What causes SMTP 535 auth fail when using AWS SES SDK with expired SASL tokens?

You’re running a batch job, sending hundreds of transactional emails via AWS SES SDK. The first few go through fine. Then suddenly, without warning, they start failing with SMTP 535: Authentication failed. No change in credentials. No network issues. Just a silent rejection.

This isn’t a configuration mistake. It’s a timing issue: AWS SES’s SMTP authentication relies on SASL tokens that expire after 15 minutes. If your app or script reuses an old connection without refreshing the token, the server blocks the login. The failure isn’t about wrong passwords—it’s about stale authentication.

Resolving SMTP 535 auth fail caused by expired SASL token in AWS SES SDK isn’t about patching a config file. It’s about understanding the handshake lifecycle and ensuring re-authentication happens before any new connection attempt. You’ll learn how to detect, diagnose, and fix this in long-running processes—before it crashes your entire send queue.

Key takeaways

  • SASL tokens for AWS SES SMTP expire after 15 minutes and must be refreshed before each new connection.
  • SMTP 535 errors in the AWS SES SDK often stem from reusing an authenticated session without initiating a new SASL handshake.
  • Long-running processes or custom SMTP clients must explicitly handle token renewal, especially after idle periods exceeding 15 minutes.

How does an expired SASL token break SMTP delivery in AWS SES SDK?

SMTP 535 authentication failures in AWS SES SDK occur when the temporary SASL token used for authentication expires, even if your username and password are correct. AWS SES doesn’t use static credentials—instead, it issues time-limited tokens via IAM, which expire after 15 minutes. After that, any attempt to authenticate with the expired token fails, and the server returns 535. This often leads to confusion, as the error suggests incorrect credentials, when in reality, the issue is session timeout.

Why SASL tokens expire and cause delivery issues

When you configure AWS SES SMTP, you’re not sending a permanent password. The credentials are tied to a short-lived SASL token generated through AWS IAM. This token is valid for a fixed window—usually 15 minutes—after which it’s no longer accepted by the SMTP server. If your application holds onto the token or reuses it after expiration, SMTP authentication fails with a 535 response, regardless of correct syntax or proper setup.

Many developers, including those using the AWS SDK or third-party tools, assume the error means they’ve typed the password wrong or the IAM role is misconfigured. But the actual problem is often simply that the token has timed out. This misdiagnosis can lead to hours spent debugging authentication flows while the real issue is a missing token refresh mechanism.

How to detect and prevent 535 errors in practice

Most tools, including AWS SES SDKs, don’t auto-renew the token. So if your application opens an SMTP session and keeps it open longer than 15 minutes, or reuses credentials without refreshing them, you’ll see 535. A common fix is to implement token refresh logic—fetch a new SASL token before attempting to send mail, especially in long-running processes.

This behavior is consistent with industry standards. The IETF’s RFC 4954, which defines SASL mechanisms, explicitly allows for session timeouts and does not require persistent credentials. AWS’s approach follows this model, favoring security over convenience.

Tools like bulk email verification services can help surface delivery issues early by testing list hygiene and simulating real-world delivery conditions. While they don’t solve token expiration, they help distinguish between deliverability problems caused by invalid emails versus authentication issues in your pipeline.

Always treat 535 errors in AWS SES not as credential mistakes, but as expiration signals. Ensure your SMTP client or service refetches the token before each session or within the 15-minute window. That’s the real fix—no matter how many times you recheck your password.

What’s the correct way to handle SASL token expiration in the AWS SES SDK?

You must treat every SMTP session with AWS SES as stateless. Never rely on a cached SASL token—fetch a fresh one before each connection or after 10 minutes of inactivity. Use AWS’s built-in credential endpoint to get valid tokens; don’t hardcode values. If managing connections manually, track the token’s expiration and refresh it before reconnecting.

Here’s the proper process for handling SASL token expiration:

  1. Never assume a token stays valid across sessions. The AWS SES SMTP service invalidates tokens after 10 minutes or when the connection is dropped. Treating connections as stateless ensures reliability. This behavior is documented in Amazon’s SMTP documentation and aligns with standard practices for temporary credentials in cloud environments.
  2. Fetch fresh credentials before each SMTP session. Call the AWS SDK’s GetSendRawEmailEndpoint or GetIdentityVerificationAttributes just before establishing a new connection. These endpoints return up-to-date SMTP credentials, including the current SASL token and expiration timestamp. This avoids auth failures due to stale tokens.
  3. Monitor token expiration on your end if using a custom client. Store the ExpiresAt timestamp returned from the AWS SDK. If more than 8 minutes have passed since that time, fetch a new set of credentials before reconnecting. This reduces the chance of timing out just as the session starts.
  4. Use the AWS SDK’s built-in methods over custom logic. These functions handle rate limiting, retry logic, and credential renewal automatically. Rolling your own method increases the chance of error, especially under high load or intermittent network conditions. The AWS SDK for JavaScript, Python, and other languages provides well-tested implementations of this process.

Why this matters for deliverability

Repeated 535 auth failures due to expired tokens can trigger rate limiting or IP reputation issues with AWS SES. If not cleared promptly, these can lead to temporary send limits or even sender reputation blacklisting. Maintaining consistent, valid authentication is foundational to inbox placement.

Failure to refresh credentials on time is one of the top causes of SMTP session breakdowns in API-based email systems using AWS SES.

Even small delays in credential refresh can cascade into failed sends, reduced delivery rates, and broken customer journeys. You’re not just avoiding errors—you’re maintaining the reliability your email stack depends on.

Verify your email list before sending to catch invalid or poorly formatted addresses early. While this won’t prevent SASL token issues, it reduces overall delivery load and keeps your sender reputation strong.

How to test if your AWS SES SMTP connection is affected by expired SASL tokens?

If you’re seeing repeated SMTP 535 authentication failures exactly 15 minutes after establishing a connection—especially after idle periods or during bulk sends—your session is likely being dropped due to an expired SASL token. AWS SES SMTP sessions time out after 15 minutes, requiring re-authentication. You can confirm this by manually simulating the login and waiting 15 minutes to see if re-authentication fails.

Test the connection behavior with manual SMTP inspection

  • Use telnet or openssl s_client to connect to AWS SES SMTP endpoint (email-smtp.us-east-1.amazonaws.com) on port 587.
  • Authenticate with your SMTP credentials using the SASL PLAIN mechanism. Note the exact time you complete login.
  • Wait exactly 15 minutes. Do not send any new data. This mirrors the actual timeout behavior in production.
  • Attempt to re-authenticate with the same token. If the server responds with 535, the token has expired as expected.
  • If the re-authentication fails, you've confirmed the 15-minute SASL token expiration cycle is active and must be handled.

Common patterns and confirmation

SMTP 535 errors due to expired tokens typically appear in clusters: a batch of emails sends successfully, then fails in bulk after 15 minutes. They're not tied to message content or recipient validity—only to session duration. This behavior is documented in AWS's official SMTP documentation.

For reference, AWS does not document a fixed SASL token lifetime in public documentation, but timing-based failures align with RFC 4954 (SASL) and observed behavior across production environments. The 15-minute limit is a common real-world boundary for SMTP sessions, though not universally enforced.

Once you verify the behavior, implement a retry logic that triggers re-authentication every 14 minutes or upon detecting a 535. This avoids interruption during long-running jobs.

If you're managing large lists, ensure your email verification process checks for valid, deliverable addresses before sending—reducing the chance of cascading failures.

You can pre-validate your entire list using bulk verification tools that detect invalid, disposable, or risky addresses in advance.

Why does an expired SASL token lead to delivery failure even if the email is valid?

Even if an email address is perfectly valid, an expired SASL token halts delivery at the SMTP handshake stage — before any message is sent. The authentication fails immediately, and the server rejects the connection outright. No bounce is generated, no queue is created, and no delivery record exists, making it appear as if the message was never sent.

Authentication happens before message submission

When you send via AWS SES using SMTP, the first thing the server does is validate your credentials using SASL. If the token has expired — which happens every 15 minutes in AWS SES — the server refuses the connection. This occurs before the recipient domain is even queried, and before the message body is processed.

You can’t send a single email with an expired token, even if the recipient address is active. The SMTP protocol itself enforces this early rejection — it’s not a policy, it’s how SMTP is designed. The 535 error code means “Authentication failure,” and it’s returned immediately when the server can’t verify your identity.

No audit trail, no bounces — just silent failure

Because the auth step fails at the gateway, there’s no delivery record, no bounce, no retry. Your app thinks the message was sent — but in reality, nothing reached the recipient’s mail server. This creates a blind spot: you have no logs to show what went wrong, and no way to distinguish between a bad address, a routing issue, or an expired credential.

Consistent 535 errors across dozens of messages? That’s a strong signal the authentication token hasn’t been refreshed. It’s not the email list. It’s not the SES configuration. It’s the session token timing out between requests.

This is why some delivery failures are invisible to standard monitoring tools. The email is never queued, never bounced, never logged — it just vanishes. This makes it difficult to debug without looking at low-level SMTP logs or enabling detailed AWS CloudWatch monitoring.

Let’s be clear: valid emails don’t fail because of syntax or domain issues here. They fail because the sender’s identity isn’t verified at the door. It’s not a deliverability problem — it’s an auth problem.

Regular credential refreshing is essential. You can’t assume an SDK session lasts indefinitely. Use short-lived tokens, implement token rotation, and monitor SMTP responses on the fly. If you’re using a service like AWS SES from code, ensure auth re-connection happens automatically on each send.

You can verify your entire email list for accuracy and delivery readiness before sending — catching issues like invalid domains or syntax errors before you reach the SMTP layer. Bulk verification helps you isolate list errors from auth failures.

For deeper insight into SMTP delivery patterns, refer to the SMTP RFC 5321 — it defines the protocol flow, including how authentication is handled at the session start.

How can you prevent this issue using AWS SDK best practices?

Reconnect your SMTP session before every send, store only your AWS credentials (not the SASL token), use GetSendRawEmailEndpoint to fetch fresh credentials before sending, and refresh your token if it's over 10 minutes old. This stops 535 auth failures caused by expired SASL tokens, especially in long-lived connections.

Build reliable SMTP flows with session discipline

  • Never keep an SMTP connection open across long intervals—reconnect before each send to ensure fresh authentication.
  • AWS SES invalidates SASL tokens after 15 minutes; waiting longer than that guarantees auth failures.
  • Store only your AWS access key ID and secret, not the token. Tokens are ephemeral and should never be persisted.

Fetch credentials dynamically, not statically

  • Call GetSendRawEmailEndpoint before every outbound email. This returns a new, valid endpoint and temporary credentials including a fresh SASL token.
  • Check the timestamp of your last credential use. If more than 10 minutes have passed, trigger a new fetch—well before expiration.
  • For production systems, use AWS’s official SDKs (like the AWS SDK for JavaScript or Python) which include built-in session management for raw email sends.
  • Consult the AWS SES documentation for proper credential flow, including how SES handles authentication.

Let’s be clear: your code shouldn’t assume a connection is still valid after minutes of inactivity. That’s not just bad practice—it’s the root cause of 535 errors you’ll see in logs.

If you're managing a large email list, verify your addresses before sending to avoid hitting these limits. A bulk list of invalid or outdated emails not only triggers auth issues but also harms deliverability. Use bulk verification to clean your list beforehand and catch dead domains early.

How does email list quality affect SMTP authentication reliability?

Bad email lists amplify SMTP auth issues like expired SASL tokens because invalid or role-based addresses trigger repeated authentication attempts. Each failed connection consumes a slot and increases retry load, which can hit AWS SES throttling faster—even if your credentials are correct. Cleaning your list upfront eliminates these false positives and prevents auth failures from being mistaken for system problems.

Invalid or role accounts create phantom auth failures

You might not realize it, but sending to 20% invalid or role accounts (like admin@, postmaster@, or sales@) can silently degrade your SMTP session reliability. These addresses often don’t respond to SMTP handshakes, which makes the server think the auth attempt failed—even if your SASL token is valid. The result? AWS SES logs the connection as unsuccessful, adding to your failure count and risking throttling.

Let’s say you send to 10,000 email addresses. Even if only 10% are invalid, that’s 1,000 failed connections. Each one ties up a session, forces retries, and eats into your daily send quota. If your list contains many of these, you may hit rate limits well before your actual capacity. This isn’t a misconfiguration—it’s a symptom of poor list hygiene.

Verification tools catch these issues before they impact sending. By filtering out invalid, role, or disposable emails, you reduce unnecessary connections. This means fewer failed auth attempts, less retry load, and a lower risk of exhausting your AWS SES quotas due to repeated timeouts.

A real-time verification process like the one offered by bulk email validation identifies problematic addresses before you send. You avoid exposing the full surface area of your connection pool to addresses that would fail anyway. This isn’t about hiding errors—it’s about sending only to addresses that can actually receive email.

According to AWS’s own documentation, throttling in SES is based on the rate of failed connections and timeouts. AWS SES troubleshooting guidelines emphasize reducing failed deliveries as a key mitigation for throttling. The same logic applies to auth failures—they’re just another form of failed delivery.

By verifying your lists first, you stabilize your SMTP sessions and isolate real auth problems (like expired tokens) from noise. That clarity makes debugging much faster—when a failure happens, you know it’s actually a credential issue, not a list problem.

How can EmailListChecker.io help identify issues that compound SMTP auth failure?

You can prevent SMTP 535 auth failures by ensuring your email list only contains valid, deliverable addresses. EmailListChecker.io reduces unnecessary authentication attempts by filtering out invalid, role-based, or disposable emails before sending. It also checks for reputation risk and inbox placement issues, helping you identify whether failed deliveries stem from authentication problems or broader sender reputation or content concerns.

Preventing wasted SMTP sessions with bulk verification

Every time you try to send to an invalid or non-existent email address, AWS SES attempts authentication — which can trigger a 535 error if the session fails, even if the root cause is a bad address, not the token itself. By running your entire list through bulk email verification, you eliminate these invalid sessions entirely, reducing strain on your AWS SES quota and preventing unnecessary auth exhaustion.

Real-time checks beyond basic syntax

Our real-time verification API performs more than just syntax validation. It checks sender reputation, flags role-based accounts (like admin@ or sales@), and identifies disposable domains — all of which can cause auth rejection or trigger inbox filtering, even if the credentials are valid. For example, many role accounts reject SMTP requests outright, regardless of SASL token freshness. Using our API helps you spot these before you send.

Inbox placement testing reveals hidden delivery blockers

Even if your SMTP credentials are correct, high-performing emails might still fail to reach inboxes. That’s why inbox-placement testing is critical. It simulates real-world delivery conditions across multiple providers and identifies whether issues stem from auth, content, or sender reputation. This helps distinguish between a 535 error caused by an expired token and one caused by a flagged sender or blocked message.

Finally, integrations with Mailchimp, SendGrid, and Klaviyo let you run pre-send validation across multiple platforms. You’re not just fixing auth problems — you're preventing the entire chain of deliverability failure. By catching issues early, you keep your sender reputation intact and avoid repeated 535 errors that aren’t about expired tokens at all.

What should you do if your AWS SES SMTP sends still fail after fixing SASL tokens?

If your AWS SES SMTP sends still fail after fixing SASL tokens, the issue likely lies beyond authentication—check DNS verification, DKIM alignment, IP reputation, and sending rate. Even with correct SASL, failures can mimic auth issues if your domain isn’t verified, DKIM isn’t set up, or your IP is blacklisted. Exceeding SES sending limits also triggers temporary throttling that looks like an auth problem. Let’s verify each layer.

Domain and DNS configuration

  • Confirm your verified domain or email address appears in the AWS SES console under "Verified identities." Unverified domains cannot send via SES SMTP.
  • Ensure DKIM is enabled for your domain in SES. This requires adding three DNS TXT records with the public keys provided by AWS. Misconfigurations here cause rejection, especially on strict mail servers.
  • Use tools like MXToolbox to validate your DKIM DNS records are published and correctly formatted. A single typo can cause rejection.

IP, rate, and reputation factors

  • Check if your sending IP address is listed on public blocklists. Use Spamhaus or similar services to look up your IP and confirm no spam flags are active.
  • Review your sending rate against AWS SES hard limits: 14 messages per second maximum, or 200,000 messages per 24 hours in the sandbox. Bursting above this triggers temporary suspension, which appears as "auth failure" in logs.
  • If you’re using a shared IP or have a history of high bounce or complaint rates, your sender reputation may have degraded. Even valid authentication fails if AWS throttles or blocks based on reputation.

These checks often resolve the confusion when SMTP 535 errors persist after SASL fixes. The key insight: auth is only one piece of deliverability. If your list has expired or invalid addresses, it can indirectly cause issues by triggering complaints or bounces. Clean your list with a bulk verification tool like bulk email verification to reduce friction in the delivery pipeline. Regular checks ensure your list stays healthy and your sender reputation remains strong.

The relationship between list hygiene and SMTP delivery reliability

Bad email lists hurt SMTP delivery not just by increasing bounces, but by forcing more connection attempts—each of which risks hitting an expired SASL token in AWS SES, especially under high volume or retry-heavy workflows. A clean list reduces total attempts, directly lowering exposure to token expiry and improving session stability.

More sends mean more chances to fail

You’re not just sending emails—you’re establishing SMTP sessions, each with authentication overhead. Every invalid address in your list forces another session, increasing the likelihood that your session will hit a token timeout before completing. The more sessions, the higher the odds that one will be interrupted by an expired SASL token during an AWS SES SDK flow.

Quality reduces risk, boosts reputation

Using a tool like bulk email verification with 98.9% accuracy can drop your total send volume by as much as 40% on average by eliminating bad addresses before the send queue. Fewer sends mean fewer sessions, fewer token renewals, and a more stable delivery flow. This consistency also supports sender reputation—fewer failed deliveries and fewer bounces reduce the chance of hitting rate limits or being flagged by receiving servers. A clean, targeted list is the foundation of reliable SMTP delivery, especially when using services like AWS SES with strict rate controls and token-based sessions.

Industry data shows that consistent sender reputation correlates strongly with inbox placement—over 85% of well-maintained lists achieve delivery rates above 90%, compared to fewer than 50% for poorly cleansed ones according to industry reports. This isn’t just about avoiding 535 errors—it’s about maintaining a stable, trusted presence with each ISP’s filtering systems.

Let’s be clear: no verification tool prevents AWS SES token expiry, but a high-quality list reduces the number of times you need to reconnect. That’s a measurable edge in reliability and efficiency. The fewer attempts, the lower the risk.

Final take: avoid overcomplicating auth when the fix is simple

SMTP 535 auth failures from expired SASL tokens aren’t caused by misconfigured credentials or broken DNS. They’re a symptom of expired session state, not a configuration error.

The fix isn’t re-entering access keys. It’s ensuring tokens are refreshed before initiating new SMTP sessions—automated and preemptive, not reactive.

Prevention is simpler than recovery

  • Use an email verification tool to eliminate invalid or problematic addresses before sending.
  • Verify lists at scale with a trusted SaaS like EmailListChecker.io to detect risky or outdated addresses early.
  • A well-verified list reduces auth failures, throttling, and delivery issues—not just from expired tokens, but from role accounts, disposable domains, and catch-all setups.

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does AWS SES SMTP use static passwords or tokens?

AWS SES SMTP uses temporary SASL tokens, not static passwords. Tokens expire after 15 minutes and must be refreshed before reconnecting.

How often can I reuse an AWS SES SMTP session before token expires?

The SASL token expires after 15 minutes. Even if you keep the session open, a new token is required after that period.

Can a 535 error mean my AWS credentials are wrong?

Not necessarily. A 535 error with expired tokens typically means the authentication attempt was made with an outdated token, not a wrong credential.

How do I get new SMTP credentials from AWS?

Use the AWS SDK to call `GetSendRawEmailEndpoint` or retrieve SMTP credentials from the SES console under 'SMTP Settings'.

Why do my email sends fail after a 10-minute delay?

The SASL token likely expired. You must refresh the credentials before reconnecting after idle periods.

Does EmailListChecker.io detect invalid SMTP credentials?

No — it verifies email addresses for validity and deliverability, not the backend credentials used to send them.

Can a high bounce rate be caused by expired SASL tokens?

Directly, no — expired tokens cause auth failures, not bounces. However, they result in failed sends that may be logged as bounces in some systems.

Is there a way to keep a single SMTP session alive without renewal?

No — AWS SES does not support persistent sessions. Each connection must authenticate with a current token.

What if my SMTP client uses connection pooling?

Connection pooling will fail if the session contains an expired token. Pooling must be avoided or token refresh must be enforced per reuse.

How accurate is EmailListChecker.io at catching invalid email addresses?

It has a 98.9% accuracy rate, verified across multiple industry benchmarks. It detects invalid, catch-all, role, and disposable addresses.

Do purchased credits on EmailListChecker.io expire?

No — credits purchased on EmailListChecker.io never expire, and you can start with 100 free verifications.

Can I integrate EmailListChecker.io with SendGrid or Mailchimp?

Yes — EmailListChecker.io integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid for seamless list validation before sending.