How to Use Nodemailer to Send Email in Node.js

How to send email with Nodemailer (quick steps)

Sending email with Nodemailer takes 5 steps:

1. Install the package with npm install nodemailer
2. Get SMTP credentials from an email service
3. Create a transporter with your host, port, and login
4. Call sendMail() with your message
5. Run verify() to confirm the connection works

The rest of this guide walks through each step with working code.

What is Nodemailer, and what does it actually do?

Nodemailer is a Node.js module that sends email through an SMTP server you supply. It builds the message, opens an authenticated connection, transfers the mail, and reports back.

It has no mail server of its own. You’ll sometimes see it written as “node mailer”, but it’s one package: nodemailer on npm.

How to set up Nodemailer and send your first email

Here, I’ll show you how to add Nodemailer to an existing Node.js application.

Prerequisites

Before getting started, you’ll need to have the following:

• Node.js 20 or newer installed
• A project with package.json (run npm init -y if you don’t have one)
• An SMTP service provider

I’ll use SendLayer SMTP for this tutorial. But the steps are similar regardless of your SMTP provider.

One of the standout features I like about SendLayer is its domain reputation protection. Your emails are sent from a subdomain (sl.example.com). This protects your primary domain in the event of any issues with your sender reputation.

After creating your SendLayer account, be sure to add and authorize your sending domain. This involves adding DNS records to prove domain ownership and improve email deliverability.

Step 1: Install Nodemailer

Start by installing the package from NPM:

npm install nodemailer dotenv

Nodemailer has no dependencies, so this adds one package to your project.

Notice that I added dotenv to the installation. This package helps with loading environment variables.

If you’re using ES modules, make sure "type": "module" is set in your package.json. The examples below use ES module syntax.

Step 2: Get your SMTP credentials

To configure Nodemailer, you’ll need your SMTP credentials for the transporter. Here’s how to retrieve your details in SendLayer.

Log in to SendLayer and go to Settings » SMTP Credentials. You’ll see the host, port, username, and password your transporter needs.

Go ahead and copy these details into a .env file within your project’s directory. Never paste these into your code:

# .env
SENDLAYER_USER=your_smtp_username
SENDLAYER_PASS=your_smtp_password

Step 3: Create the transporter

The transporter holds your connection settings. Create it once and reuse it:

// mailer.js
import nodemailer from 'nodemailer';
import 'dotenv/config';

export const transporter = nodemailer.createTransport({
  host: 'smtp.sendlayer.net',
  port: 587,
  secure: false,
  auth: {
    user: process.env.SENDLAYER_USER,
    pass: process.env.SENDLAYER_PASS,
  },
});

The secure flag confuses almost everyone. On port 587 it’s false, because the connection upgrades to TLS after it opens.

Set it to true only on port 465. Both ports are encrypted, so 587 with secure: false is not an insecure setup.

Step 4: Send a test email

To send your first email with Nodemailer, call sendMail() with your message. Wrap it in a try/catch so a failed send doesn’t crash your app:

// send.js
import { transporter } from './mailer.js';

async function sendTestEmail() {
  try {
    const info = await transporter.sendMail({
      from: '"Northside Goods" <[email protected]>',
      to: '[email protected]',
      subject: 'Your first Nodemailer email',
      text: 'If you can read this, your transporter works.',
    });
    console.log('Sent:', info.messageId);
    return info;
  } catch (error) {
    // Log it and move on. Never let a mail failure break the request.
    console.error('Send failed:', error.message);
    throw error;
  }
}

sendTestEmail();

Run it with node send.js. You should see a message ID in your terminal and the email in your inbox.

The from address must be on your authorized domain. Using an address on a domain you haven’t verified is the most common cause of a rejected send.

Step 5: Verify the connection before sending

Call verify() to test your credentials without sending anything:

// verify.js
import { transporter } from './mailer.js';

try {
  await transporter.verify();
  console.log('SMTP connection is ready');
} catch (error) {
  console.error('SMTP connection failed:', error.message);
}

Most tutorials skip this step. It’s the fastest way to separate a credentials problem from a message problem.

How to send an HTML email with Nodemailer

To send HTML emails, add an html property to your message. Keep the text property too, as a fallback for clients that don’t render HTML:

await transporter.sendMail({
  from: '"Northside Goods" <[email protected]>',
  to: '[email protected]',
  subject: 'Order #48211 confirmed',
  // Plain-text fallback. Some clients and most spam filters read this.
  text: 'Order #48211 confirmed. Total $90.72. Arriving Aug 8 to Aug 12.',
  html: `
    <table width="100%" cellpadding="0" cellspacing="0">
      <tr>
        <td align="center" style="padding:24px 0;">
          <table width="600" cellpadding="0" cellspacing="0"
                 style="font-family:Arial,sans-serif;color:#222;">
            <tr>
              <td style="padding:24px;">
                <h1 style="font-size:20px;margin:0 0 12px;">Order #48211 confirmed</h1>
                <p style="font-size:15px;line-height:1.5;margin:0;">
                  Thanks for your order. We're packing it now.
                </p>
              </td>
            </tr>
          </table>
        </td>
      </tr>
    </table>
  `,
});

Two rules for HTML email. Use tables for layout and inline all your CSS, because email clients strip code blocks.

Keep the layout to a single 600px column. That width renders reliably across Outlook, Gmail, and Apple Mail.

Including a plain-text alternative improves compatibility and gives recipients and filtering systems another representation of your message.

Building a specific flow? Our walkthrough of password reset emails in Node.js uses this exact setup.

Send email to multiple recipients

To send emails to multiple recipients using Nodemailer, pass an array to to, or use cc and bcc for the other fields:

await transporter.sendMail({
  from: '"Northside Goods" <[email protected]>',
  to: ['[email protected]', '[email protected]'],
  cc: '[email protected]',
  bcc: ['[email protected]'],
  subject: 'Weekly order summary',
  text: 'Your weekly summary is attached.',
});

Everyone in to and cc sees each other’s addresses. Use bcc when recipients shouldn’t.

How do you send email with attachments?

Add an attachments array. Each entry needs a filename and a source:

await transporter.sendMail({
  from: '"Northside Goods" <[email protected]>',
  to: '[email protected]',
  subject: 'Your invoice',
  text: 'Your invoice is attached.',
  attachments: [
    // 1. From a local file path
    { filename: 'invoice.pdf', path: './invoices/48211.pdf' },
    // 2. From a string or Buffer you generated at runtime
    { filename: 'summary.txt', content: 'Order #48211\nTotal: $90.72' },
    // 3. From a remote URL
    { filename: 'logo.png', path: 'https://yourdomain.com/logo.png' },
  ],
});

Keep the total message under 10 MB, including the body. Larger files should be stored with a download link in the email.

How do you use Nodemailer with Gmail?

Set service: 'gmail' and authenticate with an app password. Gmail blocks plain password logins, so you’ll need 2-Step Verification enabled first:

const gmailTransporter = nodemailer.createTransport({
  service: 'gmail',
  auth: {
    user: '[email protected]',
    // A 16-character app password, NOT your Google account password.
    pass: process.env.GOOGLE_APP_PASSWORD,
  },
});

Nodemailer recommends OAuth2 over app passwords for anything long-lived. An app password is fine for a local test.

Here’s the OAuth2 version. It stores a refresh token and swaps it for a fresh access token on each send:

const gmailOAuth = nodemailer.createTransport({
  service: 'gmail',
  auth: {
    type: 'OAuth2',
    user: '[email protected]',
    clientId: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    refreshToken: process.env.GOOGLE_REFRESH_TOKEN,
  },
});

OAuth2 survives password changes. It also takes time to set up a Google Cloud project, so budget an hour the first time.

Google applies several sending and recipient limits depending on your account type and how you send. Typical daily sending limits include:

Nodemailer’s own guide says Gmail is “not recommended for production workloads.” Google monitors for unusual login activity and can block your connection mid-send.

So Gmail works for a proof of concept. Move to a transactional service before real customers depend on it.

Why do Nodemailer emails go to spam?

Nodemailer emails land in spam when the receiving inbox can’t verify who sent them. The fix is DNS, not code.

Add 3 records for your sending domain:

Google and Yahoo have required all 3 from bulk senders since February 2024. Microsoft applied the same rules to Outlook.com in May 2025. Google’s Email sender guidelines list the current requirements.

Three more things that hurt delivery, in order of how often they bite:

• Sending from a shared host IP. You inherit every other site’s reputation on that address.
• No plain-text fallback. An HTML-only message may be less compatible with some clients and filtering systems.
• A from domain that doesn’t align with SPF or DKIM. This can cause DMARC to fail and, depending on the domain’s policy, lead to quarantine or rejection.

See our guide on SPF, DKIM, and DMARC for more details on email authentication.

Troubleshooting common email failure issues

Most Nodemailer failures throw one of 3 errors. Match the message to the fix.

Of the three, the secure flag mismatch is the one we see most often, and it’s the easiest to miss because the code looks correct.

EAUTH, invalid login. Your username or password is wrong, or you’re using an account password where an app password is required. Confirm the credentials by running verify() on its own.

ECONNREFUSED, or a hanging connection. The port is blocked. Some hosting and cloud environments restrict outbound SMTP connections, so test the port directly:

openssl s_client -connect smtp.sendlayer.net:587 -starttls smtp

If that hangs or is refused, the port is blocked and no code change will fix it. Try the other port.

ESOCKET, a secure mismatch. You set secure: true on port 587 or false on 465. Match the flag to the port.

Two failures that throw nothing at all are worth knowing:

• The send resolves but nothing arrives. Check your provider’s delivery logs. A message can be accepted and then rejected downstream.
• The from domain isn’t authorized. Some servers accept the message and drop it silently.

Frequently Asked Questions

These are answers to some of the common questions developers ask about sending emails with Nodemailer.

David Ozokoye

David is a technical writer at SendLayer. He tests and documents new features and updates to SendLayer's email services. Away from the computer, he enjoys playing video games and roller skating.

See Full Bio