Ghost usually stops sending mail for one of four reasons: the production mail block is missing or stale, Google is rejecting the login, the server cannot reach the SMTP port, or Gmail accepts the handoff but later filters or rejects the message. Check those in that order. Add a valid SMTP configuration to Ghost’s active production file, restart Ghost, use either smtp.gmail.com for an authenticated mailbox or smtp-relay.gmail.com for an administrator-managed Workspace relay, and then verify domain authentication and delivery logs.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Ghost uses Nodemailer underneath and sends transactional messages such as staff invitations, password resets, member signups and magic login links. A successful SMTP connection only proves that another mail server accepted the message; it does not prove that the message reached a Gmail inbox.
As an Amazon Associate I earn from qualifying purchases.
Start with the failure you can observe
Use the symptom to choose the first check instead of changing several settings at once.
| What you see | Most likely area | First check |
|---|---|---|
| Ghost reports a failed send immediately | Configuration, authentication, port or TLS negotiation | Inspect the production mail block, restart Ghost, then read the exact SMTP response. |
| The request times out or says connection refused | Firewall, blocked port, DNS or TLS negotiation | Test the selected port from the Ghost host; on Google Cloud Compute Engine, avoid port 25. |
A 530, 535 or relay-authorization error appears |
Credentials or Google policy | Use an app password where permitted, or switch to the Workspace relay method configured by an administrator. |
| Ghost says the message was sent, but Gmail never shows it | Receiving, spam filtering or domain authentication | Check MX records, Spam and quarantine, Email Log Search, and SPF, DKIM and DMARC alignment. |
| Only newsletters or high-volume sends fail | Provider limits or unsuitable transport | Review Gmail or relay quotas and consider a transactional provider such as Mailgun or Amazon SES. |
1. Verify Ghost’s production mail configuration
Mail configuration is required for a self-hosted Ghost production install. Development behavior can be misleading because a local environment may log messages or use a direct mail service while production requires an explicit SMTP transport.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Open the configuration file used by the running production instance, normally the production configuration managed by Ghost-CLI.
- Confirm that a top-level
mailobject exists and that its transport is SMTP. - Check the SMTP host, port, encryption mode, account name and password or app password character by character. Remove trailing spaces copied from a password manager.
- Set a real sender address that the account or relay is allowed to use. Make sure the configured support or newsletter address is not overriding that sender unexpectedly.
- Save the file and run
ghost restartfrom the Ghost directory. A restart is required because an already-running process can continue using the old settings.
The following illustrates the fields Ghost needs. Match the exact schema supported by your Ghost version; the values shown are examples, not credentials:
{
"mail": {
"transport": "SMTP",
"options": {
"host": "smtp.gmail.com",
"port": 465,
"secure": true,
"auth": {
"user": "[email protected]",
"pass": "app-password"
}
},
"from": "[email protected]"
}
}Do not treat a successful restart as a delivery test. Trigger a password-reset or staff-invitation email and keep the Ghost and SMTP error output available for the next step.
2. Choose the Google path your account policy supports
Direct Gmail authentication and organization-managed Google Workspace relay are different services. The correct hostname depends on who controls the sending account and the organization’s security policy.
| Sending path | SMTP host | Ports and encryption | Authentication and ownership | Best fit |
|---|---|---|---|---|
| Authenticated Gmail or Workspace mailbox | smtp.gmail.com |
Use Google’s documented SSL/TLS pairing; 465 with implicit TLS or 587 with STARTTLS are the usual choices. | Mailbox credentials, normally an app password when ordinary sign-in is not accepted. | A small site sending as one specific mailbox. |
| Workspace SMTP relay | smtp-relay.gmail.com |
Google documents ports 25, 465 and 587 with the required TLS setting. | Workspace administrator configures relay policy, approved IP addresses or account authentication, envelope-sender rules and licensing eligibility. | Managed organizations, servers with stable outbound IPs and multiple applications. |
| Dedicated transactional provider | Provider-specific | Use the provider’s SMTP hostname, port and TLS instructions. | Provider-issued SMTP credentials and domain verification. | Higher-volume or operationally separate transactional and newsletter mail. |
When direct Gmail SMTP is appropriate
Choose smtp.gmail.com when Ghost should send as one Gmail or Workspace mailbox and the account is allowed to authenticate from an application. The mailbox must be active, permitted to send, and configured with the security method Google requires. A normal account password often fails when the account has stronger sign-in controls.
When Workspace relay is appropriate
Choose smtp-relay.gmail.com when an administrator wants to authorize a server rather than store an individual mailbox password. The administrator must create the relay rule in the Workspace Admin console, decide whether to allow an IP address, require SMTP authentication, require TLS, and restrict envelope sender domains. A correct hostname alone does not grant relay permission.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Relay rejection can also result from an unapproved sending IP, a sender domain not covered by the rule, a HELO or EHLO name that violates policy, missing TLS, or an account and license policy that does not permit the selected relay configuration.
3. Correct Google authentication before changing Ghost settings
Authentication errors are not fixed by repeatedly changing the sender name or restarting Ghost. Identify which security model applies to the account.
Use an app password where Google allows it
If the mailbox uses two-step verification and Google’s guidance permits app passwords, create an app password in the account’s security settings and place that generated value in Ghost’s SMTP password field. Use the app password as a single value; do not add spaces or the label shown beside it. Google’s documented remedy for an application that cannot use the normal interactive sign-in flow is to configure an app password.
Some organizations disable app passwords. In that case, an administrator may require SMTP relay with IP allowlisting, account-based relay authentication or another approved policy. Do not paste the regular interactive account password into Ghost when the organization’s policy requires a different method.
Check account and sender permissions
- Confirm that the SMTP username is the complete mailbox address, not only the part before the at-sign.
- Confirm that the mailbox has not been suspended, forced to change its password or blocked from less-trusted application access by policy.
- Make the
fromaddress match the authenticated mailbox while testing. Add aliases only after the basic send works and the account is authorized to use them. - For relay, ask the Workspace administrator whether the Ghost server’s public IP, envelope sender domain and TLS requirement are included in the rule.
4. Check hosting and network restrictions
A timeout occurs before Google can evaluate the username or password. First test whether the Ghost host can resolve the SMTP hostname and establish a TCP/TLS connection on the selected port.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Google Cloud Compute Engine and port 25
Google Cloud Compute Engine blocks traffic on port 25. Ghost’s official cloud-mail guidance identifies this as a known issue and recommends setting the transmission port to 2525. If your configuration uses port 25 on a Compute Engine instance, change to a supported submission port such as 2525 when your provider offers it, or use a provider and port combination documented for your account.
Port 2525 is a transport workaround, not a Google Gmail requirement. It works only when the SMTP service listens on that port. For Workspace relay, use one of the relay ports Google documents and ensure the hosting network permits outbound traffic on it.
Other network checks
- Verify DNS resolution for the selected SMTP hostname from the Ghost server.
- Check cloud security groups, host firewalls and outbound egress rules.
- Ensure the port and encryption mode agree: implicit TLS expects a TLS connection immediately, while STARTTLS begins unencrypted and upgrades after the SMTP greeting.
- Check the server clock. A badly skewed clock can break certificate validation and TLS negotiation.
- Use the exact hostname supplied by Google or your provider; do not substitute a webmail URL.
5. Read the SMTP response instead of guessing
Ghost’s log entry and the remote SMTP response identify the failing layer. Preserve the complete error, including the numeric code and the server’s explanatory text.
| Response or symptom | What it usually means | Action |
|---|---|---|
| Timeout, connection refused or TLS handshake failure | Port blocked, firewall rule, DNS problem or encryption mismatch | Test DNS and outbound access, select the provider’s matching TLS mode, and avoid blocked port 25 on Google Cloud. |
530 |
Authentication or TLS is required before sending, or relay permission is missing. | Enable the required TLS mode, authenticate with the approved method, and confirm relay policy. |
535 |
Authentication credentials were rejected. | Re-enter the complete username, use an app password where supported, and check whether an administrator blocks app passwords. |
| Relay access denied or unauthorized envelope sender | The account, source IP or sender domain is outside the relay rule. | Have the Workspace administrator add the server and authorize the envelope sender, or use the mailbox path. |
| Invalid HELO/EHLO or policy rejection | The server identity or policy requirements do not match Google’s relay rules. | Check the host identity, approved IP and relay documentation; do not hide the error by changing unrelated Ghost fields. |
Google maintains an SMTP error-code reference covering invalid relay credentials, unauthorized envelope senders and HELO/EHLO problems. Compare your exact response with that reference and the Workspace administrator’s relay settings.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →6. Prove whether the problem is sending or delivery
Once the SMTP server accepts a message, Ghost has completed its handoff. If the message does not appear in Gmail, investigate receiving and filtering separately.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Verify MX records for the recipient domain
For a Google Workspace recipient domain, the domain’s MX records must point to Google’s mail servers. An incorrect, incomplete or recently changed MX set can route mail to another service even though the sender reports success. Check the authoritative DNS zone, allow for DNS propagation, and confirm that all required records are present without obsolete destinations.
Search every Gmail filtering location
- Look in Spam and any user-created filters or labels.
- Ask the Workspace administrator to check quarantine and domain-level compliance rules.
- Search Email Log Search for the recipient, sender and approximate time. The log can show acceptance, rejection, routing and delayed delivery that the recipient interface does not expose.
- Test a second recipient in the same domain and one outside it. Different results point to domain policy rather than Ghost.
Check recipient restrictions
Workspace administrators can restrict external mail, suspend accounts, enforce routing rules or block messages by content and reputation. A message accepted by the outbound SMTP server can still be quarantined or rejected later. The administrator’s log is authoritative for those decisions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Authenticate the sending domain
Use domain-based authentication when Ghost sends as your own domain rather than a consumer Gmail address. Ghost recommends SPF, DKIM and DMARC to maximize deliverability, and Google identifies these records and authenticated external SMTP as common application-mail paths.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →SPF
Publish one SPF policy for the domain that lists every service authorized to send mail. If Ghost, a form service and a dedicated provider all send mail, combine their authorized mechanisms in one record instead of publishing competing SPF records. Multiple SPF records cause a permanent error and can reduce delivery.
DKIM
Enable DKIM signing in the service that actually sends the message. Publish the selector and public key exactly as supplied, then verify that the outgoing message contains a valid signature for the visible From domain or an aligned signing domain.
DMARC
Publish a DMARC policy with a reporting address you monitor. Start with a policy appropriate to your rollout, inspect alignment reports, and tighten enforcement only after every legitimate sender passes. DMARC evaluates alignment between the visible From domain and SPF or DKIM; a technically delivered message can still fail that policy if the domains do not align.
When testing, keep the From domain, authenticated account, envelope sender and DKIM signing domain consistent. Changing all four at once makes a rejection difficult to attribute.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Respect service limits and message type
Gmail SMTP is designed around mailbox sending, not unlimited application traffic. Google’s current Gmail SMTP guidance shows a limit of 2,000 messages per day. The figure is a service limit for the documented sending path, not a promise that every account can sustain that volume or that every recipient will accept it.
Google’s SMTP relay guidance shows up to 10,000 recipients per user per day, subject to relay policy and account limits. A recipient count is not the same as a message count: one message addressed to many recipients consumes multiple recipients. Workspace administrators can impose stricter limits.
Ghost’s transactional messages and a large newsletter have different operational needs. Password resets and magic links should remain dependable even when a newsletter approaches a quota. Separate high-volume traffic or use a dedicated transactional service rather than allowing bulk sends to consume the same mailbox allowance.
9. Move to a dedicated provider when Gmail is a poor fit
Ghost’s configuration guidance documents Mailgun for transactional and bulk email and includes an Amazon SES SMTP example. A dedicated provider is sensible when Workspace policy forbids app passwords, the server’s IP changes frequently, Gmail quotas are too low, or you need provider-level event logs and bounce handling.
| Decision factor | Direct Gmail SMTP | Workspace relay | Dedicated provider |
|---|---|---|---|
| Credential model | Mailbox account and app password where supported | Administrator-managed IP, account authentication or both | Provider SMTP credentials and verified domain |
| Administrative owner | Mailbox owner and site operator | Workspace administrator | Provider account owner and site operator |
| Source-IP dependency | Usually low for authenticated mailbox submission | Often central; approved IPs may be required | Depends on provider’s authentication and account setup |
| Diagnostics | Ghost errors plus Gmail account and log data | Relay policy and Email Log Search | Provider event, bounce and suppression logs |
| Bulk-newsletter suitability | Constrained by mailbox limits and policy | Constrained by relay quotas and policy | Designed for application and bulk workflows, subject to provider approval and limits |
Changing provider does not remove the need for a valid Ghost configuration, a restart, a real sender address or domain authentication. It changes the remote SMTP service and the diagnostics available after handoff.
10. Run a controlled end-to-end test
- Restart Ghost after saving the production configuration.
- Send one password-reset or invitation message to a test mailbox you can inspect.
- Record the UTC time, recipient, From address and the complete Ghost error, if any.
- If Ghost fails before handoff, classify the error as configuration, authentication, network or TLS using the tables above.
- If the SMTP server accepts the message, search the recipient’s Spam folder and the Workspace Email Log Search before changing DNS.
- For a custom sending domain, inspect the received message’s authentication results for SPF, DKIM and DMARC alignment.
- Repeat with a second recipient only after the first path is understood. This distinguishes a Ghost-wide failure from a recipient-domain or policy problem.
Common configuration mistakes to remove
- Editing a development configuration while the production process reads another file.
- Forgetting
ghost restartafter changing credentials or the SMTP host. - Using a normal Google password where an app password or relay authentication is required.
- Choosing
smtp-relay.gmail.comwithout an administrator-created relay rule. - Using port 25 from a Google Cloud Compute Engine instance.
- Setting an envelope sender or From address outside the relay’s approved domain.
- Assuming an SMTP 250-style acceptance response guarantees inbox placement.
- Publishing multiple SPF records instead of one record containing all legitimate senders.
- Testing a high-volume newsletter before confirming that password resets and invitations work.
When to involve the right administrator
Contact the Ghost host administrator when the production file is wrong, the process was not restarted, or outbound firewall rules block the selected port. Contact the Workspace administrator when relay policy, app-password availability, approved IPs, sender domains, quarantine or Email Log Search is involved. Contact a dedicated provider only after Ghost can establish an authenticated SMTP session; otherwise the same local configuration or network problem will follow you to the new service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
