Solving the "SASL authentication failed" error in Mutt when using Gmail requires switching to App Passwords and configuring the correct SMTP ports. Legacy "Less secure app access" is no longer supported, so you must generate a 16-character application-specific password from your Google Account security settings and set set smtp_url to use port 587 with STARTTLS or port 465 with implicit SSL.
Understanding the Authentication Failure
The error messageSASL authentication failed in Mutt typically indicates that the Simple Authentication and Security Layer (SASL) mechanism rejected your credentials during the handshake with Gmail's SMTP server. In the past, users could enable "Less secure app access" in their Google Account settings to allow direct password usage. However, Google has completely disabled this feature for most accounts to enhance security. Consequently, standard account passwords no longer work for third-party clients like Mutt, Alpine, or Thunderbird.
This change forces all non-Gmail clients to use OAuth2 or Application-Specific Passwords. Since Mutt does not natively support the complex OAuth2 flow required by modern Google APIs without additional plugins, the most reliable solution is to generate an App Password. This is a unique, 16-character code that grants your email client permission to send mail on your behalf. Without this specific credential, any attempt to authenticate will fail with the SASL error, regardless of how correctly the rest of your configuration is written.
Generating an App Password
Before modifying your Mutt configuration, you must obtain the valid credentials from Google. Follow these steps to create an App Password:- Navigate to your Google Account page and select the Security tab from the left-hand menu.
- Ensure that 2-Step Verification is turned on. If it is not, you cannot create App Passwords. Enable it if necessary.
- Once 2-Step Verification is active, look for the App Passwords option. You may need to search for it in the search bar within the Security section.
- Select Mail as the app and choose Other (Custom name) as the device. Name it something recognizable, such as "Mutt Linux".
- Click Generate. Google will display a 16-character password. Copy this password immediately, as it will not be shown again.
Configuring Mutt for SMTP
With the App Password in hand, you need to update your~/.muttrc file. The configuration involves setting the SMTP URL, specifying the authentication method, and providing the new credentials.
First, define the SMTP server details. You have two primary options for connecting to Gmail: Port 587 with STARTTLS or Port 465 with implicit SSL. Port 587 is generally recommended for its flexibility and widespread support.
```
set smtp_url = "smtp://YOUR_EMAIL%[email protected]:587/"
set smtp_pass = "YOUR_APP_PASSWORD"
set ssl_starttls = yes
set smtp_auth = login
```
In the smtp_url, replace YOUR_EMAIL with your full Gmail address. Note that the @ symbol must be encoded as %40 to ensure proper parsing. Replace YOUR_APP_PASSWORD with the 16-character code generated earlier. The ssl_starttls = yes directive ensures that the connection starts unencrypted and upgrades to TLS after the initial handshake, which is standard for port 587.
If you prefer to use port 465, which uses implicit SSL/TLS from the start, the configuration changes slightly. You must disable STARTTLS and enable standard SSL.
```
set smtp_url = "smtps://YOUR_EMAIL%[email protected]:465/"
set smtp_pass = "YOUR_APP_PASSWORD"
set ssl_starttls = no
set ssl_force_tls = yes
set smtp_auth = login
```
Notice the use of smtps:// instead of smtp://. This tells Mutt to expect an immediate SSL connection. Using -starttls smtp with port 465 is incorrect and will result in connection failures because port 465 does not support the STARTTLS extension; it relies entirely on implicit encryption.
Testing the Connection
After saving your configuration, test the setup by sending a test email. You can do this directly from the command line to isolate potential issues before composing a full message in Mutt. Use the following command, replacing the placeholders with your actual data: ``` echo "Test Message" | mutt -s "Test Subject" [email protected] ``` If the email sends successfully, your configuration is correct. If you encounter errors, check the following common pitfalls:- Incorrect Encoding: Ensure there are no extra spaces in the
smtp_urlorsmtp_passlines. - Port Mismatch: Verify that you are using
smtp://withssl_starttls = yesfor port 587, andsmtps://withssl_force_tls = yesfor port 465. - Firewall Issues: Ensure your local firewall allows outbound connections on ports 587 or 465.
Frequently Asked Questions
Why did my old password stop working?
Google disabled "Less secure app access" to improve account security, requiring stronger authentication methods. Standard passwords are no longer accepted by third-party SMTP servers unless they are replaced by App Passwords or OAuth2 tokens.
Can I use OAuth2 with Mutt instead of App Passwords?
While possible, OAuth2 support in Mutt is complex and often requires external helper scripts or patches that are not included in standard distributions. App Passwords provide a simpler, native solution that works reliably with the built-in SMTP capabilities of Mutt.
What is the difference between port 587 and 465?
Port 587 uses STARTTLS, where the connection begins unencrypted and upgrades to TLS after authentication negotiation. Port 465 uses implicit SSL, meaning the entire connection is encrypted from the very first byte. Both are secure, but 587 is the modern standard for submission.
How do I revoke an App Password if I suspect it was compromised?
You can manage your App Passwords by going to your Google Account Security settings, selecting "App Passwords," and clicking the trash icon next to the specific password you wish to revoke. This immediately invalidates that code.
Why do I get a certificate error even with the correct settings?
This usually happens if you are using port 465 but have ssl_starttls enabled, or vice versa. Ensure that ssl_starttls = no and ssl_force_tls = yes for port 465, and ssl_starttls = yes for port 587 to match the expected encryption behavior.