迁移Gmail SMTP至Sendinblue发信报5.7.0认证错误怎么办

谷歌停用*Less secure apps（低安全性应用）*功能后，Gmail SMTP发信门槛大幅提高，因此将邮件发送服务迁移至Sendinblue SMTP服务。
迁移后发信持续报错：

SMTP服务器需要安全连接，或客户端未通过身份验证，服务器响应为：5.7.0 Authentication required（需要身份验证）
原有对接Gmail SMTP的代码可正常运行，调整多种写法后问题仍复现，原代码如下：

private void SendEmail()
{
  MailMessage message = new MailMessage();
  SmtpClient smtpClient = new SmtpClient("smtp-relay.sendinblue.com");
  message.From = new MailAddress("winrest_mail_service@winrest32.com");
  message.To.Add("sales@abspos.com");
  message.Subject = "NEW LICENCE REQUEST FROM " + ((User) this.Session["User"]).Name;
  message.Body = "LICENCE DEATIL" + Environment.NewLine + "SELLER = " + ((User) this.Session["User"]).Name + Environment.NewLine + "ID = " + this.TextBox__id.Text + Environment.NewLine + "NAME = " + this.TextBox__register_nam.Text + Environment.NewLine + "ADDRESS = " + this.TextBox__address.Text + Environment.NewLine + "LIC = " + this.TextBox__licence.Text + Environment.NewLine + "PDA = " + this.TextBox__pda.Text + Environment.NewLine + "CONTACT = " + this.TextBox__contact.Text + Environment.NewLine + "PHONE = " + this.TextBox__phone.Text + Environment.NewLine + "EMAIL = " + this.TextBox__email.Text + Environment.NewLine + "EXP = " + this.Calendar.SelectedDate.ToShortDateString() + Environment.NewLine + "AD SCREEN = " + this.CheckBox__AdScreen.Checked.ToString() + Environment.NewLine + "Biometrics = " + this.CheckBox__Biometrics.Checked.ToString() + Environment.NewLine + "Debit = " + this.CheckBox__Debit.Checked.ToString() + Environment.NewLine + "Draft = " + this.CheckBox__DraftControl.Checked.ToString() + Environment.NewLine + "KitchenScreen = " + this.CheckBox__KitchenScreen.Checked.ToString() + Environment.NewLine + "LiquorControl = " + this.CheckBox__LiquorControl.Checked.ToString() + Environment.NewLine + "WinAuthorize = " + this.CheckBox__WinAuthorize.Checked.ToString() + Environment.NewLine + "Lite = " + this.CheckBox__Lite.Checked.ToString() + Environment.NewLine + "CashNoBill = " + this.CheckBox__DisableCashNoBill.Checked.ToString();
  smtpClient.Port = 587;
  smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential("mike@notrealcredentials.com", "XSnfc213213216");
  smtpClient.EnableSsl = true;
  smtpClient.Send(message);
}

注：代码中凭证信息已做脱敏处理。

5.7.0报错核心是身份验证未通过，代码踩了三个典型坑：

• 凭证配置顺序错误：.NET的SmtpClient默认UseDefaultCredentials属性值为true，只要不手动把这个值改成false，后面给Credentials赋的自定义值根本不会生效，请求会带着当前服务器的系统默认凭证去对接SMTP服务，直接被服务商拒绝。
• TLS协议版本不匹配：Sendinblue SMTP服务要求TLS 1.2及以上版本的加密连接，老版本.NET框架默认启用的TLS版本为1.0/1.1，即使开了EnableSsl，加密握手不符合要求也会触发验证失败。
• 发件人地址未授权：代码里配置的发件人地址是winrest_mail_service@winrest32.com，但SMTP登录用的账号是mike@notrealcredentials.com，Sendinblue要求发件人地址必须是当前账号下完成域名/邮箱验证的地址，和登录账号不匹配的发件人会直接被拦截验证请求。

调整后的可正常运行的代码如下，替换成自己的真实凭证和已验证的发件人地址即可：

// 配置支持的TLS版本，放在应用启动入口全局配置一次即可，不用每次发信都写
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13;

private void SendEmail()
{
  MailMessage message = new MailMessage();
  SmtpClient smtpClient = new SmtpClient("smtp-relay.sendinblue.com");
  // 必须先关闭默认凭证，再赋值自定义凭证，顺序不能调换
  smtpClient.UseDefaultCredentials = false;
  smtpClient.Credentials = new NetworkCredential("你的Sendinblue账号邮箱/有SMTP权限的API密钥", "对应SMTP密码/API密钥值");
  smtpClient.Port = 587;
  smtpClient.EnableSsl = true;
  
  message.From = new MailAddress("你在Sendinblue后台完成验证的发件人邮箱地址");
  message.To.Add("sales@abspos.com");
  message.Subject = "NEW LICENCE REQUEST FROM " + ((User) this.Session["User"]).Name;
  message.Body = "LICENCE DEATIL" + Environment.NewLine + "SELLER = " + ((User) this.Session["User"]).Name + Environment.NewLine + "ID = " + this.TextBox__id.Text + Environment.NewLine + "NAME = " + this.TextBox__register_nam.Text + Environment.NewLine + "ADDRESS = " + this.TextBox__address.Text + Environment.NewLine + "LIC = " + this.TextBox__licence.Text + Environment.NewLine + "PDA = " + this.TextBox__pda.Text + Environment.NewLine + "CONTACT = " + this.TextBox__contact.Text + Environment.NewLine + "PHONE = " + this.TextBox__phone.Text + Environment.NewLine + "EMAIL = " + this.TextBox__email.Text + Environment.NewLine + "EXP = " + this.Calendar.SelectedDate.ToShortDateString() + Environment.NewLine + "AD SCREEN = " + this.CheckBox__AdScreen.Checked.ToString() + Environment.NewLine + "Biometrics = " + this.CheckBox__Biometrics.Checked.ToString() + Environment.NewLine + "Debit = " + this.CheckBox__Debit.Checked.ToString() + Environment.NewLine + "Draft = " + this.CheckBox__DraftControl.Checked.ToString() + Environment.NewLine + "KitchenScreen = " + this.CheckBox__KitchenScreen.Checked.ToString() + Environment.NewLine + "LiquorControl = " + this.CheckBox__LiquorControl.Checked.ToString() + Environment.NewLine + "WinAuthorize = " + this.CheckBox__WinAuthorize.Checked.ToString() + Environment.NewLine + "Lite = " + this.CheckBox__Lite.Checked.ToString() + Environment.NewLine + "CashNoBill = " + this.CheckBox__DisableCashNoBill.Checked.ToString();
  
  smtpClient.Send(message);
  // 释放资源，避免端口占用
  smtpClient.Dispose();
  message.Dispose();
}

• 确认Sendinblue后台已经完成发件人域名的SPF、DKIM配置验证，未验证的域名无法作为发件人发信
• 如果使用API密钥作为SMTP登录凭证，要确认密钥已开启SMTP发送权限，不要直接用账号前台登录密码
• 确认部署服务的服务器出站防火墙没有拦截587端口的TCP出站请求

内容的提问来源于stack exchange，提问作者markymarc1981