How to Enable SMTP in Gmail (There Is No Switch - Do This)

The most useful thing to know about how to enable smtp in gmail is that there is nothing to enable. SMTP access is already on for every Gmail and Google Workspace account, permanently, and has been for years. What people are actually looking for when they search this phrase is the thing that feels like enabling: making a third-party app's login stop failing. That failure is a credential problem wearing an access-problem costume.

The instructions below are the real sequence - what to set up, in order, and the two legacy settings people keep toggling that do nothing for sending.

Why the switch you remember is gone

Two historical settings created the idea of enabling SMTP, and both are dead ends now:

• "Less secure app access" used to let apps log in to SMTP with your normal account password. Google removed it in 2022; the toggle no longer exists, and no setting brings password login back. Guides that reference it are fossils.
• "Enable IMAP" in Gmail's Forwarding and POP/IMAP tab governs reading mail, not sending it. In today's Gmail it is on by default and increasingly hidden entirely. Toggling it has never affected SMTP.

Once those two red herrings are off the table, "enabling SMTP" collapses into one real task: giving your app a credential Google will accept.

How to enable smtp in gmail access, step by step

1. Turn on 2-Step Verification. Google account, Security, 2-Step Verification. This is a prerequisite - the app-password page literally does not exist without it.
2. Create an app password. Security, then App passwords (or search "app passwords" in the account search bar, which is faster than hunting the menu). Name it after the app that will use it - "invoice tool", not "test" - and copy the 16 characters immediately; Google shows them once.
3. Put it in the app's SMTP settings. Host smtp.gmail.com, port 587 with STARTTLS (465 with TLS also works), username your full email address, password the app password. Spaces in the 16 characters are cosmetic; with or without both work.
4. Send one test message and read the result. Success means done. A 535 error means the credential did not land - re-copy it, check the username is the complete address, and confirm the account you generated the password on is the account in the config.

That is the entire procedure for a personal Gmail address. Total time, under five minutes.

The Workspace complication: an admin may hold the key

On a company domain, two admin-side policies can block the flow above even when you do everything right:

• App passwords disallowed. Admin console, Security, Authentication - if app passwords are disabled domain-wide, step 2's page never appears for any user. The fix is an admin decision, not a user workaround.
• 2-Step Verification not permitted or enforced oddly. If the domain blocks users from enrolling in 2SV, the prerequisite for app passwords cannot be met. Same desk, same fix.

Workspace admins also control a genuinely different, better option for machine sending: the SMTP relay service, configured under Gmail routing settings, which authenticates by IP or dedicated credentials and does not consume any human's mailbox quota. If the thing you are connecting is a server rather than a mail client, ask for the relay instead of an app password - it is the difference between borrowing a person's identity and having infrastructure.

Checking it worked, beyond the green checkmark

A successful login is not the whole story; confirm the mail is actually leaving correctly:

• The message appears in the account's Sent folder - smtp.gmail.com sends as the mailbox, so Sent is your delivery receipt.
• The received copy's headers show authentication passing - open the message in any Gmail inbox, choose Show original, and look for SPF, DKIM and DMARC lines reading pass. Google signs and authenticates its own outbound, so failures here mean something else is rewriting your mail.
• Volume expectations are set: this route carries the mailbox's own daily recipient allowance (hundreds for free accounts, a couple of thousand for Workspace), shared with everything the human sends. It is a personal-scale pipe, and it was never designed to be anything more than that.

If the login still fails after all of this

Work the list in order, because each item eliminates a category:

1. The password in the config is the 16-character app password, not the account password and not a passkey.
2. The username is the full address, including the domain.
3. The app password was generated on the same account the config names - a personal Gmail app password does nothing for a work address, and vice versa.
4. The account has not been enrolled in Advanced Protection, which forbids app passwords by design.
5. Nothing between the app and Google rewrites the connection - some antivirus products intercept TLS on mail ports and break the handshake in ways that read as authentication failures.

If every line checks out and 535 persists, generate a fresh app password and retire the old one; revocation events (password changes, security checkups, admin sweeps) silently invalidate existing app passwords, and a stale one behaves exactly like a wrong one.

The one-sentence version of this whole page: Gmail's SMTP door was never locked - it just stopped accepting the old key, and the new key is an app password on an account with 2-Step Verification turned on.

Frequently asked questions

Is there a setting to enable SMTP in Gmail?

No. SMTP access is always on for every Gmail account. What you set up is the credential: enable 2-Step Verification, generate an app password, and use that in your app's SMTP settings with smtp.gmail.com.

Why does Gmail SMTP say username and password not accepted?

Because the app is presenting your account password, which Google no longer accepts for SMTP, or an app password that was revoked or generated on a different account. Create a fresh app password and use the full email address as the username.

Do I need to enable IMAP for SMTP to work in Gmail?

No. The IMAP setting controls reading mail from another client and has no effect on sending. SMTP works regardless of the IMAP toggle's state.

Why can't I find the app passwords page in my Google account?

The page only exists once 2-Step Verification is enabled, and it is hidden if your account uses Advanced Protection or a Workspace admin has disabled app passwords domain-wide. On a company domain, that policy is the first thing to check.