C# .NET4.8调用Outlook 365 SMTP发件遇5.7.57认证失败求助

问题背景 #

我有一个基于.NET 4.8的C#应用程序，用于从Outlook 365邮箱发送邮件，代码如下：

var fromAddress = new MailAddress("sendingboxname@domain.com");
var toAddress = new MailAddress("toaddress@domain.com");
using (var smtp = new SmtpClient 
{ 
    Host = "smtp.office365.com", 
    Port = 587, 
    EnableSsl = true, 
    DeliveryMethod = SmtpDeliveryMethod.Network, 
    UseDefaultCredentials = false, 
    Credentials = new System.Net.NetworkCredential("sendingboxname@domain.com", "pword") 
}) 
{ 
    using (var message = new MailMessage(fromAddress, toAddress) { Subject = subject, Body = body, IsBodyHtml = true }) 
    { 
        smtp.Send(message); 
    } 
};

运行时抛出认证异常：

System.Net.Mail.SmtpException: 'The SMTP server requires a secure connection or the client was not authenticated. The server response was: 5.7.57 Client not authenticated to send mail. Error: 535 5.7.139 Authentication unsuccessful, the request did not meet the criteria to be authenticated successfully. Contact your administrator. [MN2PR14CA0001.namprd14.prod.outlook.com 2024-01-31T14:51:46.902Z 08DC224A19943AD3]'

已完成排查：

• 发件邮箱已开启SMTP功能
• 发件邮箱已关闭双重认证
• 账号密码可正常登录outlook.office.com
• 微软官方支持未解决问题

推测原因：近期启用发件功能的账号受微软安全策略更新影响，传统SMTP认证被拦截；老账号不受该策略约束。

解决方案 #

方案1：使用应用密码替代原密码 #

部分新账号即使关闭双重认证，仍受现代认证规则限制，可生成应用密码用于SMTP认证：

1. 登录微软账号管理中心，进入安全板块
2. 找到应用密码选项（若账号支持，即使关闭双重认证也可生成）
3. 生成专用应用密码，替换代码中NetworkCredential的密码字段

方案2：迁移至Microsoft Graph API发送邮件 #

微软已逐步限制新账号的传统SMTP协议支持，推荐使用Graph API替代：

.NET 4.8实现代码

using Microsoft.Graph;
using Microsoft.Identity.Client;
using System.Collections.Generic;
using System.Threading.Tasks;

public async Task SendEmailWithGraph()
{
    // 替换为你的Azure AD应用信息
    var clientId = "YOUR_CLIENT_ID";
    var clientSecret = "YOUR_CLIENT_SECRET";
    var tenantId = "YOUR_TENANT_ID";
    var senderEmail = "sendingboxname@domain.com";
    var recipientEmail = "toaddress@domain.com";

    // 初始化认证客户端
    var confidentialClient = ConfidentialClientApplicationBuilder
        .Create(clientId)
        .WithTenantId(tenantId)
        .WithClientSecret(clientSecret)
        .Build();

    var authProvider = new ClientCredentialProvider(confidentialClient);
    var graphClient = new GraphServiceClient(authProvider);

    // 构建邮件内容
    var emailMessage = new Message
    {
        Subject = "邮件主题",
        Body = new ItemBody
        {
            ContentType = BodyType.Html,
            Content = "邮件HTML内容"
        },
        ToRecipients = new List<Recipient>
        {
            new Recipient
            {
                EmailAddress = new EmailAddress { Address = recipientEmail }
            }
        },
        From = new Recipient
        {
            EmailAddress = new EmailAddress { Address = senderEmail }
        }
    };

    // 发送邮件
    await graphClient.Users[senderEmail]
        .SendMail(emailMessage, saveToSentItems: true)
        .Request()
        .PostAsync();
}

注意：需在Azure AD中注册应用，授予Mail.Send应用权限，并安装适配.NET 4.8的Microsoft Graph SDK包。

方案3：调整租户安全策略 #

联系Office 365管理员检查租户认证策略：

• 登录Exchange admin center，进入安全 > 合规性或邮件流 > 连接器
• 确认是否启用了阻止传统认证的全局策略
• 若策略存在，将问题账号添加到例外列表，允许SMTP传统认证

内容的提问来源于stack exchange，提问作者TimA