# SMTP 503 5.5.1 Error: authentication not enabled

**URL:** https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006
**Category:** Self-hosting
**Created:** [August 3, 2021, 11:08am UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006 "2021-08-03T11:08:51Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![tiagofreitas87](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tiagofreitas87/32/174637_2.png) [@tiagofreitas87](https://meta.discourse.org/u/tiagofreitas87)
#### Post date: [August 3, 2021, 11:08am UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/1 "2021-08-03T11:08:51Z")

</div>

I am using a local postfix smtp and getting this error:

503 5.5.1 Error: authentication not enabled

DISCOURSE\_SMTP\_ADDRESS: [mail.xxx.net](http://mail.xxx.net)  
DISCOURSE\_SMTP\_PORT: 587  
DISCOURSE\_SMTP\_USER\_NAME: [resources@xxx.net](mailto:resources@xxx.net)  
DISCOURSE\_SMTP\_PASSWORD: password123?  
DISCOURSE\_SMTP\_ENABLE\_START\_TLS: true # (optional, default true)  
DISCOURSE\_SMTP\_OPENSSL\_VERIFY\_MODE: none  
DISCOURSE\_SMTP\_AUTHENTICATION: “plain”

I added the last 2 options as a last resort but made no effect.

The smtp server works in all testing tools I used, like openssl or swaks from inside the docker container.

```plaintext

root@resources-app:/# swaks --to resources@xxx.net --server mail.xxx.net:587 -tls
=== Trying mail.xxx.net:587...
=== Connected to mail.xxx.net.
<- 220 mail.xxx.net ESMTP Postfix (Ubuntu)
 -> EHLO resources-app
<- 250-mail.xxx.net
<- 250-PIPELINING
<- 250-SIZE 10240000
<- 250-VRFY
<- 250-ETRN
<- 250-STARTTLS
<- 250-ENHANCEDSTATUSCODES
<- 250-8BITMIME
<- 250-DSN
<- 250-SMTPUTF8
<- 250 CHUNKING
 -> STARTTLS
<- 220 2.0.0 Ready to start TLS
=== TLS started with cipher TLSv1.3:TLS_AES_256_GCM_SHA384:256
=== TLS no local certificate set
=== TLS peer DN="/CN=*.xxx.net"
 ~> EHLO resources-app
<~ 250-mail.xxx.net
<~ 250-PIPELINING
<~ 250-SIZE 10240000
<~ 250-VRFY
<~ 250-ETRN
<~ 250-ENHANCEDSTATUSCODES
<~ 250-8BITMIME
<~ 250-DSN
<~ 250-SMTPUTF8
<~ 250 CHUNKING
 ~> MAIL FROM:<root@resources-app>
<~ 250 2.1.0 Ok
 ~> RCPT TO:<resources@xxx.net>
<~ 250 2.1.5 Ok
 ~> DATA
<~ 354 End data with <CR><LF>.<CR><LF>
 ~> Date: Tue, 03 Aug 2021 11:04:12 +0000
 ~> To: resources@xxx.net
 ~> From: root@resources-app
 ~> Subject: test Tue, 03 Aug 2021 11:04:12 +0000
 ~> Message-Id: <20210803110412.593268@resources-app>
 ~> X-Mailer: swaks v20181104.0 jetmore.org/john/code/swaks/
 ~>
 ~> This is a test mailing
 ~>
 ~>
 ~> .
<~ 250 2.0.0 Ok: queued as 1C4ED8AA
 ~> QUIT
<~ 221 2.0.0 Bye
=== Connection closed with remote host.

```

---

<div class="post-metadata">

### Author: ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [August 3, 2021, 3:25pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/2 "2021-08-03T15:25:14Z")

</div>

The error could mean that you don’t have `smtp_sasl_auth_enable = yes` in your postfix conf. what is the output of `postconf -n` does it contain the above string? if not, then please uncomment or edit `/etc/postfix/main.cf` and report back.

---

<div class="post-metadata">

### Author: ![tiagofreitas87](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tiagofreitas87/32/174637_2.png) [@tiagofreitas87](https://meta.discourse.org/u/tiagofreitas87)
#### Post date: [August 3, 2021, 3:48pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/3 "2021-08-03T15:48:01Z")

</div>

I do have  
smtp\_sasl\_auth\_enable = yes  
smtpd\_sasl\_security\_options = noanonymous noplaintext  
smtpd\_tls\_security\_level = encrypt  
smtpd\_use\_tls = yes

---

<div class="post-metadata">

### Author: ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [August 3, 2021, 4:03pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/4 "2021-08-03T16:03:06Z")

</div>

> [@tiagofreitas87](#):
>
> smtpd\_sasl\_security\_options = noanonymous noplaintext

> [@tiagofreitas87](#):
>
> DISCOURSE\_SMTP\_AUTHENTICATION: “plain”

I think the above two options are contradictory. You should set the correct authentication method in discourse for this to work.

---

<div class="post-metadata">

### Author: ![tiagofreitas87](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tiagofreitas87/32/174637_2.png) [@tiagofreitas87](https://meta.discourse.org/u/tiagofreitas87)
#### Post date: [August 3, 2021, 6:50pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/5 "2021-08-03T18:50:29Z")

</div>

makes sense, I don’t use SASL so I set those options to make it more secure.  
What methods are available?  
Also why is SASL mandatory? I had it disabled before and SMTP worked in all other applications like nextcloud and thunderbird

SASL is only needed to send email to remote servers, but this server only works locally

Thanks

---

<div class="post-metadata">

### Author: ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [August 3, 2021, 7:19pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/6 "2021-08-03T19:19:07Z")

</div>

My understanding may be flawed here but I think sasl is needed because the docker container is logically separate from the host which has postfix running on it.

I’d say maybe try lowering the hardening of postfix and see what works best for you?

This file should give you some idea about how those settings

> [discourse/config/discourse\_defaults.conf at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/main/config/discourse_defaults.conf)

---

<div class="post-metadata">

### Author: ![tiagofreitas87](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tiagofreitas87/32/174637_2.png) [@tiagofreitas87](https://meta.discourse.org/u/tiagofreitas87)
#### Post date: [August 7, 2021, 1:37pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/7 "2021-08-07T13:37:54Z")

</div>

That defaults file doesn’t have all the possible values, was wondering if there is a more secure option. Will look at the code/libs later

---

<div class="post-metadata">

### Author: ![tiagofreitas87](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tiagofreitas87/32/174637_2.png) [@tiagofreitas87](https://meta.discourse.org/u/tiagofreitas87)
#### Post date: [August 7, 2021, 1:50pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/8 "2021-08-07T13:50:32Z")

</div>

> [@tiagofreitas87](#):
>
> smtpd\_sasl\_security\_options

removing the security options still doesn’t fix it.  
do I need to run launcher app rebuild before running discourse-doctor again?

thanks

---

<div class="post-metadata">

### Author: ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [August 7, 2021, 5:38pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/9 "2021-08-07T17:38:11Z")

</div>

> [@tiagofreitas87](#):
>
> smtpd\_sasl\_security\_options

Notice the `d`

Discourse should only really need the parameters starting with smtp and not smtpd

---

<div class="post-metadata">

### Author: ![tiagofreitas87](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tiagofreitas87/32/174637_2.png) [@tiagofreitas87](https://meta.discourse.org/u/tiagofreitas87)
#### Post date: [August 11, 2021, 10:45pm UTC](https://meta.discourse.org/t/smtp-503-5-5-1-error-authentication-not-enabled/199006/10 "2021-08-11T22:45:26Z")

</div>

I only have  
smtp\_sasl\_auth\_enable = yes

no other restrictions…