What are the Gmail SMTP server settings, and how do app passwords work?

Gmail's SMTP server lets a mail app, website, script or device send mail through a Gmail or Google Workspace account. The settings haven't changed in years, but how you sign in has: Google turned off plain username-and-password access for third-party apps in 2025, so most "it suddenly stopped working" problems are really authentication problems. This guide gives the exact settings, how app passwords work, when to use something else, and what each Gmail error means, as Google documents them at the time of writing (November 2026).

What are the Gmail SMTP settings?

The Gmail SMTP server is smtp.gmail.com, on port 465 with SSL or port 587 with TLS (STARTTLS), with authentication required. These values come from Google's POP setup page and its Workspace page on sending from a printer, scanner or app:

Port 465 and port 587 are equally secure when the app is set up correctly. The difference is when encryption starts: on 465 the connection is encrypted from the first byte, and on 587 the app upgrades a plain connection with STARTTLS. RFC 8314 prefers implicit TLS (465) for new setups. Match the encryption type to the port: "SSL" with 465 and "TLS" or "STARTTLS" with 587. A mismatch usually makes the connection fail or time out. Our guide to SMTP ports 25, 587 and 465 explains the ports in more depth. For a WordPress site, see WordPress SMTP email setup with SPF and DKIM.

Google's Workspace page also lists port 25, but many internet providers and cloud hosts block outbound port 25, so use 465 or 587.

Example configuration

A typical website or app SMTP form, filled in for a Workspace mailbox (example values):

SMTP host:      smtp.gmail.com
Port:           587
Encryption:     TLS (STARTTLS)
Authentication: On
Username:       website@example.com
Password:       abcd efgh ijkl mnop   (app password, example only)
From address:   website@example.com

What is a Gmail app password?

An app password is a passcode Google generates so an app that can't do modern sign-in can still use your account. Google defines it as "a 16-digit passcode that gives a less secure app or device permission to access your Google Account" (Google Account Help).

Key facts from Google:

• It needs 2-Step Verification. "App passwords can only be used with accounts that have 2-Step Verification turned on."
• It bypasses 2-Step Verification. Google's Workspace admin page says plainly: "App passwords bypass 2SV" (Google). Anyone holding it can send as you without a second factor.
• It's revoked when you change your password. Every app using one needs a new app password afterwards.
• Google discourages it. App passwords "aren't recommended and are unnecessary in most cases." If the app offers Sign in with Google, use that.

How do you create a Gmail app password?

Create a Gmail app password on your Google Account's App passwords page, after turning on 2-Step Verification. Step by step:

1. Turn on 2-Step Verification for the account if it isn't already on.
2. Go to myaccount.google.com/apppasswords and sign in.
3. Give the app password a name you'll recognize later, such as "Office scanner" or "Website contact form".
4. Copy the passcode Google shows and paste it into the app's password field.
5. Send a test message, then check it arrived with authentication passing (the Deliverability Test shows SPF, DKIM and DMARC results).

If the option isn't there, Google lists three reasons: the account has 2-Step Verification "set up only for security keys", you're "logged into a work, school, or another organization account", or the account has "Advanced Protection". In Google Workspace, Google says "enforcing security keys disables app passwords" (Google).

Create one app password per app or device, so you can revoke one without breaking the rest. When you retire a device or suspect a leak, revoke its app password on the same page.

Why did Gmail SMTP stop working with my normal password?

Gmail SMTP stopped working with a normal password because Google ended "less secure app" sign-in for third-party apps in 2025. Google's transition page lists March 14, 2025 as the date access to less secure apps "will be turned off for all Google Accounts", when CalDAV, CardDAV, IMAP, SMTP and POP "will no longer work with legacy passwords (basic authentication)." Its printer and scanner page gives a different date: "Starting May 1, 2025, Google Workspace accounts no longer support less secure apps", meaning apps or devices that sign in with a username and password. Google points to its Workspace Updates blog for exact dates; either way, both dates have passed.

Your options now:

For Workspace devices, Google recommends the relay; our Google Workspace SMTP relay guide covers setup. For a scanner that can't do OAuth, the relay with IP authentication avoids storing any user's credentials on the device. Google warns that "Older scanners or printers might not support OAuth" and that such devices might not support sending email at all.

What are the Gmail SMTP sending limits?

Gmail SMTP sending limits depend on the account. Google's Workspace page says that for the Gmail SMTP server "the sending limit is 2,000 messages per day." For personal Gmail, Google's sending limits page says you'll see "You have reached a limit for sending mail" after more than 500 recipients in a single email or more than 500 emails in a day, and that you should be able to send again "within 1 to 24 hours."

These limits make Gmail SMTP a poor fit for newsletters or bulk notifications. Bulk mail to Gmail users also has to meet Gmail, Yahoo and Microsoft bulk sender requirements. For limits across both major platforms, see email sending limits in Microsoft 365 and Google Workspace.

What do Gmail SMTP errors mean?

Most Gmail SMTP errors are sign-in or encryption problems, and Google lists each one on its Gmail SMTP errors and codes page:

Paste the full error into the SMTP Error Code Lookup for more detail; the 535 5.7.8 and 530 5.7.0 pages cover the general versions of the first and fourth codes.

Is it safe to use an app password?

An app password is acceptably safe for one trusted device or app, but it's a long-lived secret that skips 2-Step Verification, so treat it like a key. If someone steals it from a website config file, a backup or a scanner's web panel, they can send mail as you, which is exactly what attackers want from a compromised account.

Reduce the risk:

1. Use a dedicated mailbox for the app, such as scanner@ or website@, not a person's mailbox.
2. One app password per app, named clearly, so you can revoke one without breaking others.
3. Prefer OAuth or the relay where you can. Admins should plan for app passwords to stop working if they enforce security keys for 2-Step Verification.
4. Review and revoke regularly. Workspace admins can revoke a user's app passwords on the user's Security page in Directory > Users, and should during compromised account recovery.
5. Keep SPF, DKIM and DMARC right. Mail sent through smtp.gmail.com leaves from Google's servers; check that your domain's SPF includes Google with the SPF Checker and see SPF for Google Workspace.

Next steps

1. Check whether your app or device supports Sign in with Google; if it does, remove the app password.
2. For Workspace printers and servers, move to the SMTP relay with IP authentication.
3. List every app password in use, revoke any nobody can explain, and record the rest.
4. Protect the inbound side too. iBlockSpam filters spam, phishing and malware at the MX before it reaches Gmail; see how it works with Google Workspace.

Browse our other setup guides.