Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Most Gmail SMTP failures come down to one of three mismatches: the wrong port/TLS mode, use of the account’s normal password instead of an app password or OAuth 2.0, or an outbound firewall blocking the connection. Use smtp.gmail.com, port 587 with STARTTLS or port 465 with implicit SSL/TLS, authenticate with the complete Gmail address, and then test the network path from the server.
Use these Gmail SMTP settings first
Enter the following values in your mail library, CMS, monitoring service or server-side application. The TLS option must match the port; selecting the wrong mode can look like an authentication failure even when the credentials are correct.
Recommended Free Tools
| Setting | Value | What it means |
|---|---|---|
| SMTP host | smtp.gmail.com |
Google’s client-submission endpoint. |
| Port 587 | STARTTLS | The connection starts unencrypted, then is upgraded with the STARTTLS command before authentication. |
| Port 465 | Implicit SSL/TLS | TLS is negotiated immediately when the TCP connection opens. |
| Port 25 | Do not use for normal client submission | Port 25 is intended for server-to-server relay, not an application logging in to submit mail. |
| Username | Your full Gmail or Google Workspace address | Use the complete address, such as name@example.com, rather than only the text before the at-sign. |
| Password | An app password or OAuth 2.0 access token | The account’s ordinary Google password is rejected for SMTP authentication. |
| Authentication mechanism | LOGIN/PLAIN with an app password, or XOAUTH2 with OAuth | Your client must support the mechanism selected by the credential type. |
Google removed “less secure app” access in 2022, so turning on an old setting or allowing basic authentication in your application will not restore normal-password sign-in.
Identify the failure from the SMTP response
| Error or symptom | Likely cause | Corrective action |
|---|---|---|
535 5.7.8 Username and Password not accepted |
The application is sending the normal account password, or an app password was revoked or is no longer valid. | Create a new app password, update the secret everywhere it is stored, or migrate the integration to OAuth 2.0. |
534 5.7.9 Application-specific password required |
Two-Step Verification is enabled, but the SMTP client has no app password. | Generate an app password and use its generated value as the SMTP password. |
| Connection timed out | The server, hosting provider or ISP is blocking outbound TCP 465 or 587, or a firewall is dropping the traffic. | Test both ports from the server, ask the provider to allow the required egress, and use the port your provider permits. |
421 4.7.0 Too many concurrent connections |
Too many simultaneous SMTP sessions are open for one account or source. | Reuse connections where your library supports it, cap concurrency, close idle sessions and retry with backoff. One guide mentions a threshold of about 10 sessions, but that number is not confirmed as a universal Google limit. |
| TLS handshake or certificate error | The port and TLS mode do not match, the server’s CA bundle is outdated, or the system clock is wrong. | Use STARTTLS on 587 or implicit TLS on 465, update trusted certificates and correct the server time. |
| Authentication succeeds but mail is not sent | The application may be failing after login, mishandling the SMTP envelope, or receiving a policy response that is not shown in the initial connection test. | Capture the complete SMTP conversation with secrets redacted, check the application’s sender and recipient fields, and inspect Google’s returned status. |
Fix authentication
Create and use an app password
An app password is the quickest option for a single server or legacy library that cannot perform OAuth. It is a separate, 16-character credential and requires 2-Step Verification on the Google account.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
- Sign in to the Google Account that will send the messages.
- Enable 2-Step Verification if it is not already enabled.
- Open the account’s security settings and choose the option to create an app password.
- Give the credential a label that identifies the server or application, then generate it.
- Copy the generated 16-character value into the application’s SMTP password field. Do not substitute the account’s normal password.
- Restart the application or reload its secret store, then send a test message.
If the same 535 response continues, check for a stale copy in an environment variable, container secret, deployment setting, queue worker or second server. An app password can be revoked from the account; after revocation, every process using it must be updated with a newly generated value.
Some managed Google Workspace accounts do not offer app passwords because of administrator policy or the account’s security configuration. In that case, the administrator must confirm which authentication method is allowed; do not weaken the account policy simply to make SMTP work.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use OAuth 2.0 with XOAUTH2
OAuth is the better fit for a product that serves many users, needs delegated access, or must avoid distributing a reusable password. It requires a registered OAuth client, a user consent flow, secure storage for the refresh token, and code that obtains and refreshes short-lived access tokens.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
- Register an OAuth client in the Google project used by your application and configure the approved redirect or service flow.
- Request the mail permission documented by Google for SMTP, obtain user consent, and store the resulting refresh token in a protected secret store.
- Exchange the refresh token for an access token when a message is sent. Never treat an expired access token as a permanent password.
- Configure the SMTP library to authenticate with XOAUTH2 and the full Gmail address. The library must send the access token using the XOAUTH2 mechanism, not as a LOGIN or PLAIN password.
- Refresh the token on expiry and handle revocation by sending the user through consent again.
“The SASL XOAUTH2 mechanism enables clients to provide OAuth 2.0 credentials for authentication.” — Google Developers, IMAP, POP and SMTP documentation.
The exact OAuth permission, consent screen and token endpoints can change with Google’s current documentation and with Workspace administrator policy. Verify those values for your account type before deploying; do not copy an unverified scope from an old code sample.
Test whether the server can reach Gmail
Run these commands on the machine that actually sends mail, not only on your laptop. A successful DNS lookup does not prove that the SMTP port is reachable, and a successful TCP connection does not prove that authentication is configured.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
1. Check DNS resolution
getent ahosts smtp.gmail.comYou should receive one or more addresses. If the command returns nothing, inspect the server’s resolver configuration, outbound DNS firewall rules and any split-DNS policy. If only IPv6 addresses are returned and your host has broken IPv6 routing, temporarily test with a working IPv4 path or correct IPv6 routing rather than changing SMTP credentials.
2. Test TCP port 587
nc -vz smtp.gmail.com 587A connection refusal or timeout before any SMTP banner indicates a network-path problem. Ask the hosting provider whether outbound 587 is filtered and whether an egress rule must be added for the application’s source address.
3. Test STARTTLS on 587
openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlfThis test should complete a TLS handshake after the SMTP service advertises STARTTLS. Certificate verification errors point to the operating system’s CA store, hostname verification or clock; they are different from a bad-password response. Exit without entering credentials.
4. Test implicit TLS on 465
openssl s_client -connect smtp.gmail.com:465 -crlfPort 465 negotiates TLS immediately. Do not use the STARTTLS option for this test, and do not configure a client for implicit TLS on port 587. If 465 works while 587 times out, or the reverse, use the reachable port and have the provider explain the filtering.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Match the application’s TLS and authentication settings
| Application setting | For port 587 | For port 465 |
|---|---|---|
| Encryption mode | STARTTLS (explicit TLS upgrade) | SSL/TLS from connection start (implicit TLS) |
| Certificate verification | Enabled | Enabled |
| Server name for verification | smtp.gmail.com |
smtp.gmail.com |
| Authentication | App password or XOAUTH2 | App password or XOAUTH2 |
| Username | Full Gmail or Workspace address | |
Do not “fix” a handshake error by disabling certificate verification. That hides an identity problem and exposes the account or message contents to interception. Correct the port mode, install the current CA certificates, and ensure the server clock is synchronized.
When a framework exposes separate fields such as secure, requireTLS and port, read its version-specific documentation carefully: setting secure=true usually means implicit TLS and is appropriate for 465, while 587 normally requires STARTTLS after the socket opens. A library that does not support XOAUTH2 cannot use an OAuth access token merely by placing it in the password field.
Work through a timeout or firewall problem
- Run the netcat test for 587 and 465 from the production host.
- Check the host firewall, cloud security group, container network policy and any outbound proxy. Permit TCP egress to the selected port.
- Ask the hosting provider or ISP whether SMTP egress is blocked by default. The provider may need to remove a block or approve the server before connections are allowed.
- If one of 465 or 587 is filtered, switch the application to the other with the matching TLS mode while the provider investigates.
- Retest from the same network namespace as the application. A shell on the host can succeed while a container, serverless function or restricted worker remains blocked.
A timeout generally means the connection never reached Gmail’s SMTP service; changing a password cannot repair a packet that is being dropped. Conversely, a prompt 535 response proves that the network path and TLS negotiation progressed far enough for Gmail to evaluate credentials.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Handle intermittent failures and connection limits
Mail queues often open a new SMTP session for every message. That pattern can create bursts of concurrent connections and trigger a 421 4.7.0 response even though each individual login is valid.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Set a maximum number of simultaneous SMTP sessions per account and per sending process.
- Reuse an authenticated connection when the library safely supports connection pooling.
- Close idle sessions and issue
QUITwhen a worker is finished. - Retry temporary
4xxresponses with exponential backoff instead of starting an immediate parallel wave. - Keep separate credentials and queues for genuinely separate senders so one noisy worker does not consume every available session.
No authoritative universal session number is established here; treat any fixed threshold in a third-party guide as an operational hint, not a guaranteed Google limit.
Choose between an app password and OAuth 2.0
| Decision point | App password | OAuth 2.0 |
|---|---|---|
| Setup effort | Fast: enable 2-Step Verification and generate one 16-character credential. | Higher: register a client, obtain consent, store a refresh token and implement token refresh. |
| Best fit | A controlled internal service or legacy SMTP library that supports password-style authentication. | A user-facing product, multi-account integration or library with native XOAUTH2 support. |
| Account requirement | 2-Step Verification must be enabled, and the account or Workspace administrator must allow app passwords. | OAuth access must be permitted by the account and, for Workspace, by administrator policy. |
| Revocation | Revoke the app password in the Google Account; every service using it then needs a replacement. | Revoke consent or the token; refresh-token handling must send the user through authorization again. |
| Security model | A reusable secret is stored by the application and should be restricted and rotated when exposed. | Short-lived access tokens and documented scopes can limit what the integration can do, but refresh tokens still require strong protection. |
For a one-server alerting script, an app password usually minimizes implementation work. For software distributed to customers or connected to many mailboxes, OAuth avoids collecting account passwords and gives you a supported token lifecycle.
Workspace and policy checks
Google Workspace administrators can impose authentication and SMTP restrictions that do not apply to a personal Gmail account. Third-party guides publish different dates for when password-based SMTP was restricted for Workspace, so do not rely on a date copied from an old tutorial. Check the current Workspace administrator documentation and the organization’s security policies before deciding that a working personal-account configuration should also work for a managed address.
- Confirm that the account is licensed, active and permitted to send through SMTP.
- Ask the administrator whether 2-Step Verification and app passwords are allowed for this organizational unit.
- Verify that OAuth client access, consent and the required mail permission are approved for the project.
- Check whether the organization routes mail through another relay or requires a specific sender address.
When an administrator changes a policy, update the application’s authentication method and secret store together. Do not repeatedly retry a method that policy explicitly disallows; it can create lockouts and noisy audit events.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Secure the working configuration
- Store app passwords and refresh tokens in a secret manager or protected environment variable, not in source control, tickets or logs.
- Redact
AUTHstrings, access tokens and passwords before saving SMTP debug output. - Use a dedicated sending account with only the access required for the application.
- Revoke a credential immediately if it appears in a log, repository, error report or support attachment.
- Monitor authentication failures separately from network timeouts so that a firewall incident is not mistaken for credential theft.
- Keep the operating system, CA bundle and SMTP library current enough to validate Gmail’s certificates and negotiate modern TLS.
A complete repair sequence
- Set the host to
smtp.gmail.com. - Choose port 587 with STARTTLS or port 465 with implicit SSL/TLS; never pair the wrong TLS mode with the port.
- Enter the complete Gmail or Workspace address as the username.
- Replace the normal account password with a valid app password, or configure a real OAuth 2.0 XOAUTH2 flow.
- Run DNS, TCP and TLS tests from the production machine.
- If the connection times out, remove the outbound block or use the other supported port.
- If Gmail returns
535or534, correct the credential type and replace stale secrets. - If Gmail returns
421, reduce concurrent sessions, reuse connections and back off retries. - Send a controlled test message, then inspect the application’s complete SMTP response and queue logs with secrets removed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
