An app password is a provider-issued secret scoped to one client, so it can be revoked without touching the account password and it satisfies 2FA. Use it when the provider has no OAuth app you can register against — Yahoo, Zoho, iCloud, Fastmail, MXroute, Mailcow and most independent hosts — or on Gmail accounts you do not want to route through your Cloud project.

Microsoft is the exception: Outlook.com, Hotmail and 365 refuse basic auth entirely. There is no app password path — use OAuth.

Bulk-bought Gmail accounts usually ship with a recovery email and 2FA already configured. Log in once from the same country IP you will pin the mailbox to, confirm 2-step verification is on (Google hides the App passwords page entirely until it is), then open Google Account → Security → App passwords and generate one for "Mail". Add the mailbox in Accounts with the Gmail (app password) preset:

SMTP  smtp.gmail.com : 587 (STARTTLS)
IMAP  imap.gmail.com : 993 (SSL)
User  the full address
Pass  the 16-character app password (no spaces)

If the seller cannot supply 2FA access, the account is unusable for sending — do not buy it. An account you cannot generate an app password or OAuth consent on is dead weight in the pool.

• Yahoo / AOL — Account Security → Generate app password. IMAP is on by default; the account password never works for mail clients.
• Zoho Mail — My Account → Security → App passwords. IMAP access must also be switched on in Mail Settings → Mail Accounts → IMAP.
• iCloud — appleid.apple.com → Sign-In and Security → App-Specific Passwords. Requires two-factor and a verified custom-domain or @icloud.com address.
• Fastmail — Settings → Privacy & Security → Integrations → New app password, scoped to Mail (SMTP + IMAP).
• MXroute, Mailcow, cPanel hosts — the mailbox password is the SMTP password; there is no separate app password. MXroute has its own preset and host guide.

Choose the provider in the Accounts form and the hosts, ports and TLS mode below are filled in for you. Anything not listed connects through the Custom SMTP/IMAP preset.

Loading provider catalogue…

The password is encrypted at rest with ENCRYPTION_KEY and never returned to the browser. On save, Next Day Mail opens a real SMTP session and an IMAP session through the mailbox's proxy — a bad password fails immediately with the provider's own error rather than silently at the first send.

• 535 5.7.8 Username and Password not accepted — you pasted the account password, or the app password with spaces still in it.
• Application-specific password required — 2FA is on but you are using the account password.
• Too many simultaneous connections — IMAP session limits; lower the inbox-sync frequency for that provider.