Yahoo SMTP Settings: Server, Ports, and the App Password Requirement
Yahoo SMTP settings
To send through a Yahoo Mail account from a third-party client or application:
Yahoo SMTP settings
third-party client or applicationPair the encryption to the port and not the other way around, which is the same rule that governs the SMTP port numbers generally. Microsoft mailboxes have their own version of this in the Office 365 SMTP settings, where the blocker is an admin toggle rather than a password.
You need an app password
Yahoo does not accept your normal account password over SMTP when two-factor authentication is on, and for most accounts it is. A standard password produces an authentication failure that looks like a wrong password, which sends people in circles.
Generate one instead:
- Open your Yahoo Account Security page.
- Find app passwords and generate a new one.
- Copy the 16-character string and use it as the SMTP password.
If you later disable 2FA or regenerate the password, every app using the old one stops sending. That's usually the cause when a working setup breaks months later with no changes on your end.
What people are usually setting up
Three cases cover almost everything:
- A mail client like Outlook, Apple Mail, or Thunderbird, sending as your Yahoo address.
- A "can receive but can't send" fix, which is nearly always the SMTP half of the config being wrong while IMAP is fine. Check the port and encryption pairing first, then the app password.
- A website or form sending notifications through a Yahoo account.
That third one is where I'd stop and reconsider.
Why not to run a product on Yahoo SMTP
Yahoo Mail is a consumer mailbox. It's built for a person sending their own mail, and it comes with the limits that implies: modest daily send caps, no authentication for a domain you own, and a delivery reputation that belongs to Yahoo rather than to you.
For a contact form that emails you a few times a day, that's completely fine. For a product sending order confirmations or password resets to customers, it isn't. Those are transactional emails, and they carry stakes a consumer mailbox was never built for. You'll hit send limits, your mail won't be authenticated under your own domain, and you'll have no useful log when a customer says the email never arrived.
Our support diagnostics on high-bounce accounts keep landing on the same finding: failures cluster on older, inactive consumer domains, with sbcglobal.net, pacbell.net, comcast.net, aol.com and yahoo.com among them, returning errors like mailbox disabled or account closed. Yahoo addresses sit squarely in that cluster, which is one more reason not to attach a product's sending to one.
We measure inbox placement against a first-party pool of about twenty real seed mailboxes across Gmail, Workspace, Outlook, Office 365, Yahoo, and Apple, so I can say with some confidence that consumer mailbox sending and authenticated domain sending are not in the same league. The gap shows up exactly when it hurts most, which is at volume and on the messages people actually need.
If a product needs to send, the answer is your own verified sending domain with SPF, DKIM, and DMARC, not a mailbox with an app password. That work is the foundation of email deliverability, and once it is done you send over an email API and never think about ports or app passwords again.
I would rather nobody had to memorise smtp.mail.yahoo.com, an app password and a port pairing at all. The honest fix is not a better cheat sheet, it is having an AI agent send the email for you: describe what needs to go out inside Claude, ChatGPT, Cursor or any MCP client, and Nitrosend handles the authenticated sending domain, the ports and the retries without you touching a mailbox.
FAQ
What are the Yahoo SMTP settings?
Server smtp.mail.yahoo.com, port 465 with SSL or 587 with STARTTLS, authentication required, username is your full Yahoo address, and the password is a generated app password.
Why is Yahoo rejecting my SMTP password?
Because two-factor authentication is on and Yahoo won't accept your account password over SMTP. Generate an app password in your Yahoo Account Security settings and use that.
Can I receive Yahoo mail but not send it?
That points at the SMTP configuration rather than IMAP. Check that the port and encryption match (465 with SSL, 587 with STARTTLS) and that you're using an app password.
Can I use Yahoo SMTP for my application's email?
Only for very low volume. Consumer mailboxes have daily send caps, no authentication for your own domain, and no useful delivery logging, so product email should use an authenticated sending domain instead.