The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →For an Omnibus GitLab server, the supported small-installation setup is Gmail mailbox SMTP at smtp.gmail.com:587 with STARTTLS and a Google app password. Edit /etc/gitlab/gitlab.rb, run sudo gitlab-ctl reconfigure, then send a test notification. If your organization manages Google Workspace, a policy-controlled smtp-relay.gmail.com configuration is usually more suitable than tying GitLab to one employee’s mailbox.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you need before changing GitLab
This procedure targets a self-hosted GitLab installation managed by the Omnibus package. You need administrator access to the GitLab host, permission to edit /etc/gitlab/gitlab.rb, and permission to run gitlab-ctl reconfigure. The server must also be allowed to make outbound TCP connections to the SMTP port selected by your Google configuration.
As an Amazon Associate I earn from qualifying purchases.
- A Gmail or Google Workspace mailbox to use as the sender, or a Workspace relay policy administered by your organization.
- Two-Step Verification enabled on a mailbox account if you intend to use an app password.
- A publicly permitted sender address and, for relay use, a registered source IP and approved sender domain.
- A firewall, cloud security group, and network egress policy that allow the selected SMTP connection.
GitLab’s documented Gmail example uses an app password rather than the mailbox’s ordinary Google password. Keep the credential out of shell history, ticket systems, Git repositories, and configuration backups that are not protected. Decide first whether GitLab should authenticate as one mailbox or as an application covered by a Workspace relay policy; many apparent GitLab errors are actually mismatches between those two designs.
Choose Gmail mailbox SMTP or Google Workspace relay
The two services solve different operational problems. Mailbox SMTP authenticates GitLab as one Gmail account. Workspace relay authorizes the server or application under an organization-wide relay policy.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Decision point | Gmail mailbox SMTP | Google Workspace SMTP relay |
|---|---|---|
| Endpoint | smtp.gmail.com |
smtp-relay.gmail.com |
| Typical encryption | STARTTLS on port 587 | Port 587 with TLS is common; Google documents ports 25, 465, and 587 |
| Authentication | Mailbox username plus an app password; an ordinary account password is not the recommended credential | Registered source IP, SMTP authentication, or another method allowed by the Workspace relay policy |
| Sender control | Generally centered on the authenticated mailbox and its permitted aliases | Controlled by the Workspace sender-domain and relay policy |
| Administration | Simple for one small installation | Requires Workspace administrator configuration, source-IP registration, and policy alignment |
| Best fit | A personal Gmail mailbox or a small, low-volume GitLab instance | An organization with managed domains, a stable egress IP, and central mail auditing |
| Published limits | Google and GitLab apply account and sending limits | Google documents 100 recipients per SMTP transaction and a 10,000-recipient-per-user-per-day relay limit |
The relay recommendation is an operational judgment based on its centralized controls; it is not a guarantee that every Workspace policy or network design will work without adjustment.
Mailbox SMTP is often easiest when the server has no fixed public identity and sends only ordinary GitLab notifications. Relay is preferable when several applications share a domain, administrators need to remove a server without changing a user password, or mail activity must be reviewed centrally. A relay also avoids making an employee’s mailbox the hidden dependency for password resets and incident notifications.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure GitLab to use a Gmail mailbox
1. Turn on Two-Step Verification and create an app password
Google defines an app password as a 16-digit passcode. Google’s Gmail Help states: “App passwords can only be used with accounts that have 2-Step Verification turned on.” Create the passcode in the Google Account security area while signed in as the mailbox that GitLab will use, and copy it when Google displays it.
App passwords may be unavailable for some work or school accounts, accounts enrolled in Advanced Protection, or accounts whose Two-Step Verification is restricted to security keys. In those cases, ask the Workspace administrator for an approved relay or OAuth-capable integration instead of trying to bypass the policy.
Changing the Google account password revokes existing app passwords. If that happens, generate a new app password and update GitLab’s configuration. Treat the passcode like a service secret: do not email it to yourself, place it in a ticket, or test it by putting it directly on a command line.
2. Edit the Omnibus configuration
Open the file as root:
sudo editor /etc/gitlab/gitlab.rbAdd or update the SMTP settings below. Replace the example mailbox and APP_PASSWORD value with the real values:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsgitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.gmail.com"
gitlab_rails['smtp_port'] = 587
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = "APP_PASSWORD"
gitlab_rails['smtp_domain'] = "smtp.gmail.com"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_tls'] = false
gitlab_rails['smtp_openssl_verify_mode'] = 'peer'Port 587 and smtp_enable_starttls_auto = true tell GitLab to begin with an unencrypted SMTP connection and upgrade it with STARTTLS. The smtp_tls = false setting prevents GitLab from treating the connection as implicit TLS on connect, which is a different mode from STARTTLS.
Do not put a normal Google account password in smtp_password. Also check the app password for characters that need quoting: GitLab warns that the value must not contain Ruby or YAML string delimiters such as an unescaped single quote. Use a correctly quoted value and protect the file and its backups from unauthorized readers.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Keep one authoritative SMTP block in the file. Duplicate assignments later in gitlab.rb can override earlier values and make troubleshooting misleading. If you use a dedicated sender such as [email protected], confirm that the address is the account that generated the app password or an alias permitted by that account; do not assume any address in the same domain will authenticate.
3. Apply the configuration
Run the Omnibus reconfiguration command:
sudo gitlab-ctl reconfigureThe command renders the Rails mail settings and restarts or reloads the components that need them. Read the command output for syntax errors before testing mail. A malformed quote or duplicate setting can prevent the intended value from being applied.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Send a test notification
Trigger a notification that GitLab normally sends, such as an invitation, a password-reset message, or a project notification. Use a recipient you can inspect, then check both the mailbox and the GitLab logs. A successful SMTP submission does not guarantee inbox placement; Google may still classify a message as spam or defer it.
Test with one or two recipients first. Confirm the visible From address, Reply-To address, subject, and links, then test a second recipient domain if your installation serves multiple organizations. This distinguishes an SMTP submission problem from filtering or quarantine at the receiving side.
Configure a Google Workspace SMTP relay
Use the relay route when Workspace administrators want GitLab to send under an organization’s mail policy rather than under one user’s mailbox. In the Google Admin console, create or edit the SMTP relay service and choose the authentication method your organization permits. Google documents source-IP authentication and SMTP authentication, with policy controls for permitted senders and domains.
Google’s policy changed for managed accounts on May 1, 2025: Workspace no longer supports less-secure third-party apps or devices that ask for a Google username and password. Integrations that previously relied on that pattern must use OAuth or an approved relay design. An IP-authenticated relay is often simpler for a fixed server, while an OAuth-capable integration is appropriate when the organization requires user or application tokens.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRelay-side requirements
- Register the self-hosted GitLab server’s public egress IP if the policy uses IP authentication. A private address inside the server’s subnet is not what Google sees.
- Authorize the sender domain and the specific envelope or From identities required by GitLab.
- Choose a port accepted by the policy. Google documents 25, 465, and 587; 587 with TLS is generally the practical choice for a host that can make authenticated outbound connections.
- Make sure the server’s HELO or EHLO name and its MAIL FROM identity satisfy the relay policy. Google’s relay error guidance specifically calls out invalid identities and sender-policy mismatches.
Record the public IP that the SMTP connection actually uses, especially when the server sits behind NAT, a cloud gateway, or a changing egress pool. If that address changes, the relay can begin returning access-denied errors even though GitLab itself has not changed. Likewise, changing the From domain without updating the Workspace rule can produce a sender rejection after TLS succeeds.
GitLab-side settings
In /etc/gitlab/gitlab.rb, use the relay hostname instead of the mailbox hostname and use the domain, From, and Reply-To values approved by the Workspace policy. A typical STARTTLS foundation is:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp-relay.gmail.com"
gitlab_rails['smtp_port'] = 587
gitlab_rails['smtp_domain'] = "example.org"
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_tls'] = false
gitlab_rails['smtp_openssl_verify_mode'] = 'peer'
gitlab_rails['gitlab_email_from'] = '[email protected]'
gitlab_rails['gitlab_email_reply_to'] = '[email protected]'The authentication lines depend on the relay policy. For IP-authenticated relay, the policy may not require a mailbox username and password. For SMTP-authenticated relay, add the credentials and authentication mode specified by the Workspace administrator. Do not copy the mailbox smtp.gmail.com settings unchanged: the endpoint, permitted identities, and authentication decision are different.
After saving the file, apply it with:
sudo gitlab-ctl reconfigureTest with a message whose From address belongs to the domain allowed by the relay. If the relay rejects it, correct the Workspace policy before changing unrelated GitLab settings.
Verify connectivity before diagnosing GitLab
When GitLab reports a mail failure, first separate network connectivity from authentication and sender-policy problems. From the GitLab host, test whether the selected port is reachable. For a STARTTLS endpoint, an OpenSSL check can show whether the server presents a certificate and accepts the TLS upgrade:
openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlfUse smtp-relay.gmail.com:587 for a relay test. A timeout or “connection refused” points to the host firewall, cloud security group, outbound egress policy, DNS, or a provider-side network restriction; it is not evidence that the app password is wrong. Do not paste credentials into an interactive SMTP session or into a command that will be retained in shell history.
A successful TLS handshake proves only that DNS, routing, the port, and certificate validation work. It does not prove that the mailbox credential is valid or that the sender domain is authorized. Keep those checks separate so that a network fix is not mistaken for an authentication fix.
Troubleshoot common GitLab Gmail errors
“SMTP authentication failed”
- Confirm that the address in
smtp_user_nameis the mailbox that created the app password. - Use the newly generated 16-digit app password, not the normal Google password. Remove accidental spaces if you copied a displayed value with formatting.
- Check that Two-Step Verification is still enabled and that the account has not entered a Google security state where app passwords are unavailable.
- If the account password was changed, generate a replacement app password because Google revokes the old ones.
- For Workspace relay, stop testing mailbox credentials and inspect the relay policy’s source-IP and SMTP-authentication requirements instead.
“Connection timed out” or “network unreachable”
- Verify DNS resolution for the configured hostname.
- Allow outbound TCP 587 in the operating-system firewall, cloud security group, and network egress controls.
- Check whether the hosting provider blocks outbound mail ports.
- Confirm that the setting uses the correct endpoint:
smtp.gmail.comfor mailbox SMTP orsmtp-relay.gmail.comfor Workspace relay.
TLS or certificate errors
- Use STARTTLS settings for port 587:
smtp_enable_starttls_auto = trueandsmtp_tls = false. - Keep certificate verification at
peer; disabling verification hides a security problem rather than fixing it. - Check the host’s clock and certificate trust store. A badly skewed clock or obsolete CA bundle can make a valid Google certificate appear invalid.
- Do not combine implicit-TLS assumptions for port 465 with a STARTTLS configuration intended for port 587.
“Relay access denied,” sender rejected, or domain not permitted
For Workspace relay, verify that the server’s public IP is registered, the sender domain is allowed, and the HELO/EHLO and MAIL FROM identities match the policy. A valid TLS connection and valid SMTP authentication can still be rejected when the sender is outside the permitted domain. Check both the envelope sender and the visible From value; they are not always identical, and a policy may evaluate either one.
Messages are accepted but do not arrive
Inspect GitLab’s Sidekiq and mail logs to establish whether the message was queued, submitted, deferred, or rejected. Workspace administrators can use Email Log Search to look for Google-side rejects, throttling, and delivery status. Also inspect the recipient’s spam or quarantine area and verify that the From address is authorized for the selected mailbox or relay policy.
If only some recipients fail, compare their domains and rejection responses rather than repeatedly changing SMTP credentials. A message accepted by Google can still be filtered by the destination organization, while a message rejected before queueing indicates a GitLab, network, authentication, or relay-policy problem.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
A message exceeds the recipient limit
Google documents a limit of 100 recipients in one SMTP transaction for smtp-relay.gmail.com. Split large recipient sets into separate messages or batches. This is a transaction limit, not permission to exceed the organization’s daily sending allowance.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Sending limits and when Gmail is the wrong transport
Google’s current Workspace guidance lists a 10,000-recipient-per-user-per-day SMTP relay limit, while its relay error guidance lists 100 recipients per SMTP transaction. These are vendor-published operational limits, not a performance benchmark or a promise of uninterrupted delivery. Account reputation, policy rules, recipient responses, and other Google controls can affect practical throughput.
GitLab’s SMTP settings documentation warns that Gmail has strict sending limits that can impair functionality as an organization grows. For a busy instance sending large volumes of pipeline, merge-request, alert, or user-notification mail, use a transactional mail service designed for application traffic, or move to an approved enterprise integration. Keep GitLab’s notification volume, retry behavior, bounce handling, and audit requirements in the capacity decision rather than treating the SMTP connection as unlimited.
Do not interpret the 10,000-recipient figure as a guaranteed daily allowance for every mailbox or relay configuration. It is a published service limit associated with the documented relay guidance. Monitor queue growth and deferred deliveries well before reaching it, and split broadcasts so that one oversized transaction does not fail the entire send.
Security and maintenance checklist
- Store the app password or relay credential only in protected configuration and secret-management systems.
- Restrict access to
/etc/gitlab/gitlab.rband configuration backups; the file contains mail credentials in clear configuration form. - Never commit
gitlab.rbto source control or paste the password into an issue, chat, or shell command. - Rotate the app password when staff access changes, when Google revokes it, or when you suspect exposure.
- For relay configurations, review registered source IPs and allowed sender domains whenever infrastructure or egress architecture changes.
- Monitor GitLab mail queues and Google Workspace Email Log Search for repeated failures, throttling, and unexpected sender identities.
- Use a dedicated mailbox or service identity rather than a personal employee account when organizational continuity matters.
When rotating credentials, generate the replacement first, update the protected GitLab configuration, run sudo gitlab-ctl reconfigure, and send a controlled test before revoking the old credential. For an IP-authenticated relay, changing credentials may be unnecessary, but changing the server’s public egress address always requires a policy review.
Which setup should you use?
Choose smtp.gmail.com:587 with an app password when one small self-hosted GitLab installation needs dependable, low-volume notifications and the account is eligible for app passwords. Choose smtp-relay.gmail.com when Google Workspace administrators need centralized policy, managed sender domains, source-IP controls, and organization-level auditing. In either case, apply the settings with sudo gitlab-ctl reconfigure, send a controlled test, and diagnose the network, authentication, sender policy, and recipient limits as separate layers.
Frequently Asked Questions
How do I configure GitLab SMTP with Gmail?
For Omnibus GitLab, enable SMTP in /etc/gitlab/gitlab.rb, set smtp_address to smtp.gmail.com, use port 587 with STARTTLS, authenticate with the mailbox address and a Google app password, then run sudo gitlab-ctl reconfigure. Send a test notification and inspect GitLab logs.
What do I put in gitlab.rb for Gmail?
Use the documented Gmail block with smtp_enable set to true, smtp_address set to smtp.gmail.com, smtp_port set to 587, smtp_authentication set to login, smtp_enable_starttls_auto set to true, smtp_tls set to false, and certificate verification set to peer. Replace the sample mailbox and app password with your values.
Should I use smtp.gmail.com or smtp-relay.gmail.com?
Use smtp.gmail.com when GitLab should authenticate as one Gmail mailbox. Use smtp-relay.gmail.com when a Google Workspace administrator will authorize the server through a relay policy using a registered public IP, SMTP authentication, or another permitted method.
Recommended Free Tools
Why does GitLab say SMTP authentication failed?
Check that the username is the mailbox that generated the app password, Two-Step Verification remains enabled, and you are not using the normal Google password. A Google account password change revokes existing app passwords. For a relay, inspect source-IP registration and relay-policy authentication instead of testing mailbox credentials.
Can GitLab send notifications through Google Workspace?
Yes. It can authenticate to a Workspace mailbox with an eligible app password, or send through smtp-relay.gmail.com under an administrator-managed relay policy. Since May 1, 2025, Workspace does not support less-secure third-party integrations that ask for a username and password; use an approved relay or OAuth-capable integration.
Why is a Gmail app password unavailable?
Google may withhold app-password access for some work or school accounts, Advanced Protection accounts, or accounts whose Two-Step Verification is limited to security keys. Ask the Workspace administrator for a relay or approved OAuth-based option rather than disabling security controls.
What ports and encryption does Google SMTP use?
Google documents ports 25, 465, and 587 for smtp-relay.gmail.com. Port 587 with STARTTLS is the common GitLab choice. Configure smtp_enable_starttls_auto = true and smtp_tls = false; do not apply implicit-TLS assumptions for port 465 to a port-587 configuration.
How many recipients can GitLab send through the relay?
Google documents 100 recipients per SMTP transaction and a 10,000-recipient-per-user-per-day relay limit. Split larger recipient sets into separate messages, and treat these as published service limits rather than throughput guarantees.
The Bottom Line
For a small Omnibus GitLab server, use smtp.gmail.com:587, STARTTLS, and a 16-digit Google app password, then run sudo gitlab-ctl reconfigure. For managed Google Workspace environments, use smtp-relay.gmail.com with an approved sender domain and registered egress identity. Keep credentials protected, test one notification, and troubleshoot connectivity, authentication, relay policy, and recipient limits independently.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
