I can’t login to my email account via Outlook. No errors are shown, the window with login and password pops up again and again. Please help!

That was a recent support request that we received in our Outsourced Technical Support helpdesk for Web Hosts.

On checking the server logs, we saw the error “SASL login authentication failed: generic failure“.

Today, let’s see the top causes for this error and how we fix them.

What is SASL?

Before seeing the details of the error, we’ll first understand about SASL.

Simple Authentication and Security Layer (SASL) is a method for authentication and data security in email protocols.

SASL supports various mechanisms for authentication like “PLAIN“, “shared secret“, etc.

The PLAIN mechanism works by transmitting a userid, an authentication id, and a password to the server. And, the server then determines whether that is an allowable triple.

Only when this is successful, server allows further transaction of email data.

What causes “SASL login authentication failed: generic failure” ?

Now that we have an idea about SASL, let’s check the causes for the error.

This error mainly happens when the SMTP authorization does not work, even with valid email login credentials. As a result, in a Postfix server, the exact lines in the log file read as :

Sep 26 13:39:58 mail postfix/smtpd[11102]: warning: SASL authentication failure: Password verification failed

Sep 26 13:39:58 mail postfix/smtpd[11102]: warning: unknown[x.x.x.x]: SASL PLAIN authentication failed: generic failure

Mostly, this is a result of bad configuration of the SASL plugin. Additionally, this happens when trying to send emails using the secure ports like 465, 587, etc. with SSL/TLS.

How to fix “SASL login authentication failed: generic failure”?

In Postfix, the error happens due to wrong configuration of TLS in /etc/postfix/master.cf file.

To ensure that the mail server accepts no mail without TLS encryption, we need to tweak a variable called “smtpd_enforce_tls“.

So to fix the error, our Support Engineers first take a backup of the configuration file. And, then set the value as  “smtpd_enforce_tls = yes” in the /etc/postfix/master.cf file.

After the edit, the entries will look like :

# grep 'submission' /etc/postfix/master.cf
192.0.2.2:submission inet n - y - - smtpd -o smtpd_enforce_tls=yes

Additionally, we ensure that the sasl config file contains no incorrect data.

In RedHat servers, the file is at /usr/lib64/sasl2/smtpd.conf and in Debian or Ubuntu servers, it is at  /etc/postfix/sasl/smtpd.conf

Altogether, these changes fixes the error and customers will be able to send mails fine.

Conclusion

“SASL login authentication failed generic failure” error mainly happens due to wrong configuration of authentication mechanism in mail server. Today, we’ve seen the causes for the error and how our Support Engineers fix it.