I am configuring the latest version of CiviCRM (Drupal) to use Mailgun as an external SMTP service. When I go to Administer > System Settings > Outbound Email, enter the SMTP credentials, and click Save & Send Test Email, everything works great, I receive the test email, and the masked password continues to appear in the password field. If I then go to send a mailing, my emails all bounce with the error:

authentication failure [SMTP: Invalid response code received from SMTP server while sending email. This is often caused by a misconfiguration in Outbound Email settings. Please verify the settings at Administer CiviCRM >> Global Settings >> Outbound Ema

When I return to the Outbound Email page, the masked password is now gone, and I'm unable to send another test without reentering the password. If I reenter the password and click Save instead of Save & Send Test Email the same thing happens. When I return to the Outbound Email page, the saved password is gone.

I didn't set up this CiviCRM installation, I'm just helping someone out with theirs. Is there a setting I'm missing that would account for this? Is it possible an overriding SMTP password is passed in as an environment variable somewhere or something?

  • Check in sites/default/civicrm.settings.php. Somebody may have set an override for smtp.
    – Demerit
    Commented Sep 9, 2022 at 2:28
  • Also if it's a recent-ish version of civi check if civicrm.settings.php has CIVICRM_CRED_KEYS and CIVICRM_SIGN_KEYS defined. If not you can use this tool to generate: civisettings.symbiotic.coop
    – Demerit
    Commented Sep 9, 2022 at 2:32
  • @Demerit There are cred and sign keys but nothing related to SMTP.
    – selfagency
    Commented Sep 9, 2022 at 15:43

2 Answers 2


I was incorrect, the password is not being deleted. It just requires a certain flag to be passed to load in the existing password, which is saved in the database.


I had the same issue with an installation of a client.

It appeared that the drupal settings.php file contained this:

ini_set('arg_separator.output', '&');

This interferes with the method that encrypts the SMTP parameters and that stores them in the database.

The method encrypt() in Civi/Crypto/CryptoToken.php uses the PHP function http_build_query without specifying the $arg_separator. The default is an ampersand, but in the case of my client, the value of arg_separator.output was taken. The decrypt function however, expects an ampersand.

That's why the password can be encrypted, but not properly decrypted.

If you encounter this edge case, search for arg_separator.output in your php.ini file and in the settings file of the CMS and CiviCRM, and put this statement in comments or remove it all together.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.