Outlook SMTP Settings for Personal Accounts, 2026 Edition
Searching outlook smtp settings lands you in a hall of mirrors, because "Outlook" names four different things: a desktop program, a mobile app, a corporate mail service, and the free consumer mailboxes at outlook.com, hotmail.com and live.com. The settings below are for the last group - personal Microsoft accounts - and they differ from the corporate smtp.office365.com world in host, in credential rules, and in which failures you can actually fix yourself.
The outlook smtp settings block for consumer accounts
| Setting | Value |
|---|---|
| Host | smtp-mail.outlook.com |
| Port | 587 with STARTTLS |
| Username | your full address - outlook.com, hotmail.com, live.com or msn.com all use the same server |
| Password | an app password on 2FA accounts; account password only on accounts without 2FA |
| Encryption | required |
The host is the detail people miss: consumer accounts use smtp-mail.outlook.com, while business Microsoft 365 mailboxes use smtp.office365.com. The two accept different account populations, and pointing a hotmail address at the business host produces authentication failures that no password will cure. Legacy guides also float smtp.live.com; it has historically aliased to the same service, but new configurations should use the canonical smtp-mail.outlook.com and stop inheriting 2009's DNS.
Matching receive settings, since most tools ask for both at once: IMAP is outlook.office365.com on port 993 with SSL, which confusingly is shared with the business world even though sending is not. Set the pair together, test the pair together, and you avoid the half-configured account that receives but cannot send - the single most common end state of a rushed setup.
The credential rules Microsoft actually enforces now
Microsoft has spent years constricting password access to consumer mail, and the current shape is:
- Accounts with two-step verification on: your normal password is refused for SMTP; you need an app password, generated in the Microsoft account security area (Security, Advanced security options, App passwords). Same 16-character pattern as Google's, same show-it-once behavior.
- Accounts without two-step verification: the plain account password can still work, but this configuration is both shrinking (Microsoft keeps nudging accounts toward stronger auth) and unwise - you are trading an unprotected account for the convenience of skipping one setup screen.
- Modern clients: Outlook desktop, Apple Mail, Thunderbird and friends sign in with OAuth automatically when you use their account-add flows; the manual SMTP block is for older software, devices, and code.
If app passwords do not appear in your security options, the account either lacks two-step verification (turn it on) or falls under one of Microsoft's newer passwordless configurations, where adding a password back to the account restores the machinery.
Sending limits nobody publishes precisely
Consumer Outlook enforces daily sending caps that Microsoft deliberately does not document as exact numbers - they vary by account age, reputation and verification state, with fresh accounts limited hardest. Community-observed ceilings sit around 300 recipients per day for established verified accounts, with per-message recipient caps near 100 and aggressive throttling for burst behavior. New accounts can find limits an order of magnitude lower for their first weeks.
Two design consequences. First, never build anything commercial on a consumer mailbox's sending path - the undocumented, floating ceiling is the product telling you it is for humans. Second, when a personal account trips its limit, the lockout language ("you've reached your daily limit") carries no numbers and no timer; observed recovery is within a day, and repeated tripping ratchets suspicion. The pattern-matching between this and every other mailbox provider is exact, because the economics are: consumer mail is priced for correspondence, not distribution.
The failure gallery for this host
- 535 5.7.3 Authentication unsuccessful - the consumer host's standard credential refusal: wrong credential class (account password on a 2FA account), a revoked app password, or the business-host mixup in reverse.
- 550 5.3.4 Message size exceeds fixed maximum - consumer size ceilings are lower than you expect once encoding overhead is counted; large attachments belong on OneDrive links.
- Silent non-delivery of the first messages from a new setup - new-connection probation; send a handful of normal messages to known contacts before concluding anything is broken.
- Blocked account interstitials - unusual sending patterns can lock the whole account pending verification, not just SMTP. That recovery runs through account.live.com, not through your SMTP client.
Where these settings belong - and where they never do
The legitimate uses are personal-scale: an old scanner in a home office, a hobby script that mails you reports, a legacy app that only speaks SMTP, a mail client too old for OAuth. For all of these, smtp-mail.outlook.com with an app password is fine and stable.
Everything else - a startup's notifications, invoices to customers, any list, anything that grows - does not belong on a consumer mailbox even briefly. The undocumented limits, the reputation coupling to one personal account, and Microsoft's habit of tightening consumer sending without notice make it the least stable foundation in email. Business identities belong on Microsoft 365 with its documented paths, and program-generated mail belongs on sending infrastructure with scoped keys and published limits, where a Tuesday policy change in Redmond cannot silently strand your Friday invoices.
Set the consumer block up once for the personal-scale cases, note the app-password location for the day it needs rotating, and resist every temptation to make hotmail.com your product's outbound mail server. That resistance is the most valuable setting on this page.
Frequently asked questions
What are the SMTP settings for outlook.com and hotmail accounts?
Host smtp-mail.outlook.com, port 587 with STARTTLS, your full address as username, and an app password if two-step verification is enabled. The same server handles outlook.com, hotmail.com, live.com and msn.com addresses.
Is the SMTP server smtp-mail.outlook.com or smtp.office365.com?
Consumer personal accounts use smtp-mail.outlook.com; business Microsoft 365 mailboxes use smtp.office365.com. They are different services for different account types, and using the wrong one yields authentication failures no password fixes.
How do I get an app password for Outlook SMTP?
Enable two-step verification on the Microsoft account, then go to Security, Advanced security options, App passwords, and create one. It is shown once - paste it as the SMTP password in place of your account password.
How many emails can I send from a personal Outlook account?
Microsoft does not publish exact consumer numbers; observed ceilings are roughly 300 recipients a day for established accounts with per-message caps near 100, and far less for new accounts. Anything business-scale belongs on Microsoft 365 or dedicated sending infrastructure instead.