SMTP is the protocol a website uses to send account verification, password reset and transaction notification emails. With Gmail, the website should not use your main login password; it needs a dedicated app password.
Configuring SMTP correctly improves reliability and lets you revoke the website's sending permission without changing your Google account password.
What is a Google app password?
An app password is a separate authentication string for software or devices that do not use the full Google sign-in flow. It differs from your account password and can be revoked independently.
Depending on the account type and administrator policy, the app password option may not be available. First you need to turn on 2-Step Verification for the Google account.
How to create an app password
- 01
Turn on 2-Step Verification
Sign in to your Google account, open the Security section and complete the 2-Step Verification setup.
- 02
Open App passwords
Find "App passwords" in the account settings. Google may ask you to authenticate again.
- 03
Give it a recognisable name
Name it something like "CMSNT website" so you know where the password is used, then create it.
- 04
Copy and store it immediately
The password string is usually shown only once. Copy it for the configuration; do not keep it in notes or a public screenshot.
The Gmail SMTP settings you need
- SMTP server: smtp.gmail.com
- Port 465 with SSL, or port 587 with TLS/STARTTLS.
- Username: the full Gmail address used to send.
- Password: the app password you just created, not your main Google password.
- From email: should match the verified account.
Note: Field names in the Admin Panel can differ between versions. If there is an encryption option, pick the one matching your SMTP port.
Configure it in CMSNT and send a test
- 01
Enter the configuration
Open the Email/SMTP section in the Admin Panel, fill in the server, port, email and app password, then save.
- 02
Send a test email
Use the test function if there is one; otherwise run a forgotten-password or sign-up flow with an email address you control.
- 03
Check deliverability
Look in both the inbox and the spam folder, and check the sender name, subject, links and mobile rendering.
Common SMTP errors
- Authentication failed: the email or app password is wrong, 2FA is off, or the password has been revoked.
- Connection timed out: the hosting/VPS provider blocks the mail port, or the firewall does not allow the connection.
- Mail lands in spam: the domain has no SPF, DKIM or DMARC, or the email content looks spammy.
- Works at first then gets limited: the volume exceeds Gmail's threshold; a larger website should use a dedicated transactional email service.
Securing the sending account
Create a separate account for system email, limit who can access it and revoke the app password as soon as you suspect a leak. Never write the password into source code or push it to Git; store it in the system's secure configuration area.
