--- title: "Python Email Automation: smtplib, aiosmtplib and SPF" description: "Python email automation done right: EmailMessage, smtplib with app passwords, aiosmtplib for batches, Jinja2 templates, and SPF, DKIM and DMARC for delivery." url: https://blog.furkankoykiran.com.tr/en/posts/python-email-automation/ lang: en date: 2025-11-08 lastmod: 2025-11-08 author: Furkan Köykıran tags: ["python","automation","asyncio","security"] translation_tr: https://blog.furkankoykiran.com.tr/posts/python-ile-eposta-otomasyonu/ license: "Text and images © Furkan Köykıran; code samples MIT" --- # Python Email Automation: smtplib, aiosmtplib and SPF Python email automation looks like a five-line job: connect with `smtplib`, send the message. Getting reports, alerts and notifications to actually land in the inbox is a different problem. Where you keep credentials, how you build the message and what your domain's DNS records say matter at least as much as the code. This is the setup I use in my own automations: building messages with `EmailMessage`, `smtplib` with an app password, `aiosmtplib` for sending many messages, Jinja2 templates, and SPF, DKIM and DMARC for deliverability. ## Build the message with EmailMessage Older examples glue parts together by hand with `MIMEMultipart` and `MIMEText`. Since Python 3.6, `email.message.EmailMessage` does the same with far less code: ```python from email.message import EmailMessage from email.utils import formataddr, formatdate, make_msgid from pathlib import Path def build_message(to: str, subject: str, text: str, html: str, attachment: Path | None = None) -> EmailMessage: msg = EmailMessage() msg["From"] = formataddr(("Report Bot", "reports@example.com")) msg["To"] = to msg["Subject"] = subject msg["Date"] = formatdate(localtime=True) msg["Message-ID"] = make_msgid(domain="example.com") msg.set_content(text) # plain-text version msg.add_alternative(html, subtype="html") # HTML version if attachment: msg.add_attachment( attachment.read_bytes(), maintype="application", subtype="pdf", filename=attachment.name, ) return msg ``` Include both a plain-text and an HTML version. Clients that don't render HTML and some corporate filters look at the text part, and HTML-only messages score worse with spam filters. `EmailMessage` encodes non-ASCII subjects and display names for you. ## App passwords, not your real password Don't put your actual Gmail or Outlook password in a script. Google has removed the "less secure apps" option that allowed password logins over SMTP. To send from a personal Gmail account with a script: 1. Turn on 2-Step Verification for the account. 2. Create an app password in your Google account settings. The 16-character password works only for this script and can be revoked any time. 3. Put it in an environment variable or a secrets manager, not in the code. Microsoft 365 and Outlook.com are retiring Basic Auth for SMTP, so there you need OAuth2 (XOAUTH2) or the Microsoft Graph API. For a long-running service, OAuth2 is the sturdier choice on Gmail as well; app passwords are a practical middle ground for personal automations. ```python import os import smtplib import ssl SMTP_HOST = "smtp.gmail.com" SMTP_USER = os.environ["SMTP_USER"] SMTP_APP_PASSWORD = os.environ["SMTP_APP_PASSWORD"] def send(msg) -> None: context = ssl.create_default_context() with smtplib.SMTP(SMTP_HOST, 587, timeout=30) as smtp: smtp.starttls(context=context) smtp.login(SMTP_USER, SMTP_APP_PASSWORD) smtp.send_message(msg) ``` `ssl.create_default_context()` verifies the certificate and hostname. If you call `starttls()` without a context, `smtplib` falls back to a default that doesn't verify certificates: the connection is encrypted, but nothing checks that the server really is Gmail. Always pass the context explicitly. ## Port 587 or 465? - 587 (STARTTLS): the connection starts in plain text and upgrades with the `STARTTLS` command. Use `smtplib.SMTP` plus `starttls()`. - 465 (implicit TLS): TLS from the first byte. Use `smtplib.SMTP_SSL`. RFC 8314 recommends this for message submission, so it is not a legacy port. - 25: server-to-server relay. Cloud providers like AWS and Google Cloud block outbound port 25 by default; don't use it from your app. Both 587 and 465 are secure. Use whichever your provider documents. ## Sending many messages: aiosmtplib Opening a new connection per message is slow. For hundreds of notifications, reuse one connection. If your code already runs on asyncio, `aiosmtplib` sends without blocking the loop: ```python import asyncio import os import aiosmtplib SMTP_USER = os.environ["SMTP_USER"] SMTP_APP_PASSWORD = os.environ["SMTP_APP_PASSWORD"] async def send_batch(messages) -> None: async with aiosmtplib.SMTP(hostname="smtp.gmail.com", port=587, start_tls=True) as smtp: await smtp.login(SMTP_USER, SMTP_APP_PASSWORD) for msg in messages: try: await smtp.send_message(msg) except aiosmtplib.SMTPRecipientsRefused as exc: print("Refused:", exc.recipients) await asyncio.sleep(0.5) # be gentle with the provider ``` One SMTP connection sends one message at a time, so the loop is sequential. If you need more throughput you can open a few connections and split the work, but check the provider's limits first. Personal Gmail accounts are capped at roughly 500 recipients a day, Google Workspace accounts at 2,000. Beyond that, use a transactional email service such as Amazon SES, Postmark or Mailgun instead of a mailbox. For a one-off message there is a shortcut: ```python await aiosmtplib.send( msg, hostname="smtp.gmail.com", port=587, start_tls=True, username=SMTP_USER, password=SMTP_APP_PASSWORD, ) ``` TaskGroup and timeouts on the asyncio side are covered in the [asyncio post](/en/posts/python-asyncio-concurrent-processing/). ## HTML templates with Jinja2 HTML embedded in Python strings gets out of hand quickly. I keep templates in separate files and render them with Jinja2: ```python from jinja2 import Environment, FileSystemLoader, select_autoescape env = Environment(loader=FileSystemLoader("templates"), autoescape=select_autoescape()) def render(name: str, **context) -> tuple[str, str]: html = env.get_template(f"{name}.html").render(**context) text = env.get_template(f"{name}.txt").render(**context) return text, html ``` Keep `autoescape` on. If an outside value like a username lands in the HTML unescaped, someone can inject markup or links into your message. HTML support in email clients is far behind browsers. Gmail supports `