The End of Password-Based SMTP: Yandex and Mail.ru Join the Lockdown

Why Yandex and Mail.ru Are Pulling the Plug on Password-Based SMTP

Yandex and Mail.ru (owned by VK) have quietly joined Google and Microsoft in limiting free access to email via SMTP, IMAP, and POP3 using simple passwords. If your business relies on these services for automated email sending—like notifications, newsletters, or support tickets—it's time to rethink your authentication strategy. The practical impact is immediate: password-based access is being phased out in favor of OAuth2 tokens or API keys.

What This Means for Your Business

Think of it like this: you've been using the same rusty key to unlock your office door for years. Suddenly, the landlord replaces the lock with a biometric scanner. Annoying, but necessary. Similarly, the days of storing a plain username and password in your code are over. Companies that don't migrate to modern authentication will face email delivery failures and potential security risks.

The Shift to Secure Authentication

The change isn't arbitrary. It's driven by a need to reduce spam and phishing attacks that exploit compromised credentials. By requiring OAuth2 or dedicated API keys, Yandex and Mail.ru ensure that each application has its own revocable permission, making unauthorized access harder. For businesses, this means updating scripts, software, and integrations that rely on SMTP.

Legal Implications Under GDPR and Beyond

From a privacy perspective, this move aligns with data protection principles like accountability and security by design. If you're processing personal data (e.g., email addresses) when sending automated emails, you must ensure that your service provider offers adequate safeguards. Using legacy password authentication may expose you to liability if a breach occurs. Consider whether you need to update your Data Processing Agreement with Yandex or Mail.ru.

Practical Steps to Adapt

• Identify all applications using SMTP/IMAP/POP3 with password auth.
• Contact Yandex or Mail.ru support to enable OAuth2 or generate API keys.
• Update your code to use the new authentication method—most libraries support OAuth2 out of the box.
• Test thoroughly before the old method is fully deprecated.
• Consider switching to a dedicated email service provider like SendGrid, Amazon SES, or Mailgun for better deliverability and support.

If you're thinking, 'But my old script still works!'—it won't for long. Yandex and Mail.ru have already begun blocking password-based logins. Act now to avoid disruption.

FAQ