What to Use, When to Use It, and Why It Breaks at 2AM
Email delivery looks simple from the outside. A button says “Send”. A message flies away. Magic. ✨
Behind that button lives SMTP. A protocol older than most frontend frameworks and still more reliable than half of them.
Let’s dissect it properly. Clean. Practical. No fluff.
📡 What Is SMTP?
SMTP stands for Simple Mail Transfer Protocol.
It is the protocol used to send emails between servers and from applications to mail servers.
It does not handle inbox reading. That’s IMAP or POP3.
SMTP is the delivery truck. 🚚
🧩 Core SMTP Configuration Fields
When configuring SMTP in Node.js, NestJS, or any backend, you usually see:
{
host: "",
port: 000,
secure: false,
auth: {
user: "",
pass: ""
}
}
Let’s decode each part.
1️⃣ host
The SMTP server address.
Examples:
-smtp.gmail.com
-smtp.sendgrid.net
-mail.yourdomain.com
This is where your app connects to send mail.
2️⃣ port
The communication channel. Different ports = different security expectations.
Here’s the real breakdown 👇
Port Usage Secure Value
465 SSL/TLS (immediate encryption) true
587 STARTTLS (recommended) false
2525 Alternative to 587 false
25 Server to server (often blocked) false
🔐 Port 465
port: 465,
secure: true
Encryption starts immediately.
Use when:
Provider explicitly supports SSL on 465
Corporate mail setups
Traditional configurations
🤝 Port 587 (Recommended)
port: 587,
secure: false
Connection starts normal, then upgrades to TLS.
Use when:
Sending transactional emails
Production apps
Gmail, SendGrid, Mailgun setups
This is the industry standard.
🛟 Port 2525
port: 2525,
secure: false
Used when:
587 is blocked by firewall
Cloud providers restrict port 25
Hosting environments limit SMTP traffic
Think of it as the reliable backup lane.
⚠️ Port 25
Old-school SMTP. Mostly used for server-to-server communication.
Avoid for application-level sending unless specifically required.
🔑 secure: true vs secure: false
This setting controls how encryption is initiated.
secure: true
SSL from first byte
Used with port 465
secure: false
Uses STARTTLS
Encryption begins after connection
Used with 587 or 2525
Common mistake:
port: 587,
secure: true ❌
That causes handshake failure.
🔐 auth
Authentication credentials.
auth: {
user: process.env.SMTP_USER,
pass: process.env.SMTP_PASS
}
Best practices:
Never hardcode credentials
Use environment variables
Prefer app passwords for Gmail
Use API-based mail providers in production
🏗 Where to Use SMTP?
1️⃣ Small Apps / MVPs
Use:
Gmail SMTP
Port 587
secure: false
Good for:
Internal tools
Testing
Early-stage projects
2️⃣ Production SaaS / Enterprise Apps
Use:
SendGrid
Mailgun
Amazon SES
Dedicated SMTP relay
Why?
Better deliverability
SPF, DKIM, DMARC support
Rate limiting protection
Analytics & bounce handling
3️⃣ High-Scale Notification Systems
If you’re building something like:
OTP systems
Approval workflows
Finance notifications
Campaign systems
You should:
Separate email service layer
Use queues (BullMQ / RabbitMQ / NATS)
Implement retry logic
Track bounce & failure states
SMTP alone is transport. Reliability comes from architecture.
🧠 Production Best Practices
✅ Always Enable TLS
Even if secure: false, STARTTLS should be enabled.
✅ Configure SPF, DKIM, DMARC
Without these, emails land in spam.
✅ Use a Dedicated Domain
Don’t send from personal Gmail in production.
✅ Handle Failures Gracefully
SMTP servers can throttle or reject.
✅ Use Connection Pooling
In high-volume systems.
Example:
{
pool: true,
maxConnections: 5,
maxMessages: 100
}
🧨 Why SMTP Config Fails
Most common reasons:
Port and secure mismatch
Firewall blocking outbound SMTP
Wrong credentials
TLS version mismatch
Provider rate limits
Debug tip: Always enable logging during setup.
🚀 Example: Clean Production Configuration
{
host: process.env.SMTP_HOST,
port: 587,
secure: false,
auth: {
user: process.env.SMTP_USER,
pass: process.env.SMTP_PASS
},
tls: {
rejectUnauthorized: true
}
}
Simple. Predictable. Stable.
📌 Final Mental Model
SMTP is not email marketing.
SMTP is not analytics.
SMTP is not inbox management.
SMTP is transport.
Think of it like TCP for email.
Reliable when configured properly. Brutal when misconfigured. 📡
If you want, I can also write:
📊 A version comparing SMTP vs Email APIs
🏗 A NestJS-specific SMTP implementation guide
🔐 A deep dive into SPF/DKIM/DMARC
Choose your weapon.
Top comments (0)