Yahoo SMTP settings: server, ports, app password, and why an agent should not send product mail through it

Yahoo SMTP settings

To send through a Yahoo Mail account from a third-party client or application:

Use SSL on 465 and STARTTLS on 587, and do not mix them. That is the same rule that governs the SMTP port numbers generally. Microsoft mailboxes have their own version of this in the Office 365 SMTP settings, where the blocker is an admin toggle rather than a password.

Port 587 is the message submission port defined in RFC 6409, where the connection upgrades with STARTTLS. Port 465 is submission over implicit TLS, registered in RFC 8314.

You need an app password

Yahoo does not accept your normal account password over SMTP when two-factor authentication is on, and for most accounts it is. A standard password produces an authentication failure that looks like a wrong password, which sends people in circles.

Generate one instead:

1. Open your Yahoo Account Security page.
2. Find app passwords and generate a new one.
3. Copy the 16-character string and use it as the SMTP password.

Yahoo's own steps are on its help page for third-party app passwords.

If you later disable 2FA or regenerate the password, every app using the old one stops sending. That's usually the cause when a working setup breaks months later with no changes on your end.

Gmail has the same requirement, covered step by step in the Gmail app password SMTP guide.

What an agent does differently with Yahoo SMTP

Ask a coding agent in Claude, ChatGPT or Cursor to make a contact form send email and it will reach for the first SMTP block that works. For a solo developer that is often their own Yahoo account. A person typing these settings into a mail client is a different case from an agent putting them into a product, for four reasons:

• It runs unattended. Nobody watches the first hundred sends, so a failure shows up as a missing email days later.
• It retries on failure. A send that times out gets sent again, and against a mailbox with undocumented daily caps that adds up fast.
• It copies credentials into config. The Yahoo address and app password go into .env, a config file or a test script, and from there into commits and logs.
• It sends product mail on a person's mailbox. Every agent that sends this way borrows one person's address, and every reply and bounce lands in that person's inbox.

Nitrosend gives the agent tools over MCP instead of a mailbox password and a port. The agent sends from a verified domain you own, not from one person's mailbox, and a person reviews the mail before customers get it.

Worked example: move app mail off a Yahoo account

The prompt: "Our contact form and signup emails send through my Yahoo app password. Move them off it."

Before. Left unguided, an agent keeps the setup it finds. The Yahoo address and app password sit in .env, the mailer points at smtp.mail.yahoo.com on 587, and the product's signup mail depends on one personal account.

After. With the Nitrosend MCP tools, the agent works through a fixed sequence:

1. nitro_get_status checks account readiness and the sender identity.
2. nitro_manage_domains adds the company's sending domain and checks that it is verified.
3. nitro_review_delivery runs read-only validation, spam analysis and previews on the contact form and signup templates. It never sends.
4. nitro_send_test_message sends one real test, which never reaches an audience.
5. A person reviews the test and approves with nitro_control_delivery.
6. The app code replaces the Yahoo SMTP block with nitro_send_message or a direct call to the REST API, each send carrying an idempotency_key that is reused only for an exact retry.
7. nitro_get_insights shows the analytics for the first live sends.

The end state is a verified sending domain and an API key in place of a personal Yahoo credential. The Free plan includes 5,000 emails up front and then 500 a month. New accounts start at 100 recipients per rolling 24 hours, and the allowance rises with sender standing. The limits are on the pricing page.

Where it goes wrong when an agent uses Yahoo SMTP

• The app password leaks. It gets committed to a repo or printed in a debug log, and anyone who finds it can send as that Yahoo account.
• A retry loop hits the daily cap. Yahoo does not publish its send limits, and a loop that keeps resending can get the account temporarily blocked from sending.
• Sending stops silently. A revoked app password or a security hold on the account stops every send, and there is no per-message status to show it.
• Reputation is tied to one person. The product's mail rides on one person's mailbox, so their account problems become the product's delivery problems.

What people are usually setting up

Three cases cover almost everything:

• A mail client like Outlook, Apple Mail, or Thunderbird, sending as your Yahoo address.
• A "can receive but can't send" fix, which is nearly always the SMTP half of the config being wrong while IMAP is fine. Check the port and encryption pairing first, then the app password.
• A website or form sending notifications through a Yahoo account.

The third case is the one to reconsider.

Why not to run a product on Yahoo SMTP

Yahoo Mail is a consumer mailbox, built for a person sending their own mail, and its delivery reputation belongs to Yahoo rather than to you. In a person's own mail client, that is fine. For a form, an app or a product sending order confirmations or password resets to customers, it is not. Those are transactional emails, and a consumer mailbox runs into three limits with them:

• Send caps. Daily limits are modest and unpublished.
• No authentication for your domain. The mail is not signed under a domain you own.
• No delivery log. There is nothing to check when a customer says the email never arrived.

If a product needs to send, the answer is your own verified sending domain with SPF, DKIM, and DMARC, not a mailbox with an app password. That work is the foundation of email deliverability, and once it is done you send over an email API and never think about ports or app passwords again.

For receipts, password resets and signup mail, the transactional email API page covers that route in more detail.

FAQ

Related reading

• Transactional email, defined
• What email deliverability is
• Email authentication protocols

Go deeper