PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMost Gmail SMTP failures come from one of two mistakes: using the wrong submission port/security mode or trying to authenticate with the account’s normal password. Configure smtp.gmail.com on port 587 with STARTTLS or port 465 with implicit SSL/TLS, use the complete Gmail or Google Workspace address as the username, and authenticate with a 16-character app password (after enabling 2-Step Verification) or with OAuth 2.0. A timeout usually points to an outbound firewall or hosting-provider block, while SMTP status codes 535 and 534 identify credential and app-password problems.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use these Gmail SMTP settings first
Enter the values below in your mail library, control panel, CMS, or application. Do not mix the security mode for one port with the mode for the other.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Setting | Port 587 | Port 465 |
|---|---|---|
| Server | smtp.gmail.com |
smtp.gmail.com |
| Transport security | STARTTLS (explicit TLS) | Implicit SSL/TLS (TLS from the first packet) |
| Authentication | Required | Required |
| Username | The full Gmail or Workspace address, including the domain | |
| Password | An app password or an OAuth 2.0 access token; the regular account password is rejected | |
| Port 25 | Not a client-submission alternative; it is intended for server-to-server relay | |
Google’s developer documentation describes XOAUTH2 this way: "The SASL XOAUTH2 mechanism enables clients to provide OAuth 2.0 credentials for authentication." The exact OAuth consent, scope, and token-exchange requirements can change, so verify them against Google’s current documentation when implementing OAuth.
Identify which layer is failing
SMTP has separate stages. A useful fix starts by locating the stage that fails instead of changing credentials at random.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- DNS: your host must resolve
smtp.gmail.comto an address. - TCP connection: the server must be allowed to open an outbound connection to port 587 or 465.
- TLS negotiation: the client and Gmail must agree on a valid TLS connection. Port 587 requires an SMTP connection first and then STARTTLS; port 465 expects TLS immediately.
- SMTP authentication: Gmail checks the address and app password or OAuth token.
- Message submission: only after authentication can the client issue the mail commands.
A failure before an SMTP banner is a network or TLS problem. A numeric 535 or 534 response means Gmail was reached and rejected the authentication attempt, so firewall changes will not solve it.
Fix the network path before changing credentials
Check DNS from the actual mail server
Run the lookup on the machine that sends mail, not on your laptop. For example:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsdig +short smtp.gmail.com
nslookup smtp.gmail.comYou should receive one or more addresses. An empty result, a resolver timeout, or a server that can resolve other names but not this one indicates a local DNS or resolver policy issue. Correct the host’s resolver configuration or ask the hosting provider to repair DNS access before testing SMTP again.
Test whether the submission ports are reachable
These tests do not authenticate or send a message; they only show whether a TCP connection and TLS handshake are possible.
nc -vz smtp.gmail.com 587
nc -vz smtp.gmail.com 465
openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf
openssl s_client -connect smtp.gmail.com:465 -crlfFor port 587, a successful test should show a connection, an SMTP banner, and a completed STARTTLS handshake. For port 465, TLS negotiation occurs immediately. A refusal, unreachable-network error, or a command that hangs until it times out means the path is blocked or the remote connection cannot be established. It does not prove that the Gmail account or password is wrong.
Check outbound policy at every hop
- Inspect the server’s egress firewall and cloud security-group rules for TCP 587 and 465.
- Check a local firewall such as UFW, firewalld, or a hosting control panel’s outbound rules.
- Ask the VPS, shared-hosting, data-center, or ISP provider whether it blocks SMTP submission ports for new or unverified accounts.
- If 587 is blocked, test 465; if 465 is blocked, test 587. Do not switch to port 25 merely to bypass a block.
- If your application runs in a container, test from inside the container or pod. A host-level test can succeed while the container’s network policy denies egress.
When a provider confirms a block, request an SMTP-submission exception and include the destination, port, and business reason. A provider may require account verification before opening the port.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Use an app password when your client supports password authentication
Gmail’s ordinary account password is not an SMTP password. The supported password-style option is an app password tied to an account with 2-Step Verification enabled.
Create the credential
- Sign in to the Gmail or Workspace account that will send mail.
- Open the account’s Security settings and turn on 2-Step Verification if it is not already enabled.
- In the same security area, open App passwords. Google may change the exact menu wording or location.
- Create a new app password for the mail-sending service and record the generated 16-character value.
- Put that value in the SMTP password field. Keep it in a secret store or environment variable, not in source control or a ticket.
If Gmail returns 534 5.7.9 Application-specific password required, 2-Step Verification is active but the SMTP client is not presenting an app password. If the app-password option is unavailable, do not substitute the normal account password; use OAuth 2.0 or ask the Workspace administrator which authentication methods are allowed.
Replace a revoked or rejected app password
A 535 5.7.8 Username and Password not accepted response commonly means the client sent the account password, mistyped the address, or used an app password that has been revoked or has expired. Generate a new app password, update every worker that uses the old value, and retry with the full email address as the username. Remove old credentials from configuration files and secret stores after rotation.
Configure the SMTP client without mixing TLS modes
Set the server, port, encryption, and authentication explicitly. A typical configuration has these fields:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- Host:
smtp.gmail.com - Port:
587with STARTTLS, or465with implicit SSL/TLS - Authentication: enabled
- Username: the complete address, such as
[email protected] - Password: the generated app password, unless the library is using OAuth XOAUTH2
- Certificate validation: enabled; do not disable verification as a permanent workaround
Common configuration errors include selecting an option labeled SSL on port 587 when the library expects STARTTLS, selecting STARTTLS on port 465, leaving authentication disabled, or placing only the text before the @ sign in the username. Read your library’s terminology carefully: some call port 587 "TLS" or "explicit TLS," while port 465 may be called "SSL" or "implicit TLS."
Choose OAuth 2.0 when passwords are unsuitable
OAuth 2.0 avoids putting an account password or app password in the SMTP configuration. Your application registers an OAuth client, obtains user consent, receives an access token, and authenticates to SMTP with the XOAUTH2 mechanism. The access token is short-lived, so a production service also needs a secure refresh-token process and a way to recover when consent is revoked.
OAuth setup is more involved than an app password: it requires a registered client, a consent flow, encrypted token storage, refresh handling, and correct SASL construction. Scope names and Workspace administrator controls should be checked in Google’s live OAuth documentation rather than copied from an unverified third-party example. One commonly cited scope is https://mail.google.com/, but confirm the scope and authorization details for your application before shipping.
When debugging OAuth, log the SMTP status and your token’s expiry metadata, never the token itself. A token can be valid for another Google API and still be unusable for SMTP if the requested scope, account, or XOAUTH2 formatting is wrong.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Interpret Gmail’s most useful error responses
| Response | Likely cause | Corrective action |
|---|---|---|
535 5.7.8 Username and Password not accepted |
Normal account password, wrong address, mistyped app password, or a revoked/expired app password | Use the full address, create a fresh app password, or migrate the client to OAuth 2.0 |
534 5.7.9 Application-specific password required |
2-Step Verification is enabled but the client did not use an app password | Create and install an app password, or use OAuth 2.0 |
| Connection timed out | Outbound TCP 587 or 465 is blocked, filtered, or unreachable | Run reachability tests, try the other submission port, and ask the provider to unblock egress |
421 4.7.0 Too many concurrent connections |
Too many simultaneous sessions from one account or source | Pool and reuse connections, cap concurrency, and close idle sessions; one vendor guide reports a threshold of about 10 simultaneous sessions, but that figure is not independently confirmed |
Record the complete SMTP response, including enhanced status codes. A generic application error such as "mail send failed" hides the distinction between a blocked socket and a rejected login.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Resolve timeout and TLS failures systematically
If both ports time out
- Run
ncandopensslfrom the sending host to prove the failure is outside the application. - Review egress firewall logs for denied connections to the resolved Gmail addresses.
- Test from a second network or a temporary host only as a comparison; do not treat a successful laptop test as proof that the production host is allowed.
- Ask the provider whether SMTP egress is restricted by account age, plan, region, or abuse controls.
If 587 works but 465 fails
Use 587 with STARTTLS and ensure the client is not configured for implicit TLS. The working result establishes that DNS, routing, and Gmail reachability are available; the remaining issue is the 465 path or the client’s TLS mode.
If 465 works but 587 fails
Use 465 with implicit SSL/TLS, or have the provider permit 587. Do not send cleartext credentials by disabling TLS on 587.
If the TLS handshake fails
- Confirm the hostname is exactly
smtp.gmail.comso certificate-name validation matches. - Update an obsolete TLS library or runtime that cannot negotiate the server’s currently accepted protocol.
- Check the server clock; a badly incorrect clock can make otherwise valid certificates appear outside their validity period.
- Keep certificate verification enabled and inspect the client log for the specific certificate or protocol alert.
Prevent connection-limit and reliability problems
Do not create a new SMTP session for every message when a queue or connection pool can safely reuse one. Bound the number of workers for each sending account, close sessions after errors, and apply exponential backoff instead of immediate retries. A retry loop that opens another connection before the first one closes can turn a transient failure into a 421 response.
Separate authentication failures from delivery retries. Repeating a 535 login with the same secret will not help and can create noisy logs; stop the queue, correct the credential, then resume. For a timeout, retry only after confirming the network path is available.
Workspace accounts and changing Google policies
Google Workspace administrators can restrict app passwords, OAuth clients, SMTP access, or external sharing. Claims that plain-password SMTP ended on a particular Workspace date have appeared in third-party guides, but the dates conflict and are not confirmed here. Check the current Google Admin and Gmail documentation for your organization before choosing an authentication method.
An administrator policy can therefore produce a different result from a personal Gmail account using the same code. Ask the administrator whether the account may use app passwords, whether the OAuth client is trusted, and whether the sending address is permitted. Keep the account’s region, edition, and policy context with the incident record.
Security checklist for a production sender
- Store app passwords and OAuth refresh tokens in a secret manager with access logging.
- Grant the sending process only the secret and network permissions it needs.
- Rotate an app password immediately when a server, employee, or repository may have exposed it.
- Revoke unused app passwords and OAuth grants from the Google account’s security controls.
- Redact passwords, access tokens, authorization headers, and full SMTP commands from logs.
- Monitor authentication failures separately from recipient or content rejections.
- Use a queue with bounded concurrency so a temporary Gmail response does not create a connection storm.
A concise recovery sequence
- Set host
smtp.gmail.com. - Test port 587 with STARTTLS; if the network blocks it, test port 465 with implicit TLS.
- Confirm the username is the complete Gmail or Workspace address.
- Enable 2-Step Verification and create a 16-character app password, or complete an OAuth 2.0 integration.
- Run an authenticated test and capture the exact SMTP response.
- Map that response to the error table, correct one layer, and retry once.
- After success, configure secret storage, connection limits, logging redaction, and credential rotation.
Frequently Asked Questions
Can I use Gmail SMTP on port 25 from my application server?
Port 25 is intended for server-to-server relay, not Gmail client submission. Use port 587 with STARTTLS or port 465 with implicit SSL/TLS.
Recommended Free Tools
Why does the same SMTP code work on my laptop but time out on the server?
The production host can have a different outbound firewall, cloud security group, provider policy, DNS resolver, or container network policy. Test from the server itself and ask its hosting provider about TCP 587 and 465 egress.
Do I need both an app password and OAuth 2.0?
No. They are alternative authentication methods. An app password is quicker when 2-Step Verification and account policy permit it; OAuth 2.0 requires a client registration and token lifecycle but avoids storing a password-style credential.
What should I do after changing an app password?
Update every process, worker, and secret-store entry that used the old value, remove the old credential from configuration and logs, then run one authenticated test and resume the queue.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
