Why Gmail SMTP?
There are a lot of email services out there, and most tutorials pick one without explaining why. Here's the actual reasoning — what the options are, what disqualifies most of them for getting started, and when to revisit the choice.
The one requirement
To send email from your app during development, you need a service that can deliver to any inbox without domain verification.
Domain verification means adding DNS records (DKIM, SPF, DMARC) to a custom domain you own. It's the right long-term move for production, but it's a 30-minute detour that has nothing to do with writing your first email-sending code. The goal right now is to see an email arrive in a real inbox.
Most transactional email services require domain verification before they'll deliver to anyone but you. That disqualifies them for getting started.
Gmail SMTP
You already have a Gmail account. Gmail lets you use it as an SMTP sender — your app connects to smtp.gmail.com and sends email through your Google account.
Setup is two steps: turn on 2-Step Verification, then generate an app password. That's it — no new account, no signup friction.
Limits: 500 emails/day on a free @gmail.com account, 2,000/day on Google Workspace.
Honest caveats: Gmail SMTP is not meant for production app email at scale. Google's terms don't allow bulk automated sending, and they may throttle patterns that look like automated mail. It's excellent for development and small-scale use, but when your app grows past a handful of users you'll want to swap in a dedicated service.
Why not the others?
The rest don't clear the bar:
| Service | The issue |
|---|---|
| Resend | Without a verified domain, you can only send to the account owner's email. Anyone else gets blocked. |
| Brevo | Since early 2024, requires domain authentication. Without it, your sender domain is replaced with @brevosend.com. |
| SendGrid | Dropped their free tier in May 2025. Now a 60-day trial only, then paid. |
| SMTP2GO | Signup requires a work/private-domain email (no Gmail/Yahoo). That adds friction for first-time builders. |
| Mailjet | Onboarding mixes transactional and marketing email, which adds extra decision points and setup friction for first-time builders. |
| MailerSend | Requires domain DNS records — no verified-sender email path. |
| Amazon SES | Sandbox mode restricts delivery to pre-approved recipients only; production access requires manual review. |
When to add a dedicated email service
Once you have a domain and real users, swap Gmail SMTP for a dedicated transactional email service with domain verification (DKIM + SPF records). This improves deliverability, unlocks higher sending limits, and makes your "from" address look like your brand instead of a personal email.
There's a broader reason this matters: in early 2024, Gmail and Yahoo tightened their DMARC enforcement. If your app sends email from a @gmail.com or @yahoo.com address through a third-party relay, the SPF/DKIM records won't align with the sending domain — and inbox providers can reject or junk it. Using a verified custom domain sidesteps this entirely.
The swap is straightforward — change SMTP_CONFIG to point at your new provider. The Nodemailer code stays the same.