Yahoo SMTP Settings: Server, Ports, and the App Password Requirement

Yahoo SMTP settings

To send through a Yahoo Mail account from a third-party client or application:

• SMTP server: smtp.mail.yahoo.com
• Port: 465 (SSL) or 587 (TLS/STARTTLS)
• Encryption: SSL on 465, STARTTLS on 587
• Authentication: required
• Username: your full Yahoo address, e.g. [email protected]
• Password: a generated app password, not your account password

You need an app password

Yahoo does not accept your normal account password over SMTP when two-factor authentication is on, and for most accounts it is. A standard password produces an authentication failure that looks like a wrong password, which sends people in circles.

Generate one instead:

1. Open your Yahoo Account Security page.
2. Find app passwords and generate a new one.
3. Copy the 16-character string and use it as the SMTP password.

If you later disable 2FA or regenerate the password, every app using the old one stops sending. That's usually the cause when a working setup breaks months later with no changes on your end.

What people are usually setting up

Three cases cover almost everything:

• A mail client like Outlook, Apple Mail, or Thunderbird, sending as your Yahoo address.
• A "can receive but can't send" fix, which is nearly always the SMTP half of the config being wrong while IMAP is fine. Check the port and encryption pairing first, then the app password.
• A website or form sending notifications through a Yahoo account.

That third one is where I'd stop and reconsider.

Why not to run a product on Yahoo SMTP

Yahoo Mail is a consumer mailbox. It's built for a person sending their own mail, and it comes with the limits that implies: modest daily send caps, no authentication for a domain you own, and a delivery reputation that belongs to Yahoo rather than to you.

For a contact form that emails you a few times a day, that's completely fine. For a product sending order confirmations or password resets to customers, it isn't. You'll hit send limits, your mail won't be authenticated under your own domain, and you'll have no useful log when a customer says the email never arrived.

We measure inbox placement against a first-party pool of about twenty real seed mailboxes across Gmail, Workspace, Outlook, Office 365, Yahoo, and Apple, so I can say with some confidence that consumer mailbox sending and authenticated domain sending are not in the same league. The gap shows up exactly when it hurts most, which is at volume and on the messages people actually need.

If a product needs to send, the answer is your own verified sending domain with SPF, DKIM, and DMARC, not a mailbox with an app password.

FAQ

What are the Yahoo SMTP settings?

Server smtp.mail.yahoo.com, port 465 with SSL or 587 with STARTTLS, authentication required, username is your full Yahoo address, and the password is a generated app password.

Why is Yahoo rejecting my SMTP password?

Because two-factor authentication is on and Yahoo won't accept your account password over SMTP. Generate an app password in your Yahoo Account Security settings and use that.

Can I receive Yahoo mail but not send it?

That points at the SMTP configuration rather than IMAP. Check that the port and encryption match (465 with SSL, 587 with STARTTLS) and that you're using an app password.

Can I use Yahoo SMTP for my application's email?

Only for very low volume. Consumer mailboxes have daily send caps, no authentication for your own domain, and no useful delivery logging, so product email should use an authenticated sending domain instead.