Exact response pattern
538 5.7.11 Encryption required for requested authentication mechanismPermanentGenericTLS
What it means
The server refuses authentication until a protected TLS channel is established.
Likely causes
- AUTH attempted before STARTTLS.
Recommended response
- Enable STARTTLS or use implicit TLS on the correct port.
- Validate certificates and protocol support.
Operational rule: Preserve the complete SMTP response, remote hostname, sending IP, envelope sender and timestamp. Never diagnose from the three-digit code alone.