{"id":359,"date":"2026-09-06T14:17:02","date_gmt":"2026-09-06T19:47:02","guid":{"rendered":"https:\/\/photonconsole.com\/blog\/?p=359"},"modified":"2026-09-06T14:17:03","modified_gmt":"2026-09-06T19:47:03","slug":"how-to-send-emails-in-node-js-with-nodemailer-a-production-setup-guide","status":"publish","type":"post","link":"https:\/\/photonconsole.com\/blog\/how-to-send-emails-in-node-js-with-nodemailer-a-production-setup-guide\/","title":{"rendered":"How to Send Emails in Node.js with Nodemailer: A Production Setup Guide"},"content":{"rendered":"\n

Your Node.js app sends email perfectly on localhost. You deploy it, and the emails stop arriving. No crash, no error in the logs, no bounce message. Just silence.<\/p>\n\n\n\n

This is the most common email failure in Node.js applications, and it is almost never a bug in your code. It is a configuration gap between your development machine and your production environment. Most SMTP errors occur due to misconfiguration or authentication issues rather than faults in the application itself.<\/p>\n\n\n\n

This guide walks through a Nodemailer setup that survives production: correct ports, safe credentials, connection pooling, retry handling, and the point at which you need to stop using a personal mailbox and move to a dedicated relay.<\/p>\n\n\n\n

Quick Answer: How Do You Send Email in Node.js?<\/h2>\n\n\n\n

Install Nodemailer, create a single reusable transporter with your SMTP host, port and credentials, then call sendMail()<\/code>.<\/p>\n\n\n\n

    \n
  1. Run npm install nodemailer<\/code><\/li>\n\n\n\n
  2. Create one transporter using nodemailer.createTransport()<\/code> with host, port 587, and auth credentials<\/li>\n\n\n\n
  3. Store credentials in environment variables, never in code<\/li>\n\n\n\n
  4. Call transporter.verify()<\/code> at startup to confirm the connection<\/li>\n\n\n\n
  5. Send with await transporter.sendMail({ from, to, subject, html })<\/code><\/li>\n\n\n\n
  6. Enable pool: true<\/code> so connections are reused instead of reopened per message<\/li>\n\n\n\n
  7. Use an authenticated SMTP relay rather than port 25 or a personal Gmail account<\/li>\n<\/ol>\n\n\n\n

    The setup takes about ten minutes. The reason it fails in production is usually port 25 being blocked, a missing app password, or a transporter created inside a request handler.<\/p>\n\n\n\n

    For production traffic, point that transporter at a dedicated relay rather than a personal mailbox. Using an SMTP service like PhotonConsole means the same six lines of Nodemailer code work at 10 emails a day or 10,000.<\/p>\n\n\n\n

    What Nodemailer Actually Does<\/h2>\n\n\n\n

    Nodemailer is a Node.js module that speaks SMTP on your behalf. It does not deliver email itself. It opens an authenticated connection to a mail server you specify, hands over your message, and that server handles the actual delivery to the recipient.<\/p>\n\n\n\n

    This distinction matters. Nodemailer is a client, not a mail server. Its job is to format your message correctly and transmit it. Whether that message reaches the inbox depends entirely on the server you connect it to and on your domain’s authentication records.<\/p>\n\n\n\n

    If you are new to the underlying protocol, our explanation of what SMTP is and how it works<\/a> covers the fundamentals this guide builds on.<\/p>\n\n\n\n

    Why Node.js Email Fails in Production but Works Locally<\/h2>\n\n\n\n

    Six causes account for the overwhelming majority of these failures.<\/p>\n\n\n\n

    1. Port 25 is blocked by your host<\/h3>\n\n\n\n

    Almost every cloud provider blocks outbound port 25 by default to prevent spam. Code that works on your laptop silently fails on a deployed server. Use port 587 instead.<\/p>\n\n\n\n

    2. Gmail rejects your password<\/h3>\n\n\n\n

    Google removed support for basic “less secure app” sign-in. A regular account password will not authenticate. You need either an App Password generated on an account with two-factor authentication enabled, or OAuth 2.0.<\/p>\n\n\n\n

    3. You create a new transporter on every request<\/h3>\n\n\n\n

    Calling createTransport()<\/code> inside a route handler opens a fresh TLS handshake for every single email. Under load this exhausts connections and triggers rate limiting from your provider.<\/p>\n\n\n\n

    4. There is no retry logic<\/h3>\n\n\n\n

    SMTP failures are frequently temporary. A 4xx response means “try again later,” but a plain sendMail()<\/code> call treats it as final and the message is lost.<\/p>\n\n\n\n

    5. Your domain has no authentication records<\/h3>\n\n\n\n

    Without SPF and DKIM aligned to your sending domain, mailbox providers treat your mail as unverified. Authentication failures are one of the most common causes of email delivery problems, and they produce no error in your application at all. Our guide to SPF, DKIM and DMARC explained simply<\/a> covers what to publish.<\/p>\n\n\n\n

    6. You are sending through a personal mailbox<\/h3>\n\n\n\n

    Free Gmail accounts cap at roughly 500 recipients per day and Google Workspace accounts at 2,000, according to Google’s published Workspace sending limits<\/a>. Application traffic hits these ceilings quickly, and exceeding them can suspend the account your team relies on.<\/p>\n\n\n\n

    Step-by-Step: A Production Nodemailer Setup<\/h2>\n\n\n\n

    Step 1: Install the package<\/h3>\n\n\n\n
    npm install nodemailer<\/code><\/pre>\n\n\n\n
    Step 2: Choose the correct port<\/h3>\n\n\n\n
    Port choice determines whether your connection succeeds at all. The secure<\/code> flag must match the port.<\/p>\n\n\n\n
    Port<\/th>Encryption<\/th>secure value<\/th>Use in production?<\/th><\/tr><\/thead>
    587<\/td>STARTTLS (upgrades after connect)<\/td>false<\/code><\/td>Yes \u2014 recommended default<\/td><\/tr>
    465<\/td>Implicit TLS (encrypted from start)<\/td>true<\/code><\/td>Yes \u2014 valid alternative<\/td><\/tr>
    2525<\/td>STARTTLS<\/td>false<\/code><\/td>Yes \u2014 fallback when 587 is blocked<\/td><\/tr>
    25<\/td>Usually none<\/td>false<\/code><\/td>No \u2014 blocked by most hosts<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Setting secure: true<\/code> on port 587 is a frequent mistake and produces a connection that hangs rather than a clear error.<\/p>\n\n\n\n
    Step 3: Store credentials in environment variables<\/h3>\n\n\n\n
    Never commit SMTP credentials. Put them in .env<\/code> and add that file to .gitignore<\/code>.<\/p>\n\n\n\n
    SMTP_HOST=smtp.yourprovider.com\nSMTP_PORT=587\nSMTP_USER=your_smtp_username\nSMTP_PASS=your_smtp_password\nMAIL_FROM=\"Your App <noreply@yourdomain.com>\"<\/code><\/pre>\n\n\n\n
    Step 4: Create one shared transporter<\/h3>\n\n\n\n
    Create this once, at module level, and import it wherever you send mail.<\/p>\n\n\n\n
    \/\/ mailer.js\nimport nodemailer from \"nodemailer\";\n\nexport const transporter = nodemailer.createTransport({\n  host: process.env.SMTP_HOST,\n  port: Number(process.env.SMTP_PORT),\n  secure: false,           \/\/ false for 587, true for 465\n  auth: {\n    user: process.env.SMTP_USER,\n    pass: process.env.SMTP_PASS,\n  },\n  pool: true,              \/\/ reuse connections\n  maxConnections: 5,\n  maxMessages: 100,\n  connectionTimeout: 10000,\n  greetingTimeout: 10000,\n});<\/code><\/pre>\n\n\n\n
    The official Nodemailer SMTP documentation<\/a> lists every available transport option.<\/p>\n\n\n\n
    Step 5: Verify the connection at startup<\/h3>\n\n\n\n
    This surfaces credential and firewall problems on deploy rather than on the first user signup.<\/p>\n\n\n\n
    try {\n  await transporter.verify();\n  console.log(\"SMTP connection verified\");\n} catch (err) {\n  console.error(\"SMTP verification failed:\", err.message);\n}<\/code><\/pre>\n\n\n\n
    Step 6: Send a message<\/h3>\n\n\n\n
    export async function sendWelcomeEmail(to, name) {\n  const info = await transporter.sendMail({\n    from: process.env.MAIL_FROM,\n    to,\n    subject: \"Welcome aboard\",\n    text: `Hi ${name}, thanks for signing up.`,\n    html: `<p>Hi ${name}, thanks for signing up.<\/p>`,\n  });\n\n  console.log(\"Message sent:\", info.messageId);\n  return info;\n}<\/code><\/pre>\n\n\n\n
    Always include a text<\/code> version alongside html<\/code>. Messages with only an HTML body score worse with spam filters.<\/p>\n\n\n\n
    Quick Fix: Emails Send Locally but Not in Production<\/h3>\n\n\n\n