IANA SMTP Enhanced Status Codes registry. The causes and fixes above are drawn from our own experience supporting UK business email systems.

All Email delivery & SMTP codes