Zoho SMTP Settings for 2026: Hosts, Ports and Fixes

Do not index

For outgoing mail, use smtp.zoho.com on port 465 with SSL/TLS or port 587 with TLS/STARTTLS, and for incoming mail use imap.zoho.com on port 993 with SSL/TLS. Paid organization accounts on a custom domain use smtppro.zoho.com for SMTP instead. A password reset flow, an invoice job or a contact form usually fails at this exact point, not because Zoho Mail is down, but because one value in the matched set does not fit the others.

Table of Contents

Zoho SMTP and IMAP Settings at a Glance Default Zoho Mail SMTP and IMAP settings Which Zoho Hostname to Use for Your Account and Region Zoho SMTP and IMAP hosts by account type and data center How to confirm the host for an account How SSL, TLS and Login Authentication Work in Zoho What happens on each port How the login ties to the sender How to Turn On IMAP and SMTP Access in Zoho Mail Steps to enable access What a missing setting looks like How to Send Mail Through Zoho SMTP From Code The three lines that break most often How to Verify Zoho SMTP and IMAP with mailX Step 1. Test SMTP sending Step 2. Test IMAP reading Step 3. Repeat with the regional host when needed Common Zoho SMTP Mistakes and How to Fix Them Zoho SMTP mistakes, symptoms and fixes Confirm Your Zoho Settings Before You Deploy Final checks in order

Zoho SMTP and IMAP Settings at a Glance

For a personal @zohomail.com account or a free organization account, the default Zoho SMTP settings use smtp.zoho.com for sending and imap.zoho.com for reading. Paid organization accounts on a custom domain use smtppro.zoho.com for sending instead.

Default Zoho Mail SMTP and IMAP settings

Use	Host	Port	Encryption	Authentication
Outgoing mail, implicit SSL	smtp.zoho.com	465	SSL/TLS from the start of the connection	Required
Outgoing mail, STARTTLS	smtp.zoho.com	587	STARTTLS upgrade after connecting	Required
Incoming mail, IMAP	imap.zoho.com	993	SSL/TLS	Required, IMAP access enabled

Every SMTP connection requires authentication. The username is the full Zoho Mail address, not the part before the @ sign. The password is the account password, or an app-specific password when two-step verification is on.

These values describe a default account. Regional data centers use different hostnames, and Zoho can change account defaults, so the values should be confirmed in Zoho's official documentation before an application relies on them. Teams comparing mail clients, plugins and sending utilities often start from curated roundups such as Awesome Tools email picks, then still need the exact host and port pair from the table for the account in front of them.

Once the values are entered, run a SMTP connection test with mailX to confirm the server accepts the connection before the application sends real mail.

How to verify it: A good result shows connection, encryption and authentication succeeding on the chosen port. A bad result separates the cause, because a timeout points to the host or network, a TLS error points to the encryption pairing, and an authentication failure points to the username or password type.

Which Zoho Hostname to Use for Your Account and Region

Hostname selection comes first, before any port or password troubleshooting. According to the Zoho list of SMTP and IMAP servers, personal accounts using a @zohomail.com address and free organization accounts use smtp.zoho.com, while paid organization accounts using a domain-based address use smtppro.zoho.com. That same guidance ties the login to the complete mailbox address and requires the authenticated address to match the sender address or one of its aliases.

Zoho SMTP and IMAP hosts by account type and data center

Account type or data center	SMTP host	IMAP host
United States, personal or free organization	smtp.zoho.com	imap.zoho.com
United States, paid organization on custom domain	smtppro.zoho.com	Confirm in the admin console
European Union	smtp.zoho.eu	imap.zoho.eu
India	smtp.zoho.in	imap.zoho.in
Australia	smtp.zoho.com.au	imap.zoho.com.au
Japan	smtp.zoho.jp	imap.zoho.jp
Canada	smtp.zoho.ca	imap.zoho.ca

Accounts sit in an assigned Zoho data center, and that assignment sets the hostname. A host from another data center can reject an otherwise correct login, which makes a region mismatch look like a password problem. Each regional value should be confirmed in Zoho's official documentation because data center hosts can change.

How to confirm the host for an account

Open the account settings: Sign in to Zoho Mail and open the mail server settings shown for that account.

Copy both hosts: Record the SMTP host and the IMAP host exactly as displayed, character for character.

Compare against the table: A mismatch between the displayed region and the configured host explains most correct-password login failures.

Readers who don't yet know the incoming server can find your IMAP server with mailX without entering any credentials, since the finder returns host, ports and setup guidance only.

How to verify it: Test the chosen host with the mailX SMTP test using the port and encryption pair the application will use. A good result reaches the server and completes the TLS handshake. A timeout or immediate rejection means the host, region or network path is wrong, and no password change will fix it.

How SSL, TLS and Login Authentication Work in Zoho

Zoho Mail offers two secure ways to submit outgoing mail, and they are not interchangeable. The Zoho SMTP help page describes port 465 using SSL/TLS encryption from the beginning of the connection and port 587 using TLS/STARTTLS, with authentication required in both cases.

What happens on each port

Port 465, implicit SSL/TLS: The connection is encrypted from the first byte. The client opens a TLS session immediately, then speaks SMTP inside it.

Port 587, STARTTLS: The client connects in plain SMTP, issues STARTTLS, upgrades the session to TLS, and only then sends credentials and message data.

Port 25, server relay: This port serves server-to-server transfer. Internet service providers and hosting platforms block it often, so applications shouldn't submit mail on it.

The encryption setting must match the port. STARTTLS selected on port 465, or implicit SSL selected on port 587, produces a TLS handshake or connection error even when the hostname and password are correct. Background on choosing the right SMTP submission port helps when a client labels these modes differently, for example SSL/TLS, STARTTLS, Auto or None.

Port 587 with STARTTLS is the sensible default for most applications because mail libraries handle the upgrade explicitly. Port 465 fits clients that expect implicit TLS at connect time, including older libraries with a dedicated SSL mode. Either is encrypted. Neither works with the other's setting.

How the login ties to the sender

SMTP AUTH is required on both submission ports. The username is the full Zoho Mail address, and the authenticated address must be the sender address or a configured alias. When two-step verification is enabled, the password is an app-specific password rather than the normal sign-in password. IMAP uses the same login, over SSL on port 993.

How to verify it: A configuration that connects but fails during the handshake has a port and encryption mismatch. A configuration that completes TLS and then rejects the login has a credential or sender address problem. The stage of the failure names the fix.

How to Turn On IMAP and SMTP Access in Zoho Mail

Correct server values don't help while the account itself refuses third-party access. Zoho Mail controls IMAP access per account, and an organization admin can restrict external clients further, so the account state needs checking before any code or mail client gets configured.

Steps to enable access

Sign in to the right account: Use the Zoho Mail account that will send or receive the mail, not a personal admin login.

Open Settings, then Mail Accounts: Find the IMAP Access section for the mailbox. Menu names shift over time, so current Zoho help documentation is the reference when labels differ.

Turn IMAP access on and save: The setting takes effect for new connections. Existing failed sessions don't retroactively succeed.

Create an app-specific password if needed: When two-step verification is on, open the security settings, generate a password for the application, and copy it when it appears. It typically can't be viewed again later.

Check organization restrictions: If SMTP or third-party app access is restricted, the admin console controls that policy. An individual user can't override it from mailbox settings.

Record the full set: Write down username, password type, host, port and encryption in one place for the configuration step that follows.

What a missing setting looks like

When IMAP access is off, the server refuses the IMAP login even though webmail sign-in works normally. On some account types the IMAP options don't appear at all, and an admin policy can hide or block them for the whole organization. Both situations look like wrong passwords from the application's side, which wastes hours when nobody checks the account toggle first.

The account is ready when three things are true: IMAP access is on, a usable password exists for the application's login type, and the host matches the account's region and plan. Anything less sends the next configuration step into avoidable debugging.

How to verify it: Run an IMAP connection test against imap.zoho.com on port 993 with SSL. A good result logs in and lists folders. A refused login after this setup almost always means IMAP access is still off or the app-specific password is missing.

How to Send Mail Through Zoho SMTP From Code

The same matched values apply in code, where the encryption choice becomes visible as an explicit function call. This Python example uses example.com placeholders, which are examples only, and reads the password from an environment variable.

import os, smtplib

server = smtplib.SMTP("smtp.zoho.com", 587)
server.starttls()
server.login("user@example.com", os.environ["ZOHO_APP_PASSWORD"])
server.sendmail("user@example.com", "recipient@example.com",
                "Subject: Test\n\nHello from Zoho SMTP.")
server.quit()

The port 465 variant swaps one line and drops another:

server = smtplib.SMTP_SSL("smtp.zoho.com", 465)
server.login("user@example.com", os.environ["ZOHO_APP_PASSWORD"])

With SMTP_SSL, TLS starts at connection time, so there's no starttls() call. That's the whole difference, and it's set once per connection.

The three lines that break most often

Order of operations: starttls() must run before login() on port 587. Logging in first sends credentials on an unupgraded session or fails outright, depending on server policy.

Username format: The login name is the full address. A bare username passes local validation in many libraries and then fails at the server.

Password handling: The app-specific password belongs in an environment variable or secret store, never hardcoded in the source file where it lands in version control.

A clean run produces no exception and the message arrives. An SMTPAuthenticationError raised at login() points to the username or password type, not the port, because the connection and TLS stages already succeeded. A timeout before login points the other way, toward host, port or outbound network rules.

Mail libraries and frameworks in any language take the same four values: host, port, encryption mode and credentials. Reading mail from code follows the same pattern with an IMAP library over SSL on port 993. Test messages should go to a mailbox the sender controls, so delivery can be confirmed on both ends.

How to verify it: Send one test message to a controlled mailbox and confirm arrival. Then run the same host and port through the mailX SMTP test. Matching results from both paths confirm the code, not just the account, is configured correctly.

How to Verify Zoho SMTP and IMAP with mailX

A failed send has two possible homes: the account values or the code that applies them. Testing outside the application tells them apart, because an independent check runs the same host, port and credentials without the app's configuration layer in between.

Step 1. Test SMTP sending

Use the mailX SMTP test to verify SMTP login and TLS by entering the host, port, encryption, full username and password for a mailbox the tester controls. The check connects to the server and reports whether connection, encryption and authentication each succeed, and it sends one test email only when both a from address and a to address are given.

Each stage maps to a different cause. A timeout points at the host, the region or a blocked port. A TLS error points at the port and encryption pairing. An authentication failure points at the username format or password type. The mistakes table below gives the fix for each symptom.

Step 2. Test IMAP reading

Run the same credentials through the IMAP checker against imap.zoho.com on port 993 with SSL. A pass logs in and lists folders, which proves IMAP access is enabled and the credentials work for reading. When SMTP passes and IMAP refuses the login, the cause sits in the account settings, in the IMAP toggle and app-specific password requirements covered in the access steps above. The two services are switched on separately, so one can pass while the other is still off.

Step 3. Repeat with the regional host when needed

Passing on smtp.zoho.com proves nothing for an account homed in the European Union or India data centers, since Zoho routes logins by region. Accounts outside the default data center need both tests run again against the regional host before the values count as confirmed.

The connection tests run only against a mail account the tester controls and only with credentials the tester supplies, on the website, through the API and through the MCP server alike.

How to verify it: The pass condition is strict. Both tests must succeed on the exact host, port and encryption the application will use in production. A pass on different values is a pass for a different configuration, and deploying on that basis recreates the original failure.

Common Zoho SMTP Mistakes and How to Fix Them

The failure that wastes the most time is the sender address rejection, because it arrives after a successful login. Zoho accepts the credentials, then refuses the message because the From address is not the authenticated account or one of its configured aliases. Developers recheck the password, reset it, and the rejection persists, since nothing was wrong with the login. Changing the From address to match the authenticated account resolves it.

The second most frequent failure is a connection timeout, which rarely means Zoho is down. A wrong host, a blocked outbound port on the hosting platform, or port 25 chosen by habit are the usual causes. The Zoho guide to SMTP ports states that port 465 uses implicit SSL/TLS while port 587 uses STARTTLS, identifies port 587 with STARTTLS as the preferred choice for most applications, and notes that authentication failures may return error 535.

Zoho SMTP mistakes, symptoms and fixes

Mistake	Symptom	Fix and check
Port and encryption mismatch, such as 465 with STARTTLS	TLS handshake or connection error	Use 465 with implicit SSL/TLS or 587 with STARTTLS, then run the SMTP test
Port 25 used by an application	Connection timeout	Switch to port 587, since port 25 is for server-to-server transfer and is often blocked
Free account host used on a paid custom-domain organization	Login rejected	Use smtppro.zoho.com for paid organization accounts
Host from another data center	Login rejected even with the correct password	Use the host for the account's data center from the table
Short username instead of the full address	Authentication error 535	Use the complete Zoho Mail address as the username
Sender address not tied to the login	Message rejected at send	Send from the authenticated address or a configured alias
App-specific password missing with two-step verification on	Login rejected	Create an app-specific password and use it in the app
IMAP access disabled	IMAP login refused	Turn on IMAP access, then run the IMAP connection test

Deployment changes the network, so a configuration that works locally can time out in production when the hosting provider blocks outbound ports 465 or 587. The fix there is a provider firewall rule or a different submission route; no password reset will open a blocked port.

A paid organization on a custom domain that points its application at the free account host fails at login, and switching to smtppro.zoho.com resolves it without touching the password. Each row maps to a mailX check: the SMTP test catches pairing, host and credential faults, while the IMAP checker catches the disabled access toggle.

When SMTP login succeeds but mail still lands in spam or fails domain checks, the problem has moved out of server settings into SPF, DKIM or DMARC. Duplicate SPF records, more than the allowed number of DNS lookups, a wrong DKIM selector or a CNAME published where a TXT record belongs all break authentication after sending works. The email authentication guide covers those records, and the mailX SPF, DKIM and DMARC checkers detect each fault directly.

How to verify it: Fix one row at a time, then rerun the matching mailX test. A good result confirms that specific cause. Changing host, port and password together makes the next failure unreadable.

Confirm Your Zoho Settings Before You Deploy

The decision is simple: confirm the hostname, pair the port with its encryption, enter the full address as the username, and run both mailX tests before the application goes live. Skipping the tests trades five minutes now for a production incident later.

Final checks in order

Hostname: It matches the account type and data center.

Port and encryption: The pair matches the settings table, 465 with implicit SSL/TLS or 587 with STARTTLS.

Login: It uses the full address, with an app-specific password when two-step verification is on.

SMTP test: It passes on the production values.

IMAP test: It passes when the application reads mail.

If a test fails, return to the mistakes table and change one value at a time. Both checks run free, with no signup, at the SMTP test and the IMAP checker on the mailX website.

For developers working with AI agents, mailX is available through its MCP server, documented in the MCP documentation. In Claude.ai and Claude Desktop, the connector installs through Settings, then Customize, then Connectors, by pasting the MCP URL, and no authentication is needed. The SMTP and IMAP connection tests aren't offered in the ChatGPT app. Because the smtp_check and imap_check tools log in with submitted credentials and carry readOnlyHint false, an agent in Claude or Cursor should ask for user confirmation before invoking them.

Before the next deploy, enter the exact host, port, encryption and login into mailX and run the SMTP test and IMAP checker free, with no signup. mailX reports which stage fails, connection, TLS or authentication, in plain English with the fix, so the configuration that ships is the configuration that already passed.