Yahoo Mail SMTP, IMAP and POP settings that work

Yahoo Mail works with standard SMTP, IMAP and POP, but with one rule that trips up nearly everyone: third-party clients must authenticate with a generated app password, not your Yahoo account password. Get that right and the rest is ordinary configuration.

Quick reference

Authentication is required on all of them. The username is always the complete address — you@yahoo.com, not you — including for the regional domains (yahoo.co.uk, yahoo.co.in) and for Yahoo-hosted aliases.

Generate the app password

1. Sign in to Yahoo and open Account Info, then Account Security.
2. Find the app password section — labelled *Generate app password* or *Manage app passwords*.
3. Name it after the client or integration so you can revoke it independently later.
4. Copy the generated string and paste it as the password in your client. Yahoo shows it once.

Notes that save time:

• The app password has no spaces to preserve; paste it exactly as given.
• One app password per integration. Sharing one across a warm-up tool, a phone and a desktop client means revoking any of them breaks all of them.
• If the app password option is missing, two-step verification settings or account restrictions are usually why. Resolve those first rather than retrying your account password.

IMAP access

IMAP keeps the mailbox in sync, which matters if anything other than the Yahoo web interface will read the mail — including any tool that needs to see replies. Check that IMAP access is permitted in your Yahoo mail settings, then configure imap.mail.yahoo.com:993 over SSL with the same app password.

Prefer IMAP to POP unless you have a specific reason. POP3 pulls messages down and, depending on client settings, removes them from the server, so a second client sees an empty mailbox and any process that watches for replies sees nothing.

Troubleshooting, in order

"Username or password is incorrect" — the most common failure, and almost always the account password being used instead of an app password. Generate a fresh app password and re-enter it. Second cause: username entered without the domain.

Connection times out — a firewall or ISP blocking outbound 465 or 587. Try the other port before you suspect Yahoo; some networks allow 587 and block 465.

TLS or certificate error — the client is set to plain or to the wrong encryption for the port. Port 465 expects implicit SSL/TLS; port 587 expects STARTTLS. Mismatching them produces a handshake error that looks like a server fault.

Sends work, replies never appear — IMAP is not configured or not permitted, or the client is on POP and has already removed the messages.

`554 delivery error: dd This user doesn't have a yahoo.com account` — a dead recipient address, not a configuration problem. Suppress it.

Verify the configuration from outside the client

The quickest proof is a round trip: send from the Yahoo mailbox to an address on another provider, then open the received message's raw source and read the authentication summary.

Authentication-Results: spf=pass smtp.mailfrom=yahoo.com;
 dkim=pass header.d=yahoo.com; dmarc=pass header.from=yahoo.com

Three passes means the mailbox is sending correctly through Yahoo's own infrastructure. Then reply from the other side and confirm the reply shows up over IMAP. If both directions work, the configuration is done.

Sending volume and reputation reality

Working settings are not the same as good deliverability. A consumer Yahoo mailbox is not a bulk sending platform: Yahoo applies its own send limits, and a free address sending outreach at volume will be rate-limited or filtered regardless of configuration. Two further facts worth holding on to:

• Yahoo and AOL share one filtering stack. Anything you observe on one applies to the other, which is useful — one seed set covers both — and also means a complaint problem shows up in two places at once.
• Yahoo leans on DKIM. If you send from your own domain through a third-party service, a valid DKIM signature aligned to the From domain matters more here than almost anywhere else.

For business outreach, send from your own domain through a provider built for it and keep the Yahoo mailbox for receiving and for seed testing.

What not to do

• Do not use your Yahoo account password in a third-party client. It will fail, and repeated failures can trigger security interventions on the account.
• Do not reuse one app password everywhere. Revocation becomes all-or-nothing.
• Do not configure POP when something needs to watch for replies. The messages will not be there.
• Do not run cold campaigns from a free Yahoo address. Limits and filtering make it unviable, and the address itself carries no domain reputation you can build on.
• Do not store the app password in a shared document. It is a credential with full mailbox access and no second factor.

How MailPilot helps

MailPilot connects mailboxes over OAuth for Gmail and Outlook, and over SMTP/IMAP for everything else — which is how a Yahoo mailbox joins the warm-up with an app password and nothing more. It measures inbox placement per provider, so Yahoo and AOL placement is reported separately from Gmail and Microsoft, and it verifies SPF, DKIM and DMARC on the domain you actually send from.