The Gmail SMTP server is smtp.gmail.com. Use port 587 with STARTTLS or port 465 with SSL/TLS, your full Gmail address as the user name, and an app password, or OAuth 2.0, instead of your normal password. That is enough to send mail from an application, a website or a printer through a Gmail or Google Workspace account. This guide gives the settings, code examples, the common errors and how to fix them, the sending limits to expect, and the point at which a dedicated sending service is the better choice.
Gmail SMTP settings
| Setting | Value |
|---|---|
| Outgoing server (SMTP) | smtp.gmail.com |
| Port with STARTTLS | 587 |
| Port with SSL/TLS | 465 |
| Security | STARTTLS on 587, SSL/TLS on 465. Choose one pair |
| Authentication | Required |
| User name | Your full email address, such as [email protected] or [email protected] for Google Workspace |
| Password | An app password, or OAuth 2.0 sign-in. Not your normal account password |
Google changes account rules from time to time, so check Google's current help pages if a setting stops working. The values above have been the long-standing defaults, and the explanation of ports and security in our guide to SMTP settings applies to them.
Why an app password is needed
Google has retired the old "less secure apps" option, which let programs sign in with a normal password. Programs now sign in with either an app password, a 16-character password generated for one app, or OAuth 2.0, where the app receives a token instead of your password. App passwords require 2-Step Verification to be on for the account. To create one, turn on 2-Step Verification in your Google Account security settings, open the App passwords page, name the app, and copy the password shown. Store it as a secret, never in your code or repository. If your organisation has Google Workspace, an administrator may restrict app passwords, in which case you need OAuth or the Workspace SMTP relay service.
Sending from code with Gmail SMTP
# Python
import smtplib, ssl
from email.message import EmailMessage
msg = EmailMessage()
msg["From"] = "[email protected]"
msg["To"] = "[email protected]"
msg["Subject"] = "Test"
msg.set_content("Sent through smtp.gmail.com")
ctx = ssl.create_default_context()
with smtplib.SMTP("smtp.gmail.com", 587) as s:
s.starttls(context=ctx)
s.login("[email protected]", "YOUR_APP_PASSWORD") # load from an environment variable
s.send_message(msg)// Node.js with Nodemailer
const transporter = nodemailer.createTransport({
host: "smtp.gmail.com",
port: 465,
secure: true, // SSL/TLS on 465
auth: { user: process.env.GMAIL_USER, pass: process.env.GMAIL_APP_PASSWORD }
});See our Nodemailer guide for a complete example, including attachments and error handling.
Common Gmail SMTP errors and fixes
| Error | Likely cause | Fix |
|---|---|---|
| 535 5.7.8 Username and Password not accepted | Wrong password, a normal password used where an app password is needed, or the wrong user name | Use the full address and a newly created app password |
| 534 5.7.9 Application-specific password required | 2-Step Verification is on and a normal password was used | Create and use an app password |
| 530 5.7.0 Must issue a STARTTLS command first | Encryption was not started | Enable STARTTLS on 587, or use SSL/TLS on 465 |
| Wrong version number (SSL error) | SSL/TLS mode on port 587, or STARTTLS on 465 | Match the port and the security mode |
| Connection timed out | A firewall or host blocks the port | Try the other port; check network rules |
| Daily sending quota exceeded | The account hit its daily limit | Wait, reduce volume or use a sending service |
| Mail goes to spam or shows "via gmail.com" | Authentication and From address do not line up with your domain | Send from the authenticated account, and check SPF, DKIM and DMARC |
Our article on SMTP connection, timeout and TLS troubleshooting goes through connection problems in more detail, and SMTP error codes explains the codes.
Gmail sending limits
Gmail and Google Workspace limit how much one account may send in a day, and the limits differ between personal and Workspace accounts. Google documents the current numbers, and they are measured in hundreds to a few thousand recipients per day, not tens of thousands. If you pass the limit, further sending is paused for a period. Google can also restrict accounts that send in patterns that look like bulk or automated mail. Check Google's Gmail sending limits page for the numbers that apply to you, and plan so that you stay well within them.
The From address and what recipients see
Gmail sends as the authenticated account. If you set a different From address in your application, Gmail may replace it with your account address, unless you have added that address as an alias under "Send mail as". For a Gmail.com account, messages are signed by Google, so DKIM aligns with gmail.com. For a custom domain on Workspace, you need to set up DKIM for your own domain in the Workspace admin console for the messages to align with your domain. Read our DKIM guide and DMARC alignment for the reasons.
Google Workspace SMTP relay
Google Workspace also offers an SMTP relay service, at smtp-relay.gmail.com, for sending from devices and applications inside an organisation. It can authenticate by IP address, and has its own rules and limits, set by administrators. It suits internal systems such as scanners and business applications. Check the Workspace admin documentation for how to enable it.
When Gmail SMTP is the wrong tool
Gmail SMTP is convenient for testing, scripts and small internal systems. It is a poor fit for a product that sends customer email. It has daily limits, it does not provide the delivery logs and event webhooks that applications need, it does not manage bounces and suppression for you, and a problem with the account can stop all your mail at once. It also mixes your product email with a person's mailbox. If your application sends receipts, password resets or campaigns, move to a sending service. See SMTP servers vs SMTP services and our SMTP relay, and WordPress contact form SMTP setup if you run a WordPress site.
Keep secrets out of code. Put app passwords and OAuth tokens in environment variables or a secrets manager, rotate them if they leak, and never commit them to a repository. See API key security and rotation.
Setting up Gmail SMTP in common applications
Most applications ask for the same five values: server, port, security type, user name and password. In a mail client or printer, enter smtp.gmail.com, choose STARTTLS for port 587 or SSL/TLS for port 465, tick the box for authentication, type your full address, and paste the app password. In a WordPress plugin, the form fields have the same names, and the plugin usually offers a test button that sends a message to you. In a framework such as Laravel, Django or Rails, the same values go into environment variables that the framework reads at start-up. Whatever the tool, the settings do not change, and only the place where you type them does.
If a tool offers a "Gmail" preset, it normally fills in the server and port for you, and then asks only for the address and the app password. If it offers a Google sign-in button, that is OAuth, and it avoids storing a password at all. Prefer OAuth when you can, because a token can be revoked for one app without changing any password, and because it works in organisations that have turned app passwords off.
A short checklist when sending fails
- Confirm that 2-Step Verification is on and that you are using a freshly created app password, with no spaces copied by mistake.
- Use the full address as the user name, not only the part before the @ sign.
- Match the port and security mode: 587 with STARTTLS, or 465 with SSL/TLS.
- Try from another network. Some hosting companies and home networks block outgoing SMTP ports.
- Read the full error text. The numeric code in the first line usually names the cause.
- Check whether Google sent a security alert to the account's owner, since a sign-in from a new server can be held until the owner approves it.
Security habits that matter
An app password gives full sending access to the mailbox, so treat it like a password. Create one password for each application, name each one clearly, and delete it when the application is retired. If you ever paste a password into a chat, a ticket or a public repository, revoke it at once and create a new one. Never share a personal mailbox's credentials among a team. A shared mailbox or a sending service gives each system its own credentials, which you can remove without affecting anyone else.
Outgrowing Gmail SMTP? Tell us what your application sends and how often, and we will help you move to an authenticated relay with logs and bounce handling.
References and further reading
Frequently asked questions
What are the Gmail SMTP settings?
Use smtp.gmail.com as the server, port 587 with STARTTLS or port 465 with SSL/TLS, authentication on, your full Gmail address as the user name, and an app password or OAuth 2.0 instead of your normal password.
Why does Gmail SMTP say Username and Password not accepted?
Usually the wrong password is in use, a normal password where an app password is required, or the user name is not the full address. Create an app password after turning on 2-Step Verification and try again.
Do I need an app password for Gmail SMTP?
For most accounts, yes, or you must use OAuth 2.0. Google has retired the old less secure apps option. App passwords require 2-Step Verification.
How many emails can I send with Gmail SMTP?
Google sets daily sending limits that differ between personal and Workspace accounts and are measured in hundreds to a few thousand recipients per day. Check Google's current documentation for the numbers that apply to you.
Is Gmail SMTP good for sending application email?
It suits testing, scripts and small internal systems. For customer email such as receipts and password resets, a sending service gives higher limits, delivery logs, webhooks and bounce handling.