handling of communication between Application and Domain layers in DDD

I'm trying for the first time to implement DDD to build an application. I have decided to land my little knowledge on the code to generate a structure that I like and keep clean, for the implementation I have started with the context of user management (authentication, registration, password recovery, password change, etc).

To expose my doubt I will take as an example the case in which a user authenticates in the application using his mail and his password.

For that case, the basic responses are:

• Correct authentication, must return the authenticated user's data.
• Incorrect authentication, the email entered does not exist.
• Incorrect authentication, the password entered is not correct.

To make this case, I created an application service called LogInUserWithEmailService. This uses a domain service called AuthenticationService that knows how to authenticate a user as the case may be.

Therefore in my application layer I have a LogInUserWithEmailService that receives a DTO with the request, then I call AuthenticationService that is inside my domain layer and he is the one who does the management.

In reaching this situation I have encountered a problem, I need my authentication service can return user data or error messages as appropriate. In addition to communicating errors of internal validation of the fields, such as the length of the password, that the email is a valid email, etc.

To get out of that problem, I opted for the simple, return the user if it is correct and send it out in the form of DTO from the application layer. And throw specific exceptions for each error, which I catch in the application layer and add the more natural message next to a code to throw it out.

The problem is that you should not be throwing exceptions for those cases. And I do not know in what way I should communicate the answer to my application layer. I thought I could do it using simple DTO to pass the data between layers, but I do not think it is correct since a UserDTO is not something belonging to the domain, so my domain should know nothing about any DTO, although it may be wrong in this point.

So, what would be a correct or effective way to do this? And coming from the same topic, should my domain service receive as parameter a request object, primitive types or value objects of that data (do I have value objects of password and email?