How to Automate Emails with Python
Automated emails — weekly reports, alerts when a file changes, scheduled reminders — are a classic first automation. Python's built-in smtplib needs no extra libraries. The critical part is doing it safely: credentials never go in the code, and bulk sending follows anti-spam rules.
Step 1: Create an app password, not your real password
For Gmail, turn on 2-step verification, then generate an App Password in your Google account security settings and use that for scripts. For other providers, use their equivalent app-specific password or SMTP token. Never put your main account password in a script — app passwords can be revoked individually if a script leaks.
Step 2: Send one email from a script
Store the credentials as environment variables, then send:
import os, smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
sender = os.environ["EMAIL_USER"]
password = os.environ["EMAIL_APP_PASSWORD"] # app password, not your login password
msg = MIMEMultipart()
msg["From"] = sender
msg["To"] = "manager@example.com"
msg["Subject"] = "Weekly sales report"
msg.attach(MIMEText("Hi,\n\nThe weekly report is attached.\n\nAutomated report", "plain"))
with smtplib.SMTP_SSL("smtp.gmail.com", 465) as server:
server.login(sender, password)
server.sendmail(sender, msg["To"], msg.as_string())
print("Sent.")To attach a file, add a MIMEApplication part with the file's bytes — the standard library documentation shows the exact pattern, and it pairs naturally with the Excel report script in this series: generate the report, then email it, in one scheduled run.
Step 3: Schedule and protect it
Schedule with Task Scheduler (Windows) or cron (macOS/Linux), exactly as in the Excel guide. Then add three protections: (1) a recipient allow-list in the script so a typo cannot mail strangers; (2) a daily send cap and a log line for every send, so a bug cannot loop into thousands of emails; (3) a plain-text unsubscribe or contact line on any recurring mail. Respect the provider's sending limits — Gmail's daily limits apply to app-password sends too — and never buy or scrape email lists; automated mail to people who did not ask for it is spam, and providers will block the account.
Common mistakes
Hardcoding passwords; sending from a personal inbox at bulk volume; no logging, so failures go unnoticed for weeks; and HTML-only emails with no plain-text part, which spam filters penalise.
Frequently asked questions
Why an app password instead of my normal password?
An app password is a separate, revocable credential for one purpose. If a script file leaks, you revoke that one password instead of changing your account password and breaking everything else.
Can I send bulk marketing emails this way?
Technically yes, but you should not: providers cap daily sends, spam filters block suspicious volume, and unsolicited bulk mail violates provider policies. Use a proper email service (with consent lists and unsubscribe handling) for marketing.
What if the script fails silently?
Log every send with a timestamp, and add a second channel for failures — for example, write errors to a file that your weekly review checks, or send a failure alert to yourself.