Gmail’s outgoing server is smtp.gmail.com. It accepts connections on port 587 with STARTTLS and port 465 with implicit SSL/TLS, and both require authentication with an app password or an OAuth 2.0 access token. The server settings have stayed the same. The authentication options have narrowed since 2022.
What are the Gmail SMTP settings?
Setting
Value
SMTP server
smtp.gmail.com
Port (STARTTLS)
587
Port (SSL/TLS)
465
Authentication
App password or OAuth 2.0
Username
Your full Gmail address
Sending limit (personal)
Google says you may hit a limit above 500 recipients in one email or 500 emails a day
Sending limit (Workspace)
2,000 messages per user per day (500 for trial accounts)
Workspace accounts that need more can use smtp-relay.gmail.com. Google calls it the recommended option. It authenticates by IP address, allows up to 10,000 recipients per user per day, and suits printers, scanners, and internal apps that send from a known IP range. Google documents the settings in its Workspace SMTP help article.
A typical ~/.msmtprc for port 587. In production, replace the password line with passwordeval so the app password is not stored in plain text:
account gmail
host smtp.gmail.com
port 587
tls on
tls_starttls on
auth on
user you@gmail.com
password abcd-efgh-ijkl-mnop
from you@gmail.com
logfile ~/.msmtp.log
account default : gmail
How do I create a Gmail app password?
An app password is a 16-digit passcode that replaces your account password for SMTP. Google generates it after you turn on 2-Step Verification.
Name the app, for example “SMTP script”, and click Create.
Copy the password. Google shows it once.
Use it as the SMTP password with your full address as the username.
Google says app passwords are not recommended and are unnecessary in most cases. Changing your Google password revokes them, which breaks any script that stored one.
What are the common Gmail SMTP errors?
The most frequent error today is 534 5.7.9, “Application-specific password required.” It means the account has 2-Step Verification on and the script sent the regular account password. Use an app password or OAuth instead. Google lists the codes in its SMTP error reference.
If your client hides the original response, open a raw TLS connection and read the server’s reply:
openssl s_client -connect smtp.gmail.com:465 -quiet
# Banner: 220 smtp.gmail.com ESMTP ... - gsmtp
EHLO localhost
AUTH LOGIN
# Enter base64-encoded username and password
# 235 means success, 535 5.7.8 (Username and Password not accepted) means the credentials failed
Connecting to port 587 without STARTTLS also fails. Enable STARTTLS, or switch to port 465.
Why is port 25 blocked on cloud servers?
Cloud providers block outbound port 25, the server-to-server relay port, to limit spam. Port 587 is the port for authenticated message submission (RFC 6409), and it generally is not blocked.
Google Cloud: port 25 is blocked for destinations outside your VPC network, though some projects are exempt. Ports 587 and 465 are open.
AWS: port 25 is blocked by default on EC2 and Lambda. You can request removal.
Azure: port 25 is blocked on most subscription types. Port 587 is open on all of them.
For Gmail, that means smtp.gmail.com on port 587 or 465 works from a cloud server. Google Workspace SMTP relay (smtp-relay.gmail.com) accepts ports 25, 465, and 587, so use 465 or 587 when you relay from a cloud server. If port 587 fails too, check your own firewall or security group. Sources: Google Cloud, AWS, Azure, and RFC 6409.
Is Gmail SMTP being deprecated?
Google’s Workspace help page still documents smtp.gmail.com on ports 465 and 587 with app-password authentication. What Google ended for Workspace accounts is Less Secure Apps access.
Date
What happened (Workspace accounts)
June 15, 2024
Less Secure Apps settings removed from the Admin console and can no longer be changed
September 30, 2024
Original cutoff date
October 15, 2024
Google paused the rollout for the remainder of the year, then resumed it January 27, 2025
February 12, 2025
Google’s update set March 14, 2025
May 1, 2025
Final date, set in Google’s April 29, 2025 update: Less Secure Apps no longer supported
Source: Google’s announcement. For apps without OAuth, the announcement says to switch to an app that offers OAuth or create an app password.
Why is OAuth the better path for new projects?
An app password gives full SMTP access to anyone who holds it, and you cannot limit it to specific actions. OAuth 2.0 lets you request only the scopes you need, and access tokens are short-lived, typically about an hour. The cost is implementation work: consent screens, token storage, refresh handling, and Google’s app verification for production apps. A script that only needs to send mail can skip all of it.
How do I send mail without configuring SMTP?
The Nylas CLI sends through the Nylas API, so there is no SMTP host, port, or app password in your code.
brew install nylas/nylas-cli/nylas
nylas init
# Send, with no SMTP settings
nylas email send --to recipient@example.com --subject "Sent without SMTP" --body "Hello"
# Non-interactive, for cron jobs
nylas email send --to ops@company.com --subject "Deploy complete" --body "Build #1847 deployed" --yes
Connecting a Gmail account opens a browser for Google’s OAuth consent, so do that step once on a machine with a browser. Credentials are stored in the system keyring, and Nylas handles token refresh. The same commands work for Outlook, Exchange, Yahoo, iCloud, and IMAP accounts. If your product sends from your customers’ own Gmail accounts, the Nylas Email API handles OAuth, token refresh, and sending across providers behind one integration, so you do not maintain Google-specific code. See the full Gmail SMTP guide and the guide to sending email from Python without SMTP.
Frequently asked questions
What are the Gmail SMTP server and port settings?
The server is smtp.gmail.com. Use port 587 with STARTTLS or port 465 with implicit SSL/TLS. The username is your full Gmail address, and authentication is an app password or an OAuth 2.0 access token.
How do I authenticate to Gmail SMTP from a headless server or VM?
Create an app password once at myaccount.google.com/apppasswords on any device, after turning on 2-Step Verification. Then use it as the SMTP password on the server, with your full address as the username. OAuth is the other option and needs more setup.
How do I send an email from a bash script or cron job without SMTP settings?
Use an API-based CLI. With the Nylas CLI, run nylas email send with --to, --subject, and --body. Add --yes to skip the prompt for non-interactive runs such as cron. No SMTP host, port, or app password is needed.
Is Gmail SMTP being deprecated?
Google’s Workspace help page still documents smtp.gmail.com on ports 465 and 587 with app-password authentication. What Google ended for Workspace accounts is Less Secure Apps access, which was no longer supported as of May 1, 2025.
What does the Gmail SMTP error 534 5.7.9 mean?
It means an application-specific password is required. The account has 2-Step Verification on, and the script sent the regular password. Switch to an app password or OAuth. A 535 5.7.8 reply means the username and password were not accepted.
What are the Gmail SMTP sending limits?
For Workspace, the limit is 2,000 messages per user per day (500 for trial accounts). For personal accounts, Google says you may hit a limit above 500 recipients in one email or 500 emails a day. smtp-relay.gmail.com allows up to 10,000 recipients per user per day.
Why is SMTP port 25 blocked on cloud servers?
Port 25, the server-to-server relay port, is blocked by default on AWS and on Google Cloud (for destinations outside your VPC network), and on most Azure subscription types. Port 587, used for authenticated submission, generally is not blocked. If 587 fails, check your own firewall or security group.
Email and Contacts API 
Calendar API & Scheduler 
Notetaker API 
Agent Accounts 
Sales & CRM 
Recruiting & ATS 
Healthcare
Financial
Legal
Real Estate
Education
Field Services
Docs
SDKs
Guides
Integrations
API status
Changelog
Support
Professional Services
