---
title: "Set up SMTP for self-hosted Appwrite"
description: "_APP_SMTP_* in the install's .env with _APP_SMTP_SECURE=tls for 587, then docker compose up -d."
url: https://www.unitpost.com/docs/smtp/appwrite
section: SMTP
updated: 2026-11-02
---
# Set up SMTP for self-hosted Appwrite

## Connection settings

- **Host**: smtp.unitpost.com
- **Username**: unitpost (always this literal value)
- **Password**: Your Unitpost API key (must carry emails:send)
- **Port (STARTTLS)**: 587 (or 2587 if blocked, or 25)
- **Port (implicit TLS)**: 465 (or 2465 if blocked)
- **Security**: TLS 1.2 or 1.3 (required before AUTH)
- **From address**: Any address on a verified domain

## Set up SMTP for self-hosted Appwrite

> _APP_SMTP_* in the install's .env with _APP_SMTP_SECURE=tls for 587, then docker compose up -d.

Self-hosted Appwrite sends email verification, magic URL logins, password recovery and team invites with the `_APP_SMTP_*` variables in the `.env` file of your install. `_APP_SMTP_SECURE` must be set: left empty, Appwrite connects without TLS and never tries STARTTLS, and Unitpost refuses to log in on an unencrypted connection.

### 1. Create a send-only key

In Unitpost, open Settings → SMTP and create a send-only key. `_APP_SYSTEM_EMAIL_ADDRESS` defaults to `team@appwrite.io`; change it to an address on a verified domain (/docs/domains).

### 2. Set the SMTP variables

In Appwrite, `tls` means STARTTLS (port 587) and `ssl` means implicit TLS (port 465).

```env
_APP_SMTP_HOST=smtp.unitpost.com
_APP_SMTP_PORT=587
_APP_SMTP_SECURE=tls
_APP_SMTP_USERNAME=unitpost
_APP_SMTP_PASSWORD=pk_live_...
_APP_SYSTEM_EMAIL_ADDRESS=no-reply@yourdomain.com
```

> For port 465, use `_APP_SMTP_PORT=465` and `_APP_SMTP_SECURE=ssl`.

### 3. Apply the changes

Recreate the containers, then confirm the values loaded. If they didn't, run `docker compose up -d --build --force-recreate`.

```bash
docker compose up -d
docker compose exec appwrite vars
```

### 4. Send a test

Sign out of the Console and request a password recovery, or invite someone to a team. Follow the mail worker with `docker compose logs -f appwrite-worker` (`appwrite-worker-mails` if you run workers separately), and look for the send in Unitpost Emails.

### 5. If it fails

`538` in the worker log means `_APP_SMTP_SECURE` is empty, so the login went out before TLS. `550 5.7.1` means `_APP_SYSTEM_EMAIL_ADDRESS` is still `team@appwrite.io` or another unverified domain.

## Related

- [Set up PocketBase mail settings over SMTP](https://www.unitpost.com/docs/smtp/pocketbase): Dashboard → Settings → Mail settings with TLS encryption Auto (StartTLS) for 587, then Send test email.
- [Configure authentik email over SMTP](https://www.unitpost.com/docs/smtp/authentik): AUTHENTIK_EMAIL__* in .env, USE_TLS for 587 or USE_SSL for 465, then ak test_email in the worker.
- [Metabase SMTP settings for subscriptions and alerts](https://www.unitpost.com/docs/smtp/metabase): Admin → Settings → Email or MB_EMAIL_SMTP_* variables: STARTTLS on 587, SSL on 465.