# Yahoo SMTP settings: outgoing server, ports, TLS, and app passwords > Configure Yahoo's outgoing mail server with smtp.mail.yahoo.com, port 465 or 587, authentication, your full address, and the appropriate secure sign-in method. - **Category:** Developer Guide - **Published:** August 4, 2026 - **Reading time:** 12 min read - **Author:** Maya Chen, Deliverability - **Canonical page:** [https://emailbump.com/blog/yahoo-smtp-settings](https://emailbump.com/blog/yahoo-smtp-settings) Yahoo's published outgoing SMTP server is smtp.mail.yahoo.com. Yahoo lists ports 465 or 587, requires SSL, and requires authentication. Use your full Yahoo email address as the username. For a third-party application that cannot use Yahoo's branded sign-in flow, Yahoo instructs users to generate a third-party app password rather than exposing the normal account password. ### Yahoo outgoing mail settings, August 2026 ```text SMTP server smtp.mail.yahoo.com Port 465 or 587 Authentication required Username full Yahoo email address Password Yahoo-supported sign-in or generated app password Encryption SSL/TLS required Port 465 commonly uses implicit TLS. Port 587 commonly begins plaintext and upgrades with STARTTLS. Match the client setting to the chosen port. ``` > **Check Yahoo Help before configuring a new client** > > Server settings and account-security flows can change. The values here were checked against Yahoo's official IMAP and POP setup pages on August 4, 2026. Use Yahoo's current account-specific instructions if the interface or supported sign-in method differs. ## Port 465 vs 587 for Yahoo SMTP ### 465 **Implicit TLS** The TLS connection begins immediately. A client may label this SSL/TLS, TLS from connection, or secure connection. ### 587 **Message submission with STARTTLS** The client connects, requests STARTTLS, negotiates TLS, and then authenticates. Require the upgrade rather than allowing plaintext fallback. Do not configure port 465 with a STARTTLS-only toggle or port 587 as implicit TLS unless the client explicitly documents that behavior. A mode mismatch often looks like a timeout, reset, unreadable greeting, or TLS handshake failure rather than a useful Yahoo authentication response. ## How to configure a Yahoo account in a mail client - Prefer the Yahoo provider button in a modern client. It can launch Yahoo's secure sign-in flow and avoid storing a reusable account password in the application. - If manual settings are required, enter smtp.mail.yahoo.com as the outgoing host and choose either 465 with implicit SSL/TLS or 587 with required STARTTLS. - Enable outgoing-server authentication and use the complete Yahoo address—not only the portion before @—as the username. - Use the Yahoo-supported credential for that client. When the app does not use Yahoo's sign-in page, generate a dedicated third-party app password from Account Security. - Send one message to an external account, reply to it, and inspect the sent folder and received headers before assuming setup is complete. ## How Yahoo app passwords work Yahoo describes an app password as a randomly generated credential for a non-Yahoo application. Create it under Account Security → External connections → Create app password, name the application, and enter the generated value into that application's password field. Availability depends on Yahoo's account-security flow and eligibility checks. - Create a separate app password per application so one client can be revoked without disrupting the others. - Store it in the operating system credential store or a secrets manager, never in frontend code, a repository, screenshot, or support ticket. - Yahoo says app passwords can remain active after the main account password changes; delete the app password to invalidate it. - If a client is lost, retired, or compromised, revoke its credential and review recent account activity. - Use the Yahoo sign-in flow instead when the mail client supports it and Yahoo recommends it. ## Yahoo SMTP vs IMAP and POP ### Different protocol roles ```text SMTP smtp.mail.yahoo.com 465 or 587 SEND outgoing messages IMAP imap.mail.yahoo.com 993 SYNC mailbox and folders POP pop.mail.yahoo.com 995 DOWNLOAD messages Yahoo publishes SSL requirements for these routes. SMTP settings alone do not configure incoming-mail synchronization. ``` IMAP normally fits multiple-device mailbox use because changes synchronize with the server. POP downloads mail under client-specific retention behavior. Neither incoming protocol replaces SMTP for sending. If an application only needs to send product email, a consumer mailbox is usually the wrong transport altogether. ## Troubleshoot Yahoo SMTP authentication failures - Sign in to Yahoo Mail in a browser. Complete any recovery, verification, password-change, or account-security prompt there first. - Confirm the host, port, encryption mode, full-address username, and authentication setting exactly. - If the client has a Yahoo provider option, remove and re-add the account through that flow instead of preserving old manual credentials. - For a manual or legacy client, generate a new app password and replace the old app-specific credential; do not paste the normal password repeatedly. - Preserve the complete SMTP response and distinguish connection, TLS, AUTH, sender, recipient, and DATA failures. - Stop repeated failed logins to avoid account lockouts and noisy security alerts. ## Common Yahoo SMTP failure patterns ### Timeout **Endpoint, port, firewall, or TLS-mode mismatch** Verify network reachability and the exact encryption mode before changing credentials. ### Authentication failed **Wrong identity, credential type, or security state** Use the full address and Yahoo's current secure sign-in or app-password route. ### Can receive but not send **Incoming works; SMTP configuration does not** IMAP success does not prove the outgoing host, port, TLS, or authentication settings. ### Can send in webmail only **Account works; third-party client path is broken** Re-add through Yahoo sign-in or rotate the application's app password. ### From rejected **Authenticated identity cannot use that sender** Authenticate as the actual account and use only Yahoo-authorized aliases or From identities. ## Should an application use Yahoo SMTP? Yahoo SMTP is designed to send mail for a Yahoo mailbox through supported clients. It is not a production email API or bulk campaign service. Product email needs documented throughput, idempotency, bounded retries, bounce and complaint processing, suppressions, verified-domain authentication, and separation from a person's mailbox access. Do not work around mailbox sending limits with multiple Yahoo accounts or credential rotation. For receipts, password resets, alerts, and newsletters, choose an application or campaign platform that supports the message class and recipient permission model. ## Use a verified application sending route Keep transactional messages independent from a Yahoo mailbox login and preserve delivery, bounce, and complaint evidence for every send. - Verified sending domains - Application-specific credentials - Message-level delivery activity [Learn more](https://emailbump.com/signup) ## Frequently asked questions ## What is the Yahoo outgoing mail server? Yahoo currently publishes smtp.mail.yahoo.com with port 465 or 587, SSL required, and authentication required. Use the full email address and the credential method Yahoo supports for the client. ## Why does my normal Yahoo password fail in SMTP? The application may need Yahoo's secure provider sign-in or a third-party app password. Yahoo blocks outdated sign-in approaches and directs users of non-Yahoo apps to its current security options. Repeatedly entering the normal password is not a reliable fix. ## Is Yahoo SMTP free? SMTP access is part of supported Yahoo Mail use, subject to the account's current terms, security requirements, and sending limits. That does not make it a free bulk or application-email service. ## Finish the SMTP setup - [SMTP server settings](https://emailbump.com/blog/smtp-server-settings) — Understand the host, port, TLS, authentication, envelope, and timeout fields. - [SMTP ports](https://emailbump.com/blog/smtp-ports-25-465-587-2525) — Separate implicit TLS on 465 from submission with STARTTLS on 587. - [SMTP 535 authentication](https://emailbump.com/blog/smtp-535-authentication-failed) — Diagnose rejected credentials, mechanisms, and account policy. - [Email API guide](https://emailbump.com/blog/email-api) — Choose a production transport for application-generated mail. ## Sources - [Yahoo Help: IMAP and SMTP server settings](https://help.yahoo.com/kb/imap-internet-message-access-protocol-sln4075.html) - [Yahoo Help: generate and manage third-party app passwords](https://help.yahoo.com/kb/account/confirm-delete-password-sln15241.html) - [Yahoo Help: securely access Yahoo Mail](https://help.yahoo.com/kb/account/SLN27791.html)