Gmail
- Go to myaccount.google.com/security
- Under How you sign in to Google, click 2-Step Verification and enable it if not already on
- Return to the Security page β scroll down β click App passwords
- Under Select app choose Mail; under Select device choose Other and type "Mail Merge"
- Click Generate β copy the 16-character password shown (spaces don't matter)
- Paste it in the App Password field above
SMTP Host: smtp.gmail.com | Port: 587 | Encryption: TLS
🔒 After use: Go back to App passwords and delete "Mail Merge". Revoked instantly, zero residual access.
Outlook / Microsoft 365
- Go to account.microsoft.com/security
- Click Advanced security options
- Under App passwords click Create a new app password
- Copy the generated password and paste it above
SMTP Host: smtp.office365.com | Port: 587 | Encryption: TLS
⚠ If your organisation has disabled SMTP AUTH, ask IT to enable it for your mailbox, or have them whitelist this server's IP.
🔒 After use: Delete the app password from the same Advanced security options page.
Yahoo Mail
- Sign in to Yahoo β click your profile name (top-right) β Account Security
- Enable Two-step verification if not already on
- Scroll to Generate app password β select Other App β name it "Mail Merge"
- Copy the generated password and paste it above
SMTP Host: smtp.mail.yahoo.com | Port: 587 | Encryption: TLS
🔒 After use: Return to Account Security and revoke the "Mail Merge" app password.
Zoho Mail
- Go to accounts.zoho.com β Security β Two-Factor Authentication and enable it
- Navigate to App-Specific Passwords β click Generate New Password
- Enter name "Mail Merge" β copy the password shown
- Paste it in the App Password field above
SMTP Host: smtp.zoho.com | Port: 587 | Encryption: TLS
🔒 After use: Delete the password from Zoho Account Security β App-Specific Passwords.
Rediffmail / Rediffmail Pro
- Log in at mail.rediff.com
- Go to Settings β Mail Settings β enable POP3 / SMTP Access
- Rediffmail does not use app passwords β use your regular Rediffmail password directly in the App Password field above
- For Rediffmail Pro (business), use
smtp.rediffmailpro.com and your Pro account credentials
Rediffmail β Host: smtp.rediffmail.com | Port: 587 | TLS
Rediffmail Pro β Host: smtp.rediffmailpro.com | Port: 587 | TLS
⚠ Rediffmail may block SMTP from new IPs. If sending fails, log in to Rediffmail webmail and look for a security alert email to whitelist your server.
Hostinger Mail
- Log in to hpanel.hostinger.com
- Go to Emails β select your email account β Set Up Devices
- Find SMTP settings β Host is
smtp.hostinger.com, Port 587
- Use your full email address as Username and your email account password in the App Password field
- Alternatively use Port
465 with SSL encryption
SMTP Host: smtp.hostinger.com | Port: 587 (TLS) or 465 (SSL)
⚠ Hostinger does not use app passwords. Use your email account password. If sending fails, check that SMTP is not blocked under Hostinger's firewall settings.
cPanel / WHM / Custom Domain Mail
- Log in to your hosting control panel (cPanel) β typically at
yourdomain.com:2083 or cpanel.yourdomain.com
- Go to Email Accounts β select your account β click Connect Devices or Set Up Mail Client
- Note the Outgoing Server (SMTP) β usually
mail.yourdomain.com
- Use your full email address as Username and your email account password in the App Password field
- If Port 587 fails, try Port
465 with SSL, or Port 25 (some hosts block 587)
SMTP Host: mail.yourdomain.com | Port: 587 (TLS) or 465 (SSL)
GoDaddy: smtpout.secureserver.net | Port: 587
Bluehost / SiteGround: mail.yourdomain.com | Port: 587
⚠ Many shared hosts limit the number of emails per hour (50β500/hr). For large merges, consider a transactional email service like SendGrid, Mailgun, or Amazon SES instead.
🔒 After use: Change your email account password from cPanel if you're concerned about credential exposure, especially on shared servers.
💡 General security best practices
- App passwords are as powerful as your real password for sending email β treat them with equal care
- Never paste them into spreadsheets, emails, or version control
- Always revoke immediately after your mail merge is complete β it takes under 30 seconds
- Use a descriptive name ("Mail Merge β June 2026") so you can identify and remove it later
- If you need to run merges regularly, consider asking your IT team to set up a dedicated service account