Introduction

This Gmail SMTP error usually means one of two things: your client did not negotiate the required TLS connection, or Google rejected the authentication method. The older advice to enable "less secure apps" is now mostly obsolete. For current Gmail and Google Workspace setups, the safe path is smtp.gmail.com with TLS plus either OAuth or an app password when the app cannot use Google sign-in directly.

What the Error Actually Means

Gmail does not accept plain unauthenticated SMTP from random clients. A mail program or script has to do all of the following correctly:

• connect to the right server and port
• negotiate TLS
• authenticate with valid credentials
• satisfy Google account security rules

If any step fails, Gmail may answer with 5.5.1 Authentication Required or a nearby SMTP authentication error.

For modern setups, the most common causes are:

• wrong port or missing TLS
• using the account password instead of an app password
• trying to use a username-and-password flow that Google no longer allows
• attempting SMTP from an account that still needs interactive verification in the browser

Use the Correct Gmail SMTP Settings

For direct Gmail SMTP, the standard settings are:

• server: smtp.gmail.com
• port 587 with STARTTLS, or port 465 with implicit SSL
• username: full Gmail address
• authentication: OAuth, or an app password if applicable

A minimal Python example with STARTTLS looks like this:

1import os
2import smtplib
3from email.message import EmailMessage
4
5msg = EmailMessage()
6msg["Subject"] = "SMTP test"
7msg["From"] = os.environ["GMAIL_USER"]
8msg["To"] = os.environ["GMAIL_USER"]
9msg.set_content("This is a Gmail SMTP test.")
10
11with smtplib.SMTP("smtp.gmail.com", 587) as server:
12    server.ehlo()
13    server.starttls()
14    server.ehlo()
15    server.login(os.environ["GMAIL_USER"], os.environ["GMAIL_APP_PASSWORD"])
16    server.send_message(msg)

This works only if the credentials are acceptable to Google. For many accounts that means an app password, not the normal account password.

App Passwords Versus Normal Passwords

Google documents that app passwords are 16-digit passwords intended for apps or devices that cannot use Sign in with Google, and they require 2-Step Verification on the account. That is the important operational detail: if your application asks for a regular Gmail password and 2-Step Verification is enabled, the login often fails even though the user is typing the correct password.

A practical sequence is:

1. Turn on 2-Step Verification for the Google account.
2. Create an app password for the mail client or script.
3. Use that generated password in the SMTP login call.
4. Keep the full Gmail address as the username.

If the app supports OAuth directly, that is better than app passwords. Google explicitly recommends Sign in with Google when the app can do it.

Why Old "Less Secure App" Advice Is Dangerous

A lot of older blog posts recommend enabling "less secure apps." That guidance is outdated. Google Workspace documentation now says password-only access from less secure apps is no longer supported, and the long-term direction is clearly OAuth-first.

So if you are maintaining older code, do not spend time looking for a hidden toggle that used to relax Gmail security. In many accounts it is gone, and even where app passwords still exist, they are a fallback, not the primary recommendation.

A Better Pattern for Production Systems

If you are sending operational or transactional mail from a server application, treat Gmail SMTP as a compatibility option, not a universal mail backend. For production systems, consider whether one of these fits better:

• Gmail API with OAuth
• Google Workspace SMTP relay for managed organizational use cases
• a dedicated transactional mail provider

The error in the article title often appears when people try to force a consumer-style mailbox login into a server-side automation workflow that really wants service-oriented credentials.

Debugging Checklist

When the error persists, check these items in order:

1. Confirm the account can sign in normally in the browser.
2. Confirm the SMTP host is smtp.gmail.com.
3. Confirm you are using port 587 with STARTTLS or 465 with SSL.
4. Confirm the username is the full email address.
5. If using 2-Step Verification, replace the regular password with an app password.
6. If the app supports OAuth, prefer that over password-based SMTP.

That sequence finds the cause faster than guessing at random account settings.

Common Pitfalls

The biggest mistake is using the normal Google account password in an application that really needs an app password or OAuth.

Another mistake is enabling TLS incorrectly. Port 587 expects a plain connection first and then STARTTLS; port 465 expects SSL from the start. Mixing those modes produces confusing authentication failures.

Developers also often rely on old tutorials that tell them to enable less secure app access. That advice is outdated and can send you looking for settings that no longer exist.

Finally, do not hardcode credentials directly in source files. Even for a quick test, use environment variables or a secret manager.

Summary

• Gmail SMTP requires both secure transport and successful authentication.
• Use smtp.gmail.com with STARTTLS on port 587 or SSL on port 465.
• For many current Google accounts, app passwords require 2-Step Verification and work only when the app cannot use Sign in with Google.
• Old "less secure apps" guidance is no longer a reliable fix.
• If the workflow is server-side and long-lived, OAuth or a dedicated mail service is usually a better design.