SMTP Configuration

Overview

Vaultwarden-Plus uses outbound mail for mail-dependent flows such as Account Recovery notifications, Send Email Verification OTPs, and preview notifications. Supported transports documented in the repository are SMTP, sendmail, and AWS SES.

Requirements

• SMTP_FROM plus either SMTP_HOST, USE_SENDMAIL, or USE_AWS_SES.
• SMTP_PASSWORD when SMTP_USERNAME is set.
• Valid transport credentials and network access.
• For SES, a build containing the ses feature and valid AWS credentials from the standard AWS credential chain.

Configuration

SMTP example:

SMTP_HOST=smtp.example.org
SMTP_FROM=vaultwarden@example.org
SMTP_FROM_NAME=Vaultwarden
SMTP_USERNAME=username
SMTP_PASSWORD=password
SMTP_TIMEOUT=15
SMTP_SECURITY=starttls
SMTP_PORT=587

sendmail example:

SMTP_FROM=vaultwarden@example.org
USE_SENDMAIL=true
SENDMAIL_COMMAND="/path/to/sendmail"

AWS SES example:

SMTP_FROM=vaultwarden@example.org
USE_AWS_SES=true

Optional documented mail settings include SMTP_AUTH_MECHANISM, SMTP_EMBED_IMAGES, SMTP_DEBUG, SMTP_ACCEPT_INVALID_CERTS, and SMTP_ACCEPT_INVALID_HOSTNAMES.

Examples

Use SMTP for a normal relay. Use SES when the deployment has AWS credentials and the image supports SES. Use sendmail when the host/container environment provides a compatible sendmail command.

Troubleshooting

• Mail-dependent OTP and recovery flows can fail closed when mail is unavailable.
• If SES startup validation fails, verify the image was built with SES support and that AWS credentials are available.
• Avoid SMTP_DEBUG=true in normal production operation because it can produce detailed mail logs.
• Do not publish SMTP credentials, tokens, OTP values, or mail action links.

Related Pages

• DKIM Configuration
• Account Recovery
• Mail Preview

Canonical Documentation

• Environment Template
• Features: AWS SES Mail Transport
• Known Limitations