Gmail IMAP and SMTP Settings for Cold Email Tools (2026)

Gmail IMAP settings take ten seconds to copy: imap.gmail.com, port 993, SSL. Connecting the inbox to a cold email tool is where it breaks, usually with Application-specific password required or Error 400: admin_policy_enforced.

Most settings guides still tell you to switch IMAP on and allow less secure apps. Neither step exists anymore. Google removed the IMAP toggle for personal Gmail in January 2025 and turned off password-only sign-in for every Google account on March 14, 2025.

This guide lists the current Gmail and Google Workspace IMAP, SMTP and POP settings, then covers the two sign-in methods that still work: OAuth and app passwords. It walks through the Workspace admin settings, connecting Instantly, Smartlead and other sequencers, and a fix for every common error. Settings were checked against Google’s help center in October 2026, and we ran the connection tests below against Gmail’s servers on October 18, 2026.

TL;DR: Gmail IMAP Settings

• IMAP: imap.gmail.com, port 993, SSL/TLS. The username is the full email address.
• SMTP: smtp.gmail.com, port 465 with SSL/TLS or port 587 with STARTTLS. Authentication is required.
• Google Workspace uses the same servers for addresses on your own domain.
• IMAP is always on for personal Gmail since January 2025. In Workspace, an admin controls it under End User Access.
• Your normal password no longer works in third-party tools. Use Sign in with Google (OAuth) or a 16-character app password.
• Workspace OAuth often needs an admin to mark the cold email tool as Trusted in API controls. Otherwise users hit admin_policy_enforced.
• Send 30 to 50 cold emails per inbox per day. The 2,000 a day limit is a ceiling, not a target.

Gmail IMAP, SMTP and POP Settings

Gmail IMAP settings are imap.gmail.com on port 993 with SSL/TLS. Gmail SMTP settings are smtp.gmail.com on port 465 with SSL/TLS, or port 587 with STARTTLS. Both use the full email address as the username and sign in with OAuth or an app password. Cold email tools send sequences over SMTP and read replies, run warmup and fill the shared inbox over IMAP.

The values are identical for @gmail.com accounts and Google Workspace addresses such as sam@yourdomain.com. You do not need a custom server name for your domain.

One server to ignore: smtp-relay.gmail.comis Workspace’s SMTP relay service, which admins configure for printers, apps and servers. Cold email tools do not use it. They sign in to each mailbox through smtp.gmail.com.

Running Microsoft inboxes as well? Our Office 365 SMTP settings guide covers smtp.office365.com, SMTP AUTH and Microsoft’s own errors.

IMAP options that still live inside Gmail

Gmail’s web settings still matter, even without an IMAP switch. Two places affect cold email tools:

• Settings > See all settings > Forwarding and POP/IMAP: folder size limits and what happens when a client deletes a message. Leave the defaults unless a tool asks otherwise.
• Settings > Labels: each label has a Show in IMAP checkbox. Keep it ticked for Inbox, Sent Mail and Spam. Reply detection reads the inbox, and warmup tools pull warmup emails out of Spam over IMAP.

Port 465 or 587 for Gmail SMTP?

Both work. Gmail accepts authenticated submission on either port, and the choice only changes how encryption starts.

• Port 465 (SSL/TLS):the connection is encrypted from the first byte. Pick this when the tool’s form says SSL.
• Port 587 (STARTTLS): the connection opens in plain text, then upgrades to TLS. Pick this when the form says TLS or STARTTLS.
• Port 25: meant for server-to-server delivery and often blocked by ISPs and cloud hosts. Do not use it for sending from a cold email tool.

Do You Still Need to Enable IMAP in Gmail?

For personal Gmail, no. Google’s IMAP help page says IMAP access is always turned on. The Enable IMAP option was removed in January 2025, and existing connections kept working. Any guide that tells you to tick that box is describing a setting that no longer exists.

For Google Workspace, it depends on your admin. Admins can switch IMAP off for the whole domain or for one organizational unit. Some Workspace users do not see the Forwarding and POP/IMAP tab at all for the same reason. If a cold email tool reports that the account is not enabled for IMAP use, the fix is in the Admin console, not in Gmail.

One limit catches cold email teams: Gmail allows up to 15 simultaneous IMAP connections per account. A sequencer, a separate warmup tool, a CRM sync, a phone and a desktop client on one inbox add up fast. Past 15, new connections fail with Too many simultaneous connections.

Google Workspace Admin Settings for Cold Email

Three Admin console settings decide whether a cold email tool can connect a Workspace inbox. Changes can take up to 24 hours to apply, so make them before you buy and connect a batch of inboxes.

1. Turn on IMAP for the sending users

1. Sign in at admin.google.com with the Gmail Settings admin privilege.
2. Go to Menu > Apps > Google Workspace > Gmail > End User Access.
3. Under POP and IMAP access, tick Enable IMAP access for all users.
4. Choose Allow any mail client. If security requires Restrict which mail clients users can use, add the cold email tool’s OAuth Client ID to the allowed list.
5. Save. Allow up to 24 hours for the change to apply.

Google documents each option in Turn POP and IMAP on or off for users. Tip: put sending inboxes in their own organizational unit, so you can loosen settings for them without touching the rest of the company.

2. Mark the cold email tool as Trusted

1. Go to Menu > Security > Access and data control > API controls.
2. Click Manage Third-Party App Access, then Configure new app.
3. Paste the tool’s OAuth Client ID into the search box. Copy it from the tool’s connect screen, because IDs change.
4. Select the app, choose the organizational unit, set access to Trusted, and finish.

Per Google’s API controls documentation, apps can be Trusted, Limited, limited to specific Google data, or Blocked. Pick Trusted. If your admin has restricted Gmail as a service, only Trusted apps can read and send mail.

Also check the setting for unconfigured third-party apps on the same page. The default allows any app. If it was changed to basic sign-in info only, or to no third-party apps, every tool you have not configured will be blocked.

3. Allow 2-Step Verification for app passwords

Only needed if you plan to use app passwords. Under Security > Authentication > 2-step verification, let users turn it on. If your policy enforces security keys only, app passwords are not available and OAuth is the only route.

OAuth vs App Passwords: Which Sign-In to Use

Two sign-in methods remain. Google ended less secure app access for personal accounts in 2022, then for all Workspace accounts on March 14, 2025. Its transition notice is direct: IMAP, SMTP and POP no longer work with legacy passwords, with the exception of app passwords.

Default to OAuth.Google calls app passwords not recommended and unnecessary in most cases, and OAuth does not need 2-Step Verification or stored passwords. Use an app password when a tool only shows SMTP and IMAP fields, or when your Workspace admin will not trust the tool’s OAuth app.

How to Create a Gmail App Password

1. Turn on 2-Step Verification under myaccount.google.com > Security.
2. Open myaccount.google.com/apppasswords.
3. Name it after the tool and inbox, for example Smartlead inbox 03, then click Create.
4. Copy the 16-character code. Google shows it once, in four groups of four letters.
5. Paste it into the tool’s SMTP and IMAP password fields without spaces. The username stays your full email address.

If the App passwords page is missing, check Google’s app password help. The usual causes are 2-Step Verification being off, 2-Step Verification set up only with security keys, Advanced Protection, or a work account that blocks the option.

Connect Gmail to Instantly

Instantly connects Google Workspace inboxes through OAuth, with an app password option for tools-only setups. For Workspace, the admin step comes first.

1. In Instantly, open Email Accounts, click Add New, and choose Google. Pick the OAuth option and copy the Client ID it shows.
2. In the Google Admin console, open Security > Access and data control > API controls > Manage Third-Party App Access > Configure new app.
3. Paste the Client ID. Searching for the name Instantly does not find it.
4. Select the Instantly app, apply it to all users or the sending organizational unit, set it to Trusted, and finish.
5. Back in Instantly, click Login, choose the inbox, and allow every requested permission.
6. Repeat per inbox. If only the admin account appears, click Use another account or open an incognito window.

Prefer app passwords? Pick the app password option instead and enter the IMAP and SMTP settings from the table above. For a wider look at the platform, read our Instantly review or see the SyncGTM and Instantly integration.

Connect Gmail to Smartlead

Smartlead offers Google OAuth and a manual SMTP connection. It recommends OAuth because no password is stored and disconnects are rarer.

• OAuth:go to Email Accounts > Add Account and choose Google. If your Workspace restricts third-party apps, trust Smartlead’s Client ID in API controls first, the same way as Instantly.
• SMTP with an app password: choose the SMTP option and enter smtp.gmail.com on port 465 with SSL, and imap.gmail.com on port 993 with SSL. Use the full email address and the app password, click Test Connection, then check Gmail for the test email.

Comparing sequencers before you connect fifty inboxes? See our Smartlead review, the Smartlead vs Instantly comparison, and the SyncGTM and Smartlead integration.

Other Sequencers: Manual IMAP and SMTP

Most cold email platforms offer a Sign in with Google button. Use it when it is there. When a tool only shows server fields, map them like this:

Fill in both halves. A tool with working SMTP and broken IMAP still sends, but it misses replies and keeps emailing people who already answered.

Gmail Sending Limits vs Safe Cold Email Volume

Google publishes hard limits for personal Gmail and for Google Workspace. Treat them as the point where Google stops you, not as a sending plan.

Trial Workspace accounts stay at the lower limits until the domain has paid at least $100 in total, and the increase can take up to 75 days. Buy paid seats for sending inboxes from day one.

For cold email, keep each warmed inbox at 30 to 50 sends per day and scale by adding inboxes and domains. New inboxes start lower and ramp over several weeks; our Gmail warmup guide and email warmup schedule show the ramp. Skip @gmail.com addresses for outreach entirely; see the best email hosting for cold email instead.

Volume to Gmail recipients has its own rules. Google’s sender guidelines require all senders to keep spam rates under 0.3%. Anyone sending 5,000 or more messages a day to personal Gmail accounts also needs SPF, DKIM and DMARC, an aligned From domain and one-click unsubscribe for marketing mail.

Gmail IMAP and SMTP Errors and Fixes

Cold email tools usually pass Gmail’s raw error through. Match the text to the table below. Google keeps the full list in Gmail SMTP errors and codes.

Bounces cause sending blocks too. Our guide to soft bounce emails explains how to catch them before they turn into a lockout.

Blocked Sign-Ins and OAuth Errors in Google Workspace

OAuth errors appear in the Google pop-up, not in the cold email tool. Almost all of them trace back to a Workspace policy, so the fix usually needs an admin.

Checklist when sign-in is blocked

1. Confirm the person adding the inboxes is a Workspace admin, or has one on hand.
2. Copy the Client ID from the tool’s current connect screen, not from an old screenshot.
3. Check that no child organizational unit overrides the Trusted setting for the sending inboxes.
4. Confirm IMAP is on for that organizational unit and, if restricted, lists the tool’s Client ID.
5. Reconnect in an incognito window and approve every permission on the consent screen.

How to Test Gmail IMAP and SMTP Connections

Before blaming the tool, check that your network reaches Gmail. We ran these commands on macOS on October 18, 2026. IMAP answered with the Gimap ready banner, and both SMTP ports listed the same sign-in methods.

# IMAP on 993: expect "* OK Gimap ready for requests from ..."
openssl s_client -connect imap.gmail.com:993 -crlf -quiet

# Optional login test with an app password, typed after the banner
a1 LOGIN sam@yourdomain.com abcdefghijklmnop
a2 LOGOUT

# SMTP on 587 with STARTTLS: type EHLO and expect a 250-AUTH line
openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf -quiet
EHLO test

# SMTP on 465 with implicit TLS: expect "220 smtp.gmail.com ESMTP ... gsmtp"
openssl s_client -connect smtp.gmail.com:465 -crlf -quiet

250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER XOAUTH

XOAUTH2 and OAUTHBEARER are the OAuth methods, and LOGIN and PLAIN accept app passwords. If the banner appears but a tool still cannot sign in, the problem is authentication, not networking. Go back to the error tables. Do not paste a live app password into a shared terminal or screen recording.

SPF, DKIM and DMARC for Google Workspace

Correct IMAP and SMTP settings connect the inbox. DNS authentication decides whether its mail lands in the inbox. Every Workspace sending domain needs all three records.

SPF    TXT  @                   v=spf1 include:_spf.google.com ~all
DKIM   TXT  google._domainkey   v=DKIM1; k=rsa; p=<key generated in the Admin console>
DMARC  TXT  _dmarc              v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

• SPF: one record per domain with include:_spf.google.com. Merge includes if another service sends for the same domain.
• DKIM:generate a 2048-bit key under Apps > Google Workspace > Gmail > Authenticate email, publish the TXT record, then click Start authentication. Google’s DKIM setup guide has the details, and our Gmail DKIM guide covers troubleshooting.
• DMARC: start at p=none to collect reports, then move to quarantine once SPF and DKIM pass.

For the full domain setup and ramp, read our email domain warmup guide. To see where mail actually lands, use one of the best inbox placement testing tools.

Protect Gmail Inboxes With Clean Lists

Bounces are one of the fastest ways to lose a Google Workspace inbox. Google itself warns that messages bouncing from invalid addresses can pause sending for up to 24 hours, and repeated bounces damage the domain’s reputation for weeks.

SyncGTM verifies every address before it reaches your sequencer. Email verification costs 0.1 credits per address, and finding a work email costs 1 credit, with no charge when nothing is found.

Lookups run through a waterfall of 50+ data providers, then clean leads sync into Instantly, Smartlead or your CRM. See SyncGTM pricing for credit packs.

Conclusion

The Gmail IMAP settings fit on one line: imap.gmail.com, port 993, SSL/TLS. SMTP is smtp.gmail.com on 465 or 587. Most failures come from sign-in rules around those settings, not from the settings themselves.

Connect with OAuth, have your Workspace admin trust the cold email tool and keep IMAP on for sending inboxes. Fall back to one app password per tool, and keep each inbox at 30 to 50 sends a day.

Then keep every list clean with SyncGTM so bounces never put your Gmail inboxes on pause.