Django can send through several email backends. Production password resets need a real sending backend, a permitted sender identity and correct public links.
IN THIS ARTICLE
What you need before you begin
Obtain the provider SMTP or API settings and confirm the network connection is permitted. Identify any queue or worker used by the application to deliver mail.
01 Use Django email backends for password resets
Choose the backend required by the application and provider. Console or file-based backends are useful for testing but do not deliver messages to customers.
Store credentials privately and configure the required host, port and encryption. Set the From address to an identity the sending service authorises.
Confirm password-reset links use the production HTTPS hostname. Check site configuration and proxy scheme handling when links show an internal or staging address.
Send a controlled test to a mailbox you own and inspect the sending result. If delivery is queued, verify the worker and failed-job handling.
Test the complete password-reset flow with a test account, including token expiry and the final successful sign-in.
02 Example: configure a Django 6.1 SMTP mailer
For Django 6.1, use the documented MAILERS configuration. This example assumes your provider has confirmed authenticated SMTP with STARTTLS on port 587. Keep credentials in the protected runtime environment.
import os
MAILERS = {
"default": {
"BACKEND": "django.core.mail.backends.smtp.EmailBackend",
"OPTIONS": {
"host": os.environ["SMTP_HOST"],
"port": 587,
"use_tls": True,
"username": os.environ["SMTP_USERNAME"],
"password": os.environ["SMTP_PASSWORD"],
"timeout": 10,
},
},
}
DEFAULT_FROM_EMAIL = "[email protected]"
Replace the sender with an identity your provider permits. Older Django releases use their documented EMAIL_* settings, so check your installed version before applying this fragment. Do not enable both implicit TLS and STARTTLS.
Expected result: a reset requested for your controlled test account reaches its mailbox, links to the correct public HTTPS site and completes sign-in. A successful SMTP connection alone does not prove the reset token or link is correct.
Confirm the expected result
Check receipt, link destination and the relevant provider delivery event. Treat SMTP acceptance, recipient delivery and inbox placement as separate observations.
Troubleshoot unexpected results
If nothing arrives, confirm the real backend is active and inspect the private error or queue record. A bounce requires its reason and recipient address checked before retrying.
A common question
Why does a password reset appear successful for an unknown address?
Applications commonly use a neutral response to avoid disclosing which email addresses have accounts. Use an account you control for testing and inspect authorised logs rather than exposing account existence publicly.