Skip to content

Knowledgebase

Using Django email backends for password resets

development, email

Django can send through several email backends. Production password resets need a real sending backend, a permitted sender identity and correct public links.

What you need before you begin

Obtain the provider SMTP or API settings and confirm the network connection is permitted. Identify any queue or worker used by the application to deliver mail.

01 Use Django email backends for password resets

  1. Choose the backend required by the application and provider. Console or file-based backends are useful for testing but do not deliver messages to customers.

  2. Store credentials privately and configure the required host, port and encryption. Set the From address to an identity the sending service authorises.

  3. Confirm password-reset links use the production HTTPS hostname. Check site configuration and proxy scheme handling when links show an internal or staging address.

  4. Send a controlled test to a mailbox you own and inspect the sending result. If delivery is queued, verify the worker and failed-job handling.

  5. Test the complete password-reset flow with a test account, including token expiry and the final successful sign-in.

02 Example: configure a Django 6.1 SMTP mailer

For Django 6.1, use the documented MAILERS configuration. This example assumes your provider has confirmed authenticated SMTP with STARTTLS on port 587. Keep credentials in the protected runtime environment.

Code or configuration example
import os

MAILERS = {
    "default": {
        "BACKEND": "django.core.mail.backends.smtp.EmailBackend",
        "OPTIONS": {
            "host": os.environ["SMTP_HOST"],
            "port": 587,
            "use_tls": True,
            "username": os.environ["SMTP_USERNAME"],
            "password": os.environ["SMTP_PASSWORD"],
            "timeout": 10,
        },
    },
}
DEFAULT_FROM_EMAIL = "[email protected]"

Replace the sender with an identity your provider permits. Older Django releases use their documented EMAIL_* settings, so check your installed version before applying this fragment. Do not enable both implicit TLS and STARTTLS.

Expected result: a reset requested for your controlled test account reaches its mailbox, links to the correct public HTTPS site and completes sign-in. A successful SMTP connection alone does not prove the reset token or link is correct.

Confirm the expected result

Check receipt, link destination and the relevant provider delivery event. Treat SMTP acceptance, recipient delivery and inbox placement as separate observations.

Troubleshoot unexpected results

If nothing arrives, confirm the real backend is active and inspect the private error or queue record. A bounce requires its reason and recipient address checked before retrying.

A common question

Why does a password reset appear successful for an unknown address?

Applications commonly use a neutral response to avoid disclosing which email addresses have accounts. Use an account you control for testing and inspect authorised logs rather than exposing account existence publicly.

Was this answer helpful?

Need a little more help?

Our support team can help you find the next step.

Contact support