Gmail SMTP port: 587 or 465 for smtp.gmail.com

Gmail’s SMTP server is smtp.gmail.com, reachable on port 587 with STARTTLS or port 465 with implicit SSL/TLS. Both ports require authentication with an app password or an OAuth 2.0 token; Google finished removing plain-password access in May 2025. If your app sends on behalf of users, the Nylas Email API sends through their Gmail account over HTTPS with OAuth, so you don’t manage an SMTP host, a port, or an app password.

What is the Gmail SMTP port and server address?

The Gmail SMTP port is 587 with STARTTLS or 465 with SSL, and the server address is smtp.gmail.com. Google’s Gmail SMTP server setup steps say: “For SSL, enter 465. For TLS, enter 587.” Both ports require authentication with the full Gmail address and an app password or OAuth 2.0 token.

Port 587 opens a plain connection and upgrades it with the STARTTLS command, while port 465 negotiates TLS before any SMTP traffic. Both reach the same server with the same credentials, so use whichever mode your mail library supports. Google’s setup article also lists port 25 as a configuration option, but pairs 465 with SSL and 587 with TLS.

Setting	Value
SMTP server	`smtp.gmail.com`
Port (STARTTLS)	587
Port (SSL/TLS)	465
Encryption	TLS 1.2 or higher
Authentication	App password or OAuth 2.0
Username	Full Gmail address
Daily limit (personal)	500 messages
Daily limit (Workspace)	2,000 messages

Google Workspace accounts that need higher throughput can use the relay at smtp-relay.gmail.com, which supports up to 10,000 recipients per day per user and allows IP-based authentication. According to Google’s Workspace relay documentation, the relay targets printers, scanners, and internal apps sending from a known IP range.

How do you set up a Gmail app password for SMTP?

A Gmail app password is a 16-character code that replaces the account password for SMTP connections. Google generates it after you enable 2-Step Verification, and it’s currently the only password-based SMTP authentication for personal Gmail accounts: Google began shutting down “Less Secure Apps” access on September 30, 2024, and completed the removal on May 1, 2025.

Creating one takes about 3 minutes:

Confirm 2-Step Verification is on at myaccount.google.com/security.
Open myaccount.google.com/apppasswords.
Enter a name for the app and select Create.
Copy the 16-character code. It’s shown once and can’t be retrieved later.
Use it as the SMTP password; the username stays your full email address.

Google’s own guidance favors OAuth over app passwords: the September 2023 Workspace announcement directed apps that need mail access to OAuth or the Gmail API. App passwords also get revoked automatically whenever the account password changes, so any integration built on one breaks at that moment until you generate a new code.

What are Gmail SMTP sending limits?

Personal Gmail accounts can send 500 messages per rolling 24-hour window; Google Workspace accounts get 2,000. Exceeding the limit triggers a temporary rejection and suspends outbound sending for up to 24 hours, while incoming mail keeps working. Trial Workspace accounts stay capped at 500 per day until cumulative payments reach $100 USD.

Limit	Personal Gmail	Google Workspace
Messages per day	500	2,000
Recipients per message (web UI)	500	2,000 (500 external)
Recipients per message (SMTP)	100	100
Recipients per day	500	10,000
Outgoing message size (with attachments)	25 MB	25 MB

The 100-recipient SMTP cap catches scripts that worked fine in the web UI. According to Google’s Workspace sending limits, SMTP, POP, and IMAP connections are capped at 100 recipients per message regardless of account type, so larger sends need batching. Bulk senders delivering 5,000+ messages per day to Gmail recipients also need SPF, DKIM, and DMARC plus a one-click unsubscribe header, requirements Google began enforcing in February 2024.

Why does Gmail SMTP authentication fail?

Gmail SMTP authentication fails for 4 common reasons: a missing app password, wrong or revoked credentials, disabled 2-Step Verification, or too many simultaneous connections. Google returns a specific SMTP code for each case, so the error text identifies the fix.

Error code	Message	Cause	Fix
`534-5.7.9`	”Application-specific password required”	2-Step Verification is on but no app password is in use	Generate an app password
`535-5.7.8`	”Username and Password not accepted”	Wrong, expired, or revoked app password	Generate a new app password
`421-4.7.0`	”Too many concurrent SMTP connections”	More than 10 simultaneous sessions from one account	Reduce pool size, add backoff
`550-5.4.5`	”Daily sending quota exceeded”	Hit the 500 or 2,000 per day limit	Wait for the 24-hour window to reset
`530-5.7.0`	”Must issue a STARTTLS command first”	Port 587 without STARTTLS	Enable STARTTLS or switch to port 465

The most common failure is 534-5.7.9, usually from copying an older tutorial that used a regular Gmail password. Those examples stopped working when the Less Secure Apps shutdown completed in May 2025. To see the raw server response when a client hides it, test the handshake directly with swaks, which prints every SMTP exchange in about 5 seconds.

swaks --to [email protected] \
  --from [email protected] \
  --server smtp.gmail.com \
  --port 587 \
  --tls \
  --auth LOGIN \
  --auth-user [email protected] \
  --auth-password "abcd-efgh-ijkl-mnop"

How do you send Gmail without SMTP?

The Nylas Email API sends Gmail without SMTP: one POST /v3/grants/{grant_id}/messages/send request delivers mail through the connected Gmail account over HTTPS. The user signs in once with Google OAuth, and the API stores the refresh token and renews the access token, which Google expires after 3,600 seconds. There’s no port, no STARTTLS negotiation, and no app password to rotate.

The samples below send one message from a connected account. The request body is the same for Gmail, Microsoft 365, Exchange, Yahoo, iCloud, and IMAP accounts, so the code doesn’t change per provider. The curl request also turns on open, link, and reply tracking, and the Python sample attaches a file.

curl --request POST \
  --url 'https://api.us.nylas.com/v3/grants/<NYLAS_GRANT_ID>/messages/send' \
  --header 'Authorization: Bearer <NYLAS_API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "subject": "Reaching Out with Nylas",
    "body": "Reaching out using the <a href='https://www.nylas.com/products/email-api/'>Nylas Email API</a>",
    "to": [{
      "name": "Leyah Miller",
      "email": "[email protected]"
    }],
    "tracking_options": {
      "opens": true,
      "links": true,
      "thread_replies": true,
      "label": "hey just testing"
    }
  }'

import Nylas from "nylas";

const nylas = new Nylas({
  apiKey: "<NYLAS_API_KEY>",
  apiUri: "<NYLAS_API_URI>",
});

async function sendEmail() {
  try {
    const sentMessage = await nylas.messages.send({
      identifier: "<NYLAS_GRANT_ID>",
      requestBody: {
        to: [{ name: "Name", email: "<EMAIL>" }],
        replyTo: [{ name: "Name", email: "<EMAIL>" }],
        replyToMessageId: "<MESSAGE_ID>",
        subject: "Your Subject Here",
        body: "Your email body here.",
      },
    });

    console.log("Sent message:", sentMessage);
  } catch (error) {
    console.error("Error sending email:", error);
  }
}

sendEmail();

import os
import sys
from nylas import Client
from nylas import utils

nylas = Client(
    "<NYLAS_API_KEY>",
    "<NYLAS_API_URI>"
)

grant_id = "<NYLAS_GRANT_ID>"
email = "<EMAIL>"

attachment = utils.file_utils.attach_file_request_builder("Nylas_Logo.png")

message = nylas.messages.send(
  grant_id,
  request_body={
    "to": [{ "name": "Name", "email": email }],
    "reply_to": [{ "name": "Name", "email": email }],
    "reply_to_message_id": "<MESSAGE_ID>",
    "subject": "Your Subject Here",
    "body": "Your email body here.",
    "attachments": [attachment]
  }
)

print(message)

Compared with the SMTP setup above, the API handles these parts for you:

Task	Gmail SMTP	Nylas Email API
Connection	`smtp.gmail.com` on port 587 or 465	HTTPS request to the send endpoint
Credentials	App password or XOAUTH2 token you refresh	OAuth grant; Nylas refreshes the token
Safe retries	Resending can deliver duplicates	`Idempotency-Key` header prevents duplicate sends
Send outcome	SMTP reply codes per connection	`message.send_success`, `message.send_failed`, and `message.bounce_detected` webhooks

Gmail’s sending limits still apply, because the message goes out through the user’s mailbox. A throttled send returns a 429 right away; wait the number of seconds in Retry-After when the response includes it. Sending messages with Nylas documents every request field, and send email without SMTP covers attachments, CC, and reply-to handling. If you only need to send from your own Gmail account, SMTP with an app password works fine.

What’s next

Quickstart: Email API connects a Gmail account and makes a first API call in under 5 minutes.
Send email without SMTP is the full API sending walkthrough.
Outlook SMTP settings is the Microsoft equivalent of this reference.
How to handle bounced email catches the failures that SMTP error codes report.
Transactional send covers application-generated mail at volume from your own domain.
Schedule send queues messages for later delivery without a cron job.