Connecting to Servers

00:00 In the previous lesson, I showed you how to add attachments to your email and to use the fancier recipient fields. In this lesson, I’ll talk about connecting to real mail servers.

00:10 The first mail servers existed in the private world of ARPANET, and nobody was worried about anyone pretending to be anyone else. You connected to the server, said who you were, and who you were messaging, and that was it. There was no way to verify the sender and anyone who could get to your machine could message you.

00:28 Technically, there still is no way of verifying the sender, since anyone can set up a mail server, but servers do now stop just anyone from connecting. If you want to use most servers, you’re going to need to authenticate in order to send mail through them.

00:42 There are a few different ways of doing that, starting with the usual username and password pair, while fancier systems, especially those that allow programs to connect, will use key systems like OAuth 2.

00:55 SMTP is a plain text protocol, which means anyone can see what is going on. Modern servers tend to wrap this in SSL or TLS encryption. Sending to a server that uses this means a couple of extra steps.

01:08 You’ll need to create an SSL context and substitute your SMTP class with the SMTP_SSL version instead. Thankfully, Python takes care of most of the hard stuff here for you.

01:22 If you have a Gmail account, Google allows you to use their SMTP server to send mail. It does require authentication though, and it’s a little more complicated than just using your username and password.

01:33 It used to allow that, but as of 2025, you have to use a separate authentication method from the one you use to log in. You can set up keys to use OAuth 2, or the version I’m going to demonstrate uses app passwords.

01:48 These are special passwords you set up in your account which are only for connecting from a program. If you’re going to experiment with sending through Gmail, I suggest setting up a dummy account.

01:58 If anything goes too wrong and Google decides to shut you down, you don’t want that to be your real email address. To set up a new account, go to gmail.com and choose Sign Up.

02:08 You’ll need a name, birthday, gender, and unique email address. The first three can be anything you want. A unique email address though can be a little tricky these days.

02:18 All the good ones are long gone. I had to add six digits to the end of my first attempt to get something that didn’t exist already. A nice feature of Gmail is the plus modifier.

02:29 Gmail ignores anything after the plus symbol in an email address. So Bob, Bob plus Dev1, and Bob plus Dev2 at Gmail all go to the same account. This is handy if you’re playing around as you can specify multiple recipients with only a single account.

02:45 This is also handy to see who sold your email address by putting a suffix on your address when you sign up for something. That said, some sign up filters think plus isn’t a valid address character and won’t let you do this. Plus is a valid address character, but lots of the JavaScript regexes for validating an email address are very, very broken.

03:05 Let’s move on before I get all ranty.

03:09 For your program to authenticate to Gmail’s server, you’ll need an app password. That’s a special password separate from your account one. You can set up a bunch of these if you like, which is handy because then you can use a different app password for different scripts.

03:23 And if something goes awry, you can just turn off that one password. Although Google does allow you to have a Gmail account without two-factor authentication turned on, it requires you to be using 2FA to be able to configure an app password.

03:37 Google supports multiple 2FA mechanisms. If you’re okay with giving them your phone number, you can use SMS. If you’ve already got an authenticator app, you can use that instead.

03:48 You’ll find the 2FA configuration in your account settings. Note that this is not the mail settings, but the account settings for your Google account. Click on your avatar and choose Manage Google Account to get there. Or at least that’s what it said when I recorded this.

04:04 Their UI guys get a little antsy and change things sometimes.

04:08 Once you’re in the management screen, you’ll see Security and Sign-in on the left-hand side. 2FA configuration is on that screen.

04:16 My first attempt at doing this failed. I added the 2FA mechanism with no problem, but missed the fact that turning it on was a separate step. Once you’ve added your mechanism, make sure that 2FA is enabled as well.

04:29 With all that done, visit this URL to add an app password and follow the instructions on the screen. If it tells you that your account isn’t configured to add an app password, first, make sure you’re using 2FA.

04:42 Second, if you’re using a corporate Gmail account rather than a dummy one, it’s possible you’re not allowed to do it. That’s a lot. Hopefully it goes smoothly.

04:51 Once you’ve got it set up, you can connect to the server. Let me show you how. Another new copy of my program. secure_send.py this time. You should never store passwords in your code.

05:03 I’m going to use the getpass module to ask the user for the app password before sending. Note that I’ve changed the hostname and port to point to the Gmail server.

05:13 Port 465 is the TLS port, or SSL, for SMTP. Up until now, I’ve been using bob@example.com. Of course, if you’re really going to do this, you need your script to have real data.

05:27 Make sure your sender matches the account that you’re connecting with.

05:30 The getpass() function is like Python’s input(), except it doesn’t show what got typed on the screen. Calling it prompts the user for a password, which you can then use to connect.

05:41 To connect with SSL, first, you need an SSL context. You get one of these with the create_default_context() function in the ssl module.

05:51 The other part of using SSL is switching to the SMTP_SSL class. This is similar to the regular SMTP class, but you need to pass in that context that you just created in order to get going.

06:04 Everything else you did with EmailMessage is just like before. The only new thing you have to do is log into the server before sending the message.

06:13 You do that with the username and app password, which is what the script prompted you for. Note that the app password is a 16-letter value. To make it easier to read, Google will display it to you in four-letter groupings.

06:27 When you type it in, don’t include the spaces. You just want the 16 values. Let’s try this out. Running the script.

06:37 Entering my app password. And that’s it. Nothing else to see on the command line unless something went wrong. To verify it worked, just go to your inbox. A simple test message like the one I wrote here is very likely to end up in your spam folder.

06:52 If you’re debugging, there are two things you can do. First, seeing as you sent the email, it should show up in your sent folder. Check there first to make sure it worked.

07:02 And then, of course, if you sent it to yourself, or you have access to whatever account you sent it to, check the spam folder in there for the result.

07:11 This lesson was Gmail-specific. Most of it, though, will work with other providers. Next up, I’ll point you at a few other places you can use instead of Gmail if you’re interested.