How to Troubleshoot Exim Error 535: Incorrect Authentication Data

Email issues are common on servers running Exim with cPanel/WHM. One frequently reported problem is the Exim error 535 authentication failed, also shown as “535 Incorrect authentication data.” This error usually appears when users try to send or receive emails and authentication fails. The error can occur due to incorrect login credentials, misconfigured mail clients, or authentication problems with services like Dovecot. Understanding how to diagnose and troubleshoot this issue can help administrators quickly restore normal email functionality.

Prerequisites

Before troubleshooting the error, ensure you have the following:

• Root or administrative access to the server
  
• SSH access to the server
  
• Knowledge of cPanel/WHM configuration

These requirements help you analyze logs and modify server configurations if needed.

What is Exim Error 535?

Exim error 535 Incorrect authentication data typically occurs when a mail client fails to authenticate with the mail server. The error may appear in the Exim log similar to the following example:

fixed_login authenticator failed for (ispip.net) ([XX.XX.XX.XX]) [YY.YY.YY.YY]: 535 Incorrect authentication data ([email protected])

This issue is most commonly caused by incorrect email login credentials. If the username or password is wrong, the server rejects the authentication request.

However, if the credentials are correct and the problem persists, further debugging may be required using Dovecot authentication logs.

Steps to Troubleshoot Exim Error 535

Step 1: Verify Email Credentials

The first step is to confirm that the email username and password are correct.

• Check the email account credentials in cPanel.
  
• Update the password if necessary.
  
• Ensure the mail client uses the full email address as the username.

Incorrect login details are the most common reason for the 535 authentication error.

Step 2: Check Exim and Mail Logs

Next, review the server logs to identify authentication failures.

Common log locations include:

/var/log/exim_mainlog
/var/log/maillog

Look for entries that mention “authenticator failed” or “535 Incorrect authentication data.”

These logs help identify which account or IP address is failing authentication.

Step 3: Enable Dovecot Debug Logging

If the cause is still unclear, enable Dovecot debug logs to obtain more detailed authentication information.

Follow these steps:

1. Log in to the server via SSH as root.
   
2. Open the Dovecot configuration file:

/etc/dovecot/dovecot.conf

3. Enable the following debug settings:

auth_verbose = yes
auth_verbose_passwords = no
auth_debug = yes
auth_debug_passwords = yes
mail_debug = yes
verbose_ssl = yes

4. Save the configuration file.
   
5. Restart the Dovecot service:

/scripts/restartsrv_dovecot

After enabling debugging, authentication issues will appear in /var/log/maillog, helping you identify password mismatches or configuration problems.

Step 4: Test Email Authentication

Try sending a test email using the affected account.

• Confirm that authentication works with updated credentials.

• Monitor the logs again for any remaining errors.

If authentication succeeds, the issue is resolved.

Conclusion

The Exim 535 Incorrect authentication data error mainly occurs due to invalid email login credentials or authentication failures. By following the steps mentioned in the blog, system administrators can quickly identify the root cause and restore email functionality on a cPanel server. Proper log analysis and debugging tools like Dovecot debug mode are essential for resolving persistent authentication issues.

If you’re struggling with Exim error 535 authentication failed, don’t stress—our experts are here to help. With our Hourly Server Support Services and comprehensive server management services, we can quickly troubleshoot and resolve your mail server issues. Contact us today to get your server running smoothly!