ofper sends candidate email through your company's own mailbox over SMTP — never from a shared ofper address. Candidates see your address, replies land in your inbox, and your own domain reputation does the delivery work. It is also why recruiting email is free: ofper never pays to send it.
Connecting a mailbox requires a verified company, and only an owner or admin can do it. There is one mailbox per company, shared by everyone in the workspace. Open Company settings → Recruiting mailbox, fill in the SMTP host, port, username and password, save, then send yourself a test email.
Which port: 465 or 587?
Both work. Port 465 opens an encrypted connection immediately (implicit TLS) and is the right choice for Gmail. Port 587 starts unencrypted and upgrades to TLS (STARTTLS) and is the right choice for Microsoft 365. The form defaults to 465, so change it to 587 for Outlook. Never use port 25.
Gmail and Google Workspace
Google stopped accepting normal account passwords over SMTP. You need a 16-character App Password, and App Passwords only appear once 2-Step Verification is switched on for that account.
- Turn on 2-Step Verification for the mailbox: myaccount.google.com → Security.
- Go to myaccount.google.com/apppasswords, create a password named “ofper”, and copy the 16-character code. Google shows it once.
- SMTP host: smtp.gmail.com — Port: 465
- Username: the full address, for example [email protected]
- Password: the 16-character App Password, with or without spaces — not your account password.
Two Gmail quirks worth knowing. Gmail rewrites the From address to the account you authenticated as, so the optional “From address” field only changes the display name, not the address candidates see. And on Google Workspace an administrator can block App Passwords entirely — if the option is missing from your account, that is usually why, and your admin has to allow it.
Microsoft 365 and Outlook
Microsoft turns off SMTP for mailboxes by default, so this almost always needs one setting changed by an administrator first. The setting is called Authenticated SMTP, and it is enabled per mailbox in the Microsoft 365 admin center under Users → Active users → the mailbox → Mail → Manage email apps.
- SMTP host: smtp.office365.com — Port: 587
- Username: the full address, for example [email protected]
- Password: the mailbox password, or an app password if the account requires one.
- If the test email fails with an authentication error, Authenticated SMTP is still switched off for that mailbox.
Microsoft has been retiring password-based SMTP across its consumer and business mail, so a personal outlook.com or hotmail.com address may refuse to connect at all no matter what you set. Check Microsoft's current guidance above before spending long on it. A mailbox on your own domain is the better answer anyway: a personal address is a weak From line on a job offer, and candidates are more likely to trust [email protected].
Any other mailbox
Anything that speaks SMTP works. Zoho Mail is smtp.zoho.com on port 465. Your own mail server uses whatever host your provider documents. A transactional provider such as Amazon SES, Postmark or SendGrid also works and generally delivers best, though each one asks you to verify your sending domain with them first.
Whatever you pick, send from an address on your own verified domain, and make sure that domain has SPF and DKIM records. Mail from a mismatched or unauthenticated address is what puts interview invites in a candidate's spam folder.
When the test email fails
Save the settings, press Send test email, and read the error rather than guessing.
- Authentication or login errors: for Gmail you used the account password instead of an App Password; for Microsoft 365 the admin has not enabled Authenticated SMTP.
- Connection timeouts: the port is wrong for the provider. Try 587 instead of 465, or the reverse.
- The test arrives but real mail does not: check that the mailbox is not over a daily sending limit. Gmail and Workspace both cap messages per day.
- Nothing arrives at all: look in the spam folder before changing settings.
Your password is encrypted before it is stored, and it is never displayed back to you or sent to the browser again — the field simply shows that a password is saved. You can replace it at any time by typing a new one and saving.