diff --git a/README.md b/README.md
index f8b51dd..7888eb7 100644
--- a/README.md
+++ b/README.md
@@ -70,6 +70,25 @@ that **share your wireless link** are marked. The same card lists any eero that
 lost its connection and reconnected, which shows drops even when they happen
 between pings.
 
+## Daily email report
+
+The dashboard's **Daily email report** card emails you every slowdown and dropout
+since the last report, with its reason, the game you were playing, and who was busy
+on the network. It's useful for tracking a problem over days, or for showing it to
+whoever owns the eero, or to AT&T.
+
+- **When:** once a day when HogWatch starts, or at 8 AM if it's already running,
+  plus **Send report now** anytime. **Preview report** shows it without sending.
+- **Sending account:** mail goes out through your own email account. For Gmail,
+  create an [App Password](https://myaccount.google.com/apppasswords) (needs 2-Step
+  Verification). It's a separate password that can only send mail and can be revoked
+  on its own. HogWatch stores it encrypted with Windows DPAPI in `data\email.json`,
+  so only your Windows account can read it, and the dashboard never sends it back.
+- **Other providers:** open "Not using Gmail?" and enter your provider's server and port.
+  HogWatch only sends over an encrypted connection.
+- **From a terminal:** `.venv\Scripts\python.exe -m hogwatch send-report` sends one now;
+  add `--preview` to save it as `data\report_preview.html` instead.
+
 ## Reading the results
 
 - **"Internet crawled"**: the line was full. Look at "Biggest user". An **upload**
@@ -102,5 +121,7 @@ Settings › eero Labs › **Optimize for Conferencing and Gaming**.
 - Per-program data comes from the `Microsoft-Windows-Kernel-Network` ETW provider (TCP + UDP, IPv4 + IPv6).
   Only internet traffic is counted per program; traffic to devices at home is left out.
 - The dashboard has no external scripts, so it keeps working while the internet is down.
-- Command line: `.venv\Scripts\python.exe -m hogwatch run | eero-login | eero-check | selftest`
+- The dashboard only answers requests addressed to `127.0.0.1` or `localhost` (blocks DNS
+  rebinding), and every change needs a custom header that other websites can't send.
+- Command line: `.venv\Scripts\python.exe -m hogwatch run | eero-login | eero-check | selftest | send-report`
 - Tests: `.venv\Scripts\python.exe -m unittest discover -s tests`
diff --git a/hogwatch/__main__.py b/hogwatch/__main__.py
index 51e218d..355d4aa 100644
--- a/hogwatch/__main__.py
+++ b/hogwatch/__main__.py
@@ -4,6 +4,7 @@
     python -m hogwatch eero-login           connect to the eero (one time)
     python -m hogwatch eero-check           show what the eero reports right now
     python -m hogwatch selftest             15-second check that everything works
+    python -m hogwatch send-report          email the last 24 hours now (--preview: save it as HTML instead)
 """
 
 from __future__ import annotations
@@ -45,6 +46,7 @@ def cmd_run(args) -> int:
     """Start everything and serve the dashboard until stopped."""
     from .collector import Collector
     from .db import DB
+    from .report import EmailSettings, Reporter
     from .web import make_server
 
     _setup_logging()
@@ -54,8 +56,9 @@ def cmd_run(args) -> int:
     done = threading.Event()
     collector_ref: dict = {}
     db_ref: dict = {}
+    reporter_ref: dict = {}
     try:
-        server = make_server(cfg["port"], collector_ref, db_ref, on_shutdown=done.set)
+        server = make_server(cfg["port"], collector_ref, db_ref, on_shutdown=done.set, reporter_ref=reporter_ref)
     except OSError:
         log.info("HogWatch is already running -- opening the dashboard")
         if not args.no_browser:
@@ -70,6 +73,10 @@ def cmd_run(args) -> int:
     collector = Collector(cfg, db)
     collector.start()
     collector_ref["c"] = collector
+    # Daily email report (does nothing until an address and app password are saved).
+    reporter = Reporter(db, EmailSettings(DATA_DIR / "email.json"), stopping=done)
+    reporter_ref["r"] = reporter
+    threading.Thread(target=reporter.loop, name="report", daemon=True).start()
     if not args.no_browser:
         webbrowser.open(url)
     try:
@@ -194,6 +201,28 @@ def out(s=""):
     return 0
 
 
+def cmd_send_report(args) -> int:
+    """Email a report of the last N hours now, or (--preview) save it as an HTML file without sending."""
+    from .db import DB
+    from .report import EmailSettings, Reporter, build_report
+
+    db = DB(DATA_DIR / "hogwatch.db")
+    if args.preview:
+        now = time.time()
+        rep = build_report(db, now - args.hours * 3600, now)
+        out = DATA_DIR / "report_preview.html"
+        out.write_text(f"<!doctype html><meta charset=utf-8><title>{rep['subject']}</title>{rep['html']}",
+                       encoding="utf-8")
+        print(f"Subject: {rep['subject']}\n\n{rep['text']}\nHTML version saved to {out}")
+        return 0
+    result = Reporter(db, EmailSettings(DATA_DIR / "email.json"), threading.Event()).send(daily=False, hours=args.hours)
+    if result["ok"]:
+        print(f"Sent to {', '.join(result['to'])}: {result['subject']}")
+        return 0
+    print(f"Not sent: {result['error']}")
+    return 1
+
+
 def main() -> int:
     """Parse the command and run it."""
     p = argparse.ArgumentParser(prog="hogwatch", description="Find out who is slowing the internet down.")
@@ -204,12 +233,15 @@ def main() -> int:
     sub.add_parser("eero-check", help="show what the eero reports right now")
     st = sub.add_parser("selftest", help="15-second check that everything works")
     st.add_argument("--seconds", type=int, default=15)
+    sr = sub.add_parser("send-report", help="email the recent slowdowns and dropouts now")
+    sr.add_argument("--hours", type=float, default=24, help="how far back to cover (default 24)")
+    sr.add_argument("--preview", action="store_true", help="save the report as HTML instead of sending")
     args = p.parse_args()
     if args.cmd is None:
         args = p.parse_args(["run"])
     DATA_DIR.mkdir(parents=True, exist_ok=True)
     return {"run": cmd_run, "eero-login": cmd_eero_login, "eero-check": cmd_eero_check,
-            "selftest": cmd_selftest}[args.cmd](args)
+            "selftest": cmd_selftest, "send-report": cmd_send_report}[args.cmd](args)
 
 
 if __name__ == "__main__":
diff --git a/hogwatch/eero.py b/hogwatch/eero.py
index a004f61..74b08db 100644
--- a/hogwatch/eero.py
+++ b/hogwatch/eero.py
@@ -235,6 +235,8 @@ def parse_device(d: dict) -> dict:
         f"{manufacturer or 'Unknown device'} ({mac[-5:]})")
     usage = d.get("usage") or {}
     profile = d.get("profile") or {}
+    if isinstance(profile, dict) and (profile.get("name") or "").strip().lower() in ("", "unassigned"):
+        profile = {}  # eero's placeholder for "no profile", not a person
     wired = d.get("connection_type") == "wired" or d.get("wireless") is False
     return {
         "mac": mac,
diff --git a/hogwatch/report.py b/hogwatch/report.py
new file mode 100644
index 0000000..606413d
--- /dev/null
+++ b/hogwatch/report.py
@@ -0,0 +1,402 @@
+"""Daily email report: every slowdown and dropout since the last report, with reasons.
+
+Mail goes out through the user's own email account over SMTP (TLS only). For
+Gmail that means an App Password -- a 16-character password that can only
+send mail and can be revoked on its own. It's stored encrypted with Windows
+DPAPI (see secret.py) and never returned by the dashboard API.
+"""
+
+from __future__ import annotations
+
+import base64
+import datetime as dt
+import html
+import json
+import logging
+import re
+import smtplib
+import ssl
+import threading
+import time
+from collections import Counter, defaultdict
+from email.message import EmailMessage
+from email.utils import formatdate, make_msgid
+from pathlib import Path
+
+from . import secret
+from .incidents import fmt_mbps
+
+log = logging.getLogger(__name__)
+
+DEFAULTS = {
+    "to": "",              # one or more addresses, comma-separated
+    "from": "",            # the account that sends it (e.g. your Gmail address)
+    "username": "",        # SMTP login; empty = same as "from"
+    "smtp_host": "smtp.gmail.com",
+    "smtp_port": 587,      # 587 = STARTTLS, 465 = TLS from the start
+    "daily": True,
+    "send_hour": 8,        # if HogWatch is already running, the daily report goes out at this hour
+}
+_EMAIL_RE = re.compile(r"^[^@\s,;<>\"]+@[^@\s,;<>\"]+\.[^@\s,;<>\"]+$")
+MAX_REPORT_DAYS = 7
+
+
+class ReportError(Exception):
+    """A problem the user can fix (bad address, rejected login, unreachable server)."""
+
+
+def parse_recipients(value: str) -> list[str]:
+    """Split 'a@b.com, c@d.com' into addresses; raise ReportError on anything malformed."""
+    parts = [p.strip() for p in re.split(r"[,;\s]+", value or "") if p.strip()]
+    bad = [p for p in parts if not _EMAIL_RE.match(p)]
+    if bad:
+        raise ReportError(f"That doesn't look like an email address: {bad[0]}")
+    return parts
+
+
+# ------------------------------------------------------------------ settings
+
+
+class EmailSettings:
+    """data/email.json: where reports go and how to send them. The password is stored DPAPI-encrypted."""
+
+    def __init__(self, path: Path):
+        """`path` is the JSON file (data/email.json in normal use)."""
+        self.path = path
+
+    def _raw(self) -> dict:
+        try:
+            return json.loads(self.path.read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            return {}
+
+    def load(self) -> dict:
+        """Settings for display: never includes the password, just whether one is saved."""
+        raw = self._raw()
+        out = dict(DEFAULTS)
+        out.update({k: v for k, v in raw.items() if k in DEFAULTS})
+        out["password_set"] = bool(raw.get("password_dpapi"))
+        return out
+
+    def password(self) -> str | None:
+        """The decrypted app password, or None if none is saved."""
+        blob = self._raw().get("password_dpapi")
+        if not blob:
+            return None
+        return secret.unprotect(base64.b64decode(blob))
+
+    def save(self, updates: dict) -> dict:
+        """Validate and store changes. An empty password leaves the saved one alone."""
+        raw = self._raw()
+        for key in ("to", "from", "username", "smtp_host"):
+            if key in updates:
+                raw[key] = str(updates[key] or "").strip()
+        if "to" in updates and raw["to"]:
+            raw["to"] = ", ".join(parse_recipients(raw["to"]))
+        for key in ("from", "username"):
+            if raw.get(key) and not _EMAIL_RE.match(raw[key]):
+                raise ReportError(f"That doesn't look like an email address: {raw[key]}")
+        if "smtp_port" in updates:
+            try:
+                port = int(updates["smtp_port"])
+            except (TypeError, ValueError):
+                raise ReportError("The port must be a number (587 for Gmail)") from None
+            if not 1 <= port <= 65535:
+                raise ReportError("The port must be between 1 and 65535")
+            raw["smtp_port"] = port
+        if "daily" in updates:
+            raw["daily"] = bool(updates["daily"])
+        if updates.get("clear_password"):
+            raw.pop("password_dpapi", None)
+        elif updates.get("password"):
+            # Google shows app passwords with spaces ("abcd efgh ijkl mnop"); they work either way.
+            pw = str(updates["password"]).strip()
+            raw["password_dpapi"] = base64.b64encode(secret.protect(pw)).decode("ascii")
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps(raw, indent=2), encoding="utf-8")
+        return self.load()
+
+
+# ------------------------------------------------------------------ building the report
+
+
+def _clock(ts: float) -> str:
+    """'Thu Sep 24, 9:17 PM' (no leading zero; Windows strftime lacks %-I)."""
+    d = dt.datetime.fromtimestamp(ts)
+    return f"{d:%a %b} {d.day}, {d.hour % 12 or 12}:{d.minute:02d} {'AM' if d.hour < 12 else 'PM'}"
+
+
+def _dur(secs: float) -> str:
+    secs = max(1, int(round(secs)))
+    if secs < 60:
+        return f"{secs} sec"
+    m, s = divmod(secs, 60)
+    return f"{m} min" + (f" {s} sec" if s and m < 5 else "")
+
+
+_KIND_LABEL = {
+    "eero_link": "Link between eeros dropped", "congested": "Internet crawled", "outage": "Internet dropped out",
+    "home": "Home network slow", "home_outage": "PC lost the eero",
+}
+
+
+def _advice(where: str, path: dict | None) -> str | None:
+    """The same fix suggestion the dashboard shows for the most common dropout location."""
+    wired = bool(path and path.get("wired"))
+    return {
+        "eero_link": ("Check that both ends of the cable between your eeros are plugged in, or try another cable."
+                      if wired else
+                      "Most dropouts are on the wireless link between your eeros, not your internet line. "
+                      "An Ethernet cable between those two eeros (a wired backhaul) would fix them."),
+        "pc_link": "Most dropouts are between this PC and its eero. Try a different cable and the eero's other port.",
+        "eero": "Most dropouts are inside your main eero. Restart it and check the eero app for updates.",
+        "att": "Most dropouts are at the AT&T gateway. Restart it; if they continue, give AT&T these times.",
+        "internet": "Most dropouts happen past your eeros (AT&T or beyond). If frequent, give AT&T these times.",
+    }.get(where)
+
+
+def build_report(db, since: float, until: float) -> dict:
+    """Everything that went wrong in [since, until): subject line, plain text, and HTML."""
+    hiccups = db.query("SELECT * FROM hiccup WHERE start_ts >= ? AND start_ts < ? ORDER BY start_ts", (since, until))
+    incidents = db.query("SELECT * FROM incident WHERE start_ts >= ? AND start_ts < ? AND end_ts IS NOT NULL "
+                         "ORDER BY start_ts", (since, until))
+    events = db.query("SELECT * FROM eero_event WHERE ts >= ? AND ts < ? ORDER BY ts", (since, until))
+    raw_path = db.get_meta("eero_path")
+    path = json.loads(raw_path) if raw_path else None
+
+    where_counts = Counter(h["where_"] for h in hiccups)
+    where_text: dict[str, str] = {}
+    where_secs: dict[str, float] = defaultdict(float)
+    for h in hiccups:
+        where_text.setdefault(h["where_"], h["where_text"])
+        where_secs[h["where_"]] += h["end_ts"] - h["start_ts"]
+    in_game = sum(1 for h in hiccups if h["game"])
+    down_secs = sum(h["end_ts"] - h["start_ts"] for h in hiccups)
+    advice = None
+    if hiccups:
+        top, n = where_counts.most_common(1)[0]
+        if len(hiccups) >= 3 and n / len(hiccups) >= 0.6:
+            advice = _advice(top, path)
+
+    period = f"{_clock(since)} to {_clock(until)}"
+    nd, ns = len(hiccups), len(incidents)
+    if nd or ns:
+        bits = []
+        if nd:
+            bits.append(f"{nd} dropout{'s' if nd != 1 else ''}")
+        if ns:
+            bits.append(f"{ns} slowdown{'s' if ns != 1 else ''}")
+        subject = f"HogWatch: {' and '.join(bits)} since {_clock(since)}"
+    else:
+        subject = f"HogWatch: all clear since {_clock(since)}"
+
+    def busy_text(h) -> str:
+        busy = json.loads(h["busy"]) if h["busy"] else []
+        if not busy:
+            return "nobody heavy"
+        return ", ".join(f"{b['name']} ↓{fmt_mbps(b['down_mbps'])} ↑{fmt_mbps(b['up_mbps'])} Mbps"
+                         + (" (shares your link)" if b.get("on_link") and not b.get("this_pc") else "")
+                         for b in busy[:3])
+
+    def how_bad(h) -> str:
+        parts = []
+        if h["lost"]:
+            parts.append(f"{h['lost']} ping{'s' if h['lost'] != 1 else ''} lost")
+        if h["worst_ms"]:
+            parts.append(f"worst {h['worst_ms']:.0f} ms")
+        return ", ".join(parts) or "slow"
+
+    # ---- plain text
+    lines = [f"HogWatch report for {period}", ""]
+    if not (nd or ns):
+        lines.append("No slowdowns or dropouts. Everything ran normally.")
+    else:
+        lines.append(f"Dropouts (lag spikes): {nd}, about {_dur(down_secs)} offline in total"
+                     + (f", {in_game} during a game" if in_game else ""))
+        for where, n in where_counts.most_common():
+            lines.append(f"  {n} {where_text[where]} ({_dur(where_secs[where])})")
+        lines.append(f"Slowdowns: {ns}")
+        if advice:
+            lines += ["", f"Suggested fix: {advice}"]
+    if hiccups:
+        lines += ["", "DROPOUTS"]
+        for h in hiccups:
+            lines.append(f"- {_clock(h['start_ts'])}, {_dur(h['end_ts'] - h['start_ts'])}, {how_bad(h)}: {h['where_text']}"
+                         + (f". Game: {h['game']}" if h["game"] else "") + f". Busy: {busy_text(h)}")
+    if incidents:
+        lines += ["", "SLOWDOWNS"]
+        for i in incidents:
+            lines.append(f"- {_clock(i['start_ts'])} ({_KIND_LABEL.get(i['kind'], i['kind'])}): {i['headline']}")
+    if events:
+        lines += ["", "EEROS THAT LOST THEIR CONNECTION"]
+        for e in events:
+            lines.append(f"- {_clock(e['ts'])}: {e['unit']} eero reconnected")
+    lines += ["", "Open the dashboard for charts: http://127.0.0.1:8765/ (on the PC running HogWatch)"]
+    text = "\n".join(lines) + "\n"
+
+    # ---- HTML (inline styles: most email apps strip <style> blocks). Everything
+    # from the network -- device names, eero names -- is escaped.
+    e = html.escape
+    td = 'style="padding:6px 8px;border-bottom:1px solid #e1e0d9;vertical-align:top"'
+    th = 'style="padding:6px 8px;border-bottom:1px solid #c3c2b7;text-align:left;color:#52514e;font-weight:600"'
+    parts = [f'<div style="font-family:Segoe UI,system-ui,sans-serif;color:#0b0b0b;max-width:760px">',
+             f'<h2 style="margin:0 0 4px">HogWatch report</h2><p style="margin:0 0 16px;color:#52514e">{e(period)}</p>']
+    if not (nd or ns):
+        parts.append('<p style="font-size:16px">&#10004; No slowdowns or dropouts. Everything ran normally.</p>')
+    else:
+        parts.append(f'<p style="font-size:16px;margin:0 0 6px"><b>{nd} dropout{"s" if nd != 1 else ""}</b> '
+                     f'(about {e(_dur(down_secs))} offline{f", {in_game} during a game" if in_game else ""}) and '
+                     f'<b>{ns} slowdown{"s" if ns != 1 else ""}</b>.</p><ul style="margin:0 0 12px">')
+        for where, n in where_counts.most_common():
+            parts.append(f"<li><b>{n}</b> {e(where_text[where])} ({e(_dur(where_secs[where]))})</li>")
+        parts.append("</ul>")
+        if advice:
+            parts.append(f'<p style="border-left:4px solid #2a78d6;padding:8px 12px;background:#f3f2ee">'
+                         f'<b>Suggested fix:</b> {e(advice)}</p>')
+    if hiccups:
+        parts.append(f'<h3 style="margin:20px 0 6px">Dropouts</h3><table style="border-collapse:collapse;font-size:14px;width:100%">'
+                     f"<tr><th {th}>When</th><th {th}>Length</th><th {th}>How bad</th><th {th}>Where</th>"
+                     f"<th {th}>Game</th><th {th}>Busy on the network</th></tr>")
+        for h in hiccups:
+            parts.append(f"<tr><td {td}>{e(_clock(h['start_ts']))}</td><td {td}>{e(_dur(h['end_ts'] - h['start_ts']))}</td>"
+                         f"<td {td}>{e(how_bad(h))}</td><td {td}>{e(h['where_text'] or '')}</td>"
+                         f"<td {td}>{e(h['game'] or '–')}</td><td {td}>{e(busy_text(h))}</td></tr>")
+        parts.append("</table>")
+    if incidents:
+        parts.append(f'<h3 style="margin:20px 0 6px">Slowdowns</h3><table style="border-collapse:collapse;font-size:14px;width:100%">'
+                     f"<tr><th {th}>When</th><th {th}>What happened and why</th></tr>")
+        for i in incidents:
+            parts.append(f"<tr><td {td}>{e(_clock(i['start_ts']))}<br><span style=\"color:#52514e\">"
+                         f"{e(_KIND_LABEL.get(i['kind'], i['kind'] or ''))}</span></td><td {td}>{e(i['headline'] or '')}</td></tr>")
+        parts.append("</table>")
+    if events:
+        parts.append('<h3 style="margin:20px 0 6px">eeros that lost their connection</h3><ul>')
+        parts += [f"<li>{e(_clock(ev['ts']))}: {e(ev['unit'])} eero reconnected</li>" for ev in events]
+        parts.append("</ul>")
+    parts.append('<p style="color:#6f6d68;font-size:12px;margin-top:24px">Sent by HogWatch. Charts: '
+                 'http://127.0.0.1:8765/ on the PC running it.</p></div>')
+    return {"subject": subject, "text": text, "html": "".join(parts),
+            "counts": {"dropouts": nd, "slowdowns": ns, "reconnects": len(events)}}
+
+
+# ------------------------------------------------------------------ sending
+
+
+def send_email(settings: dict, password: str, subject: str, text: str, html_body: str, timeout: float = 30) -> list[str]:
+    """Send over SMTP with TLS (never in the clear). Returns the recipients."""
+    to = parse_recipients(settings.get("to", ""))
+    sender = settings.get("from") or ""
+    if not to:
+        raise ReportError("Enter at least one address to send reports to")
+    if not sender:
+        raise ReportError("Enter the email address to send from")
+    if not password:
+        raise ReportError("Enter the app password for the sending account")
+    msg = EmailMessage()
+    msg["Subject"] = subject
+    msg["From"] = sender
+    msg["To"] = ", ".join(to)
+    msg["Date"] = formatdate(localtime=True)
+    msg["Message-ID"] = make_msgid(domain="hogwatch.local")
+    msg.set_content(text)
+    msg.add_alternative(html_body, subtype="html")
+
+    host, port = settings.get("smtp_host") or "smtp.gmail.com", int(settings.get("smtp_port") or 587)
+    ctx = ssl.create_default_context()
+    try:
+        if port == 465:
+            smtp = smtplib.SMTP_SSL(host, port, timeout=timeout, context=ctx)
+        else:
+            smtp = smtplib.SMTP(host, port, timeout=timeout)
+            smtp.ehlo()
+            smtp.starttls(context=ctx)  # refuses to continue if the server can't do TLS
+            smtp.ehlo()
+        with smtp:
+            smtp.login(settings.get("username") or sender, password.replace(" ", ""))
+            smtp.send_message(msg)
+    except smtplib.SMTPAuthenticationError as err:
+        raise ReportError(f"{host} rejected the login. For Gmail, use an App Password (not your normal "
+                          "password) and make sure 'Send from' is that Gmail address.") from err
+    except smtplib.SMTPNotSupportedError as err:
+        raise ReportError(f"{host} doesn't support a secure connection on port {port}.") from err
+    except (smtplib.SMTPException, OSError) as err:
+        raise ReportError(f"Couldn't send through {host}:{port} ({err}).") from err
+    return to
+
+
+# ------------------------------------------------------------------ scheduling
+
+
+def is_due(now: dt.datetime, last_daily: str | None, startup: bool, send_hour: int) -> bool:
+    """The daily report is due once per calendar day: at startup, or from `send_hour` if already running."""
+    if last_daily == now.date().isoformat():
+        return False
+    return startup or now.hour >= send_hour
+
+
+class Reporter:
+    """Sends the daily report and on-demand reports; remembers what was sent in the DB's meta table."""
+
+    STARTUP_DELAY_S = 90   # after boot, let the network come up before emailing
+    CHECK_EVERY_S = 900
+    RETRY_AFTER_S = 3600   # after a failure, don't hammer the mail server
+
+    def __init__(self, db, settings: EmailSettings, stopping: threading.Event):
+        """`stopping` is the app's shutdown event."""
+        self.db = db
+        self.settings = settings
+        self.stopping = stopping
+        self.lock = threading.Lock()
+        self.last_attempt = 0.0
+
+    def status(self) -> dict:
+        """Last success/failure, for the dashboard."""
+        raw = self.db.get_meta("report_status")
+        return json.loads(raw) if raw else {}
+
+    def _record(self, **fields) -> None:
+        s = self.status()
+        s.update(fields)
+        self.db.set_meta("report_status", json.dumps(s))
+
+    def send(self, daily: bool, hours: float = 24) -> dict:
+        """Build and send one report. Daily reports cover the time since the last daily one;
+        on-demand ones cover the last `hours`."""
+        with self.lock:
+            now = time.time()
+            since = now - min(hours, MAX_REPORT_DAYS * 24) * 3600
+            if daily:
+                last_ts = self.status().get("last_daily_ts")
+                if last_ts:
+                    since = max(float(last_ts), now - MAX_REPORT_DAYS * 86400)
+            try:
+                cfg = self.settings.load()
+                rep = build_report(self.db, since, now)
+                to = send_email(cfg, self.settings.password() or "", rep["subject"], rep["text"], rep["html"])
+            except (ReportError, OSError) as err:
+                self._record(last_error=str(err), last_error_ts=int(now))
+                log.warning("email report failed: %s", err)
+                return {"ok": False, "error": str(err)}
+            fields = {"last_sent_ts": int(now), "last_to": ", ".join(to), "last_subject": rep["subject"],
+                      "last_error": None}
+            if daily:
+                fields.update(last_daily=dt.date.today().isoformat(), last_daily_ts=int(now))
+            self._record(**fields)
+            log.info("emailed report to %s: %s", ", ".join(to), rep["subject"])
+            return {"ok": True, "to": to, "subject": rep["subject"], "counts": rep["counts"]}
+
+    def loop(self) -> None:
+        """Send the daily report at startup (if not sent today), then check every 15 minutes."""
+        if self.stopping.wait(self.STARTUP_DELAY_S):
+            return
+        startup = True
+        while True:
+            cfg = self.settings.load()
+            ready = cfg["daily"] and cfg["to"] and cfg["from"] and cfg["password_set"]
+            if ready and time.time() - self.last_attempt > self.RETRY_AFTER_S and \
+                    is_due(dt.datetime.now(), self.status().get("last_daily"), startup, int(cfg["send_hour"])):
+                self.last_attempt = time.time()
+                self.send(daily=True)
+            startup = False
+            if self.stopping.wait(self.CHECK_EVERY_S):
+                return
diff --git a/hogwatch/secret.py b/hogwatch/secret.py
new file mode 100644
index 0000000..22c0f72
--- /dev/null
+++ b/hogwatch/secret.py
@@ -0,0 +1,70 @@
+"""Encrypt small secrets (the email app password) with Windows DPAPI.
+
+DPAPI ties the ciphertext to this Windows user account: another account, or a
+copy of the file on another PC, can't decrypt it, and there's no key file to
+manage or leak.
+"""
+
+from __future__ import annotations
+
+import ctypes
+from ctypes import wintypes
+
+CRYPTPROTECT_UI_FORBIDDEN = 0x1
+# Extra entropy so other programs running as the same user can't decrypt it by
+# accident with a plain CryptUnprotectData call.
+_ENTROPY = b"HogWatch email password v1"
+
+
+class DATA_BLOB(ctypes.Structure):
+    _fields_ = [("cbData", wintypes.DWORD), ("pbData", ctypes.POINTER(ctypes.c_char))]
+
+
+_crypt32 = ctypes.WinDLL("crypt32", use_last_error=True)
+_kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+_CryptProtectData = _crypt32.CryptProtectData
+_CryptProtectData.argtypes = [ctypes.POINTER(DATA_BLOB), wintypes.LPCWSTR, ctypes.POINTER(DATA_BLOB),
+                              ctypes.c_void_p, ctypes.c_void_p, wintypes.DWORD, ctypes.POINTER(DATA_BLOB)]
+_CryptProtectData.restype = wintypes.BOOL
+_CryptUnprotectData = _crypt32.CryptUnprotectData
+_CryptUnprotectData.argtypes = [ctypes.POINTER(DATA_BLOB), ctypes.c_void_p, ctypes.POINTER(DATA_BLOB),
+                                ctypes.c_void_p, ctypes.c_void_p, wintypes.DWORD, ctypes.POINTER(DATA_BLOB)]
+_CryptUnprotectData.restype = wintypes.BOOL
+_LocalFree = _kernel32.LocalFree
+_LocalFree.argtypes = [ctypes.c_void_p]
+
+
+def _blob(data: bytes):
+    """A DATA_BLOB over `data`, plus the buffer that must stay alive while it's used."""
+    buf = ctypes.create_string_buffer(data, len(data))
+    return DATA_BLOB(len(data), ctypes.cast(buf, ctypes.POINTER(ctypes.c_char))), buf
+
+
+def _take(out: DATA_BLOB) -> bytes:
+    """Copy the bytes out of a Windows-allocated blob and free it."""
+    try:
+        return ctypes.string_at(out.pbData, out.cbData)
+    finally:
+        _LocalFree(ctypes.cast(out.pbData, ctypes.c_void_p))
+
+
+def protect(plain: str) -> bytes:
+    """Encrypt `plain` for the current Windows user."""
+    inp, _keep1 = _blob(plain.encode("utf-8"))
+    ent, _keep2 = _blob(_ENTROPY)
+    out = DATA_BLOB()
+    if not _CryptProtectData(ctypes.byref(inp), "HogWatch", ctypes.byref(ent), None, None,
+                             CRYPTPROTECT_UI_FORBIDDEN, ctypes.byref(out)):
+        raise OSError(ctypes.get_last_error(), "Windows couldn't encrypt the password")
+    return _take(out)
+
+
+def unprotect(cipher: bytes) -> str:
+    """Decrypt bytes from protect(); fails for other users or other PCs."""
+    inp, _keep1 = _blob(cipher)
+    ent, _keep2 = _blob(_ENTROPY)
+    out = DATA_BLOB()
+    if not _CryptUnprotectData(ctypes.byref(inp), None, ctypes.byref(ent), None, None,
+                               CRYPTPROTECT_UI_FORBIDDEN, ctypes.byref(out)):
+        raise OSError(ctypes.get_last_error(), "Windows couldn't decrypt the saved password")
+    return _take(out).decode("utf-8")
diff --git a/hogwatch/static/app.js b/hogwatch/static/app.js
index 79eaf5a..d78b244 100644
--- a/hogwatch/static/app.js
+++ b/hogwatch/static/app.js
@@ -709,6 +709,89 @@ function renderHistory() {
   renderTables();
 }
 
+/* ------------------------------------------------------------------ email report */
+
+async function postJSON(path, body) {
+  /* Every POST carries X-HogWatch: the server rejects anything without it, so other
+     web pages can't change settings or trigger emails. */
+  const r = await fetch(path, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-HogWatch": "1" },
+    body: JSON.stringify(body || {}),
+  });
+  let data = {};
+  try { data = await r.json(); } catch (e) { /* non-JSON error page */ }
+  return { ok: r.ok && data.ok !== false, data };
+}
+
+function emailStatus(text, kind) {
+  const el = $("email-status");
+  el.textContent = text || "";
+  el.className = kind || "";
+}
+
+function describeEmailState(st, s) {
+  st = st || {};
+  if (st.last_error && (!st.last_sent_ts || st.last_error_ts > st.last_sent_ts)) {
+    return [`The last report couldn't be sent (${fmtClock(st.last_error_ts)}): ${st.last_error}`, "error"];
+  }
+  if (st.last_sent_ts) return [`Last report sent ${fmtClock(st.last_sent_ts)} to ${st.last_to}.`, ""];
+  if (!s.to || !s.from || !s.password_set) return ["Not set up yet. Fill in the fields above and press Save.", ""];
+  return [s.daily ? "Set up. The first daily report goes out the next time HogWatch starts, or at 8 AM." :
+    "Set up. Daily reports are off; use Send report now anytime.", ""];
+}
+
+async function loadEmail() {
+  let data;
+  try { data = await getJSON("/api/email"); } catch (e) { return; }
+  if (!data.settings) return;
+  const f = $("email-form"), s = data.settings;
+  f.elements.to.value = s.to || "";
+  f.elements.from.value = s.from || "";
+  f.elements.username.value = s.username || "";
+  f.elements.smtp_host.value = s.smtp_host || "";
+  f.elements.smtp_port.value = s.smtp_port || "";
+  f.elements.daily.checked = !!s.daily;
+  f.elements.password.value = "";
+  f.elements.password.placeholder = s.password_set ? "Saved. Type a new one only to replace it" : "16 letters from Google";
+  emailStatus(...describeEmailState(data.status, s));
+}
+
+async function saveEmail() {
+  const f = $("email-form").elements;
+  const body = {
+    to: f.to.value, from: f.from.value, username: f.username.value,
+    smtp_host: f.smtp_host.value || "smtp.gmail.com", smtp_port: f.smtp_port.value || 587, daily: f.daily.checked,
+  };
+  if (f.password.value) body.password = f.password.value; // blank = keep the saved one
+  const res = await postJSON("/api/email", body);
+  if (!res.ok) {
+    emailStatus(res.data.error || "Couldn't save the settings.", "error");
+    return false;
+  }
+  await loadEmail();
+  return true;
+}
+
+$("email-form").addEventListener("submit", async (ev) => {
+  ev.preventDefault();
+  if (await saveEmail()) emailStatus("Saved.", "ok");
+});
+
+$("email-send").addEventListener("click", async () => {
+  const btn = $("email-send");
+  btn.disabled = true;
+  try {
+    if (!(await saveEmail())) return; // send what's on screen, not stale settings
+    emailStatus("Sending…", "");
+    const res = await postJSON("/api/email/send");
+    if (res.ok) emailStatus(`Sent to ${res.data.to.join(", ")}: “${res.data.subject}”`, "ok");
+    else emailStatus(res.data.error || "Couldn't send the report.", "error");
+  } finally {
+    btn.disabled = false;
+  }
+});
+
 /* ------------------------------------------------------------------ wiring */
 
 function setRange(hours) {
@@ -735,5 +818,6 @@ window.addEventListener("resize", () => { clearTimeout(resizeTimer); resizeTimer
 
 setRange(state.hours);
 refreshNow();
+loadEmail();
 setInterval(refreshNow, 3000);
 setInterval(refreshHistory, 30000);
diff --git a/hogwatch/static/index.html b/hogwatch/static/index.html
index 5f3b0d6..4cce94b 100644
--- a/hogwatch/static/index.html
+++ b/hogwatch/static/index.html
@@ -99,6 +99,44 @@ <h3>Programs on this PC: total use</h3>
       </div>
     </section>
 
+    <section class="card" aria-labelledby="email-title">
+      <h2 id="email-title">Daily email report</h2>
+      <p class="card-sub">Every slowdown and dropout, with the reason for each, in your inbox once a day. You can also send one right now.</p>
+      <form id="email-form" class="email-form" autocomplete="off" novalidate>
+        <label>Send reports to
+          <input type="text" name="to" inputmode="email" placeholder="you@example.com (separate several with commas)">
+        </label>
+        <label>Send from (your Gmail address)
+          <input type="email" name="from" placeholder="you@gmail.com">
+        </label>
+        <label>Gmail app password
+          <input type="password" name="password" autocomplete="new-password" placeholder="16 letters from Google">
+        </label>
+        <p class="hint">
+          An app password is a separate password that can only send mail, and you can delete it anytime.
+          To make one: turn on 2-Step Verification in your Google Account, then go to
+          <a href="https://myaccount.google.com/apppasswords" target="_blank" rel="noopener">myaccount.google.com/apppasswords</a>,
+          name it "HogWatch", and paste the 16 letters here. It's stored encrypted, and only your Windows account can read it.
+        </p>
+        <label class="check"><input type="checkbox" name="daily">
+          <span>Email a report every day: when HogWatch starts, or at 8 AM if it's already running</span></label>
+        <details>
+          <summary>Not using Gmail?</summary>
+          <div class="email-advanced">
+            <label>Mail server <input type="text" name="smtp_host" placeholder="smtp.gmail.com"></label>
+            <label>Port <input type="number" name="smtp_port" min="1" max="65535" placeholder="587"></label>
+            <label>Login (if different from "Send from") <input type="text" name="username"></label>
+          </div>
+        </details>
+        <div class="actions">
+          <button type="submit" class="btn primary">Save</button>
+          <button type="button" class="btn" id="email-send">Send report now</button>
+          <a href="/api/email/preview" target="_blank" rel="noopener">Preview report</a>
+        </div>
+        <p id="email-status" role="status" aria-live="polite"></p>
+      </form>
+    </section>
+
     <section class="card help" aria-labelledby="help-title">
       <h2 id="help-title">Why one person can slow down everyone</h2>
       <p>When one device fills the connection (a big download, a 4K stream, or a heavy
diff --git a/hogwatch/static/style.css b/hogwatch/static/style.css
index 504f73c..76def6c 100644
--- a/hogwatch/static/style.css
+++ b/hogwatch/static/style.css
@@ -222,6 +222,25 @@ td .sub { color: var(--muted); font-size: 12px; display: block; overflow-wrap: a
 .tooltip .tt-val { font-weight: 650; font-variant-numeric: tabular-nums; }
 .tooltip .tt-name { color: var(--ink-2); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 
+/* ---- email report form ---- */
+.email-form { display: grid; gap: 12px; max-width: 620px; }
+.email-form label { display: grid; gap: 4px; font-size: 14px; font-weight: 600; }
+.email-form input[type=text], .email-form input[type=email], .email-form input[type=password], .email-form input[type=number] {
+  font: inherit; font-weight: 400; padding: 8px 10px; width: 100%;
+  border: 1px solid var(--axis); border-radius: 8px; background: var(--surface); color: var(--ink);
+}
+.email-form label.check { display: flex; gap: 8px; align-items: flex-start; font-weight: 400; }
+.email-form label.check input { margin-top: 4px; }
+.email-form .hint { font-size: 13px; color: var(--ink-2); }
+.email-advanced { display: grid; gap: 10px; margin-top: 10px; }
+.actions { display: flex; flex-wrap: wrap; gap: 10px; align-items: center; }
+.btn { border: 1px solid var(--border); background: var(--surface-2); padding: 8px 14px; border-radius: 8px; cursor: pointer; font-weight: 600; }
+.btn.primary { background: var(--ink); color: var(--surface); border-color: transparent; }
+.btn:disabled { opacity: .6; cursor: default; }
+#email-status { font-size: 14px; min-height: 1.5em; }
+#email-status.error { color: var(--critical-ink); }
+#email-status.ok { color: var(--good-ink); }
+
 /* ---- setup + help ---- */
 .steps { margin: 8px 0 0; padding-left: 20px; display: grid; gap: 6px; font-size: 14.5px; }
 code, kbd { font-family: ui-monospace, "Cascadia Mono", Consolas, monospace; font-size: 13px; background: var(--surface-2); border: 1px solid var(--border); border-radius: 5px; padding: 1px 5px; }
diff --git a/hogwatch/web.py b/hogwatch/web.py
index 846dc4a..497ccb8 100644
--- a/hogwatch/web.py
+++ b/hogwatch/web.py
@@ -14,6 +14,8 @@
 from pathlib import Path
 from urllib.parse import parse_qs, urlparse
 
+from .report import ReportError, build_report
+
 log = logging.getLogger(__name__)
 
 STATIC = Path(__file__).resolve().parent / "static"
@@ -143,10 +145,27 @@ def incidents(db, days: float, limit: int) -> list[dict]:
     return rows
 
 
-def make_server(port: int, collector_ref: dict, db_ref: dict, on_shutdown) -> ThreadingHTTPServer:
+def make_server(port: int, collector_ref: dict, db_ref: dict, on_shutdown,
+                reporter_ref: dict | None = None) -> ThreadingHTTPServer:
     """Create (bind) the server. Binding first doubles as the 'already running?' check."""
+    reporter_ref = reporter_ref if reporter_ref is not None else {}
+    # Only answer requests addressed to this machine by name. A web page elsewhere can
+    # point its own domain at 127.0.0.1 ("DNS rebinding") and then read this dashboard
+    # as if it were its own site; checking the Host header stops that. It matters more
+    # now that the dashboard holds email settings.
+    allowed_hosts = {f"127.0.0.1:{port}", f"localhost:{port}"}
+    last_manual_send = [0.0]
 
     class Handler(BaseHTTPRequestHandler):
+        def _host_ok(self) -> bool:
+            return (self.headers.get("Host") or "").lower() in allowed_hosts
+
+        def _body(self) -> dict:
+            n = int(self.headers.get("Content-Length") or 0)
+            if n > 16384:
+                raise ValueError("request too large")
+            return json.loads(self.rfile.read(n) or b"{}") if n else {}
+
         def _send(self, code: int, body: bytes, ctype: str) -> None:
             self.send_response(code)
             self.send_header("Content-Type", ctype)
@@ -160,10 +179,21 @@ def _json(self, obj, code: int = 200) -> None:
 
         def do_GET(self):  # noqa: N802 (http.server naming)
             """Static files and read-only API."""
+            if not self._host_ok():
+                return self._send(403, b"forbidden", "text/plain")
             url = urlparse(self.path)
             q = {k: v[0] for k, v in parse_qs(url.query).items()}
-            col, db = collector_ref.get("c"), db_ref.get("db")
+            col, db, rep = collector_ref.get("c"), db_ref.get("db"), reporter_ref.get("r")
             try:
+                if url.path == "/api/email":
+                    # Settings never include the password itself, only whether one is saved.
+                    return self._json({"settings": rep.settings.load(), "status": rep.status()} if rep
+                                      else {"error": "starting"})
+                if url.path == "/api/email/preview":
+                    now = time.time()
+                    body = build_report(db, now - min(float(q.get("hours", 24)), 24 * 7) * 3600, now)["html"]
+                    page = f"<!doctype html><meta charset=utf-8><title>HogWatch report preview</title><body style=\"margin:24px\">{body}"
+                    return self._send(200, page.encode("utf-8"), "text/html; charset=utf-8")
                 if url.path == "/api/now":
                     return self._json(col.snapshot() if col else {"status": "starting"})
                 if url.path == "/api/timeline":
@@ -184,13 +214,33 @@ def do_GET(self):  # noqa: N802 (http.server naming)
             self._send(404, b"not found", "text/plain")
 
         def do_POST(self):  # noqa: N802
-            """Only /api/shutdown. The custom header can't be sent cross-site without a CORS
-            preflight (which we never approve), so a random web page can't stop the monitor."""
-            if urlparse(self.path).path == "/api/shutdown" and self.headers.get("X-HogWatch") == "1":
+            """Shutdown and email actions. Every POST needs the X-HogWatch header: browsers
+            can't send a custom header cross-site without a CORS preflight (which we never
+            approve), so another web page can't change settings or trigger emails."""
+            path = urlparse(self.path).path
+            if not self._host_ok() or self.headers.get("X-HogWatch") != "1":
+                return self._send(403, b"forbidden", "text/plain")
+            if path == "/api/shutdown":
                 self._json({"ok": True})
                 threading.Thread(target=on_shutdown, daemon=True).start()
                 return
-            self._send(403, b"forbidden", "text/plain")
+            rep = reporter_ref.get("r")
+            if rep is None:
+                return self._json({"ok": False, "error": "HogWatch is still starting"}, 503)
+            try:
+                if path == "/api/email":
+                    return self._json({"ok": True, "settings": rep.settings.save(self._body())})
+                if path == "/api/email/send":
+                    if time.time() - last_manual_send[0] < 20:
+                        return self._json({"ok": False, "error": "Please wait a few seconds between sends."}, 429)
+                    last_manual_send[0] = time.time()
+                    result = rep.send(daily=False)
+                    return self._json(result, 200 if result["ok"] else 502)
+            except ReportError as e:
+                return self._json({"ok": False, "error": str(e)}, 400)
+            except ValueError as e:
+                return self._json({"ok": False, "error": f"Bad request: {e}"}, 400)
+            self._send(404, b"not found", "text/plain")
 
         def log_message(self, fmt, *args):
             """Silence per-request logging; the dashboard polls every few seconds."""
diff --git a/tests/test_report.py b/tests/test_report.py
new file mode 100644
index 0000000..bea967b
--- /dev/null
+++ b/tests/test_report.py
@@ -0,0 +1,258 @@
+"""Tests for the daily email report: settings storage, report content, sending, scheduling,
+and the dashboard API's protections around it. No real email is sent (smtplib is mocked).
+
+Run with:  .venv\\Scripts\\python.exe -m unittest discover -s tests
+"""
+
+import datetime as dt
+import http.client
+import json
+import smtplib
+import socket
+import tempfile
+import threading
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from hogwatch.db import DB
+from hogwatch.report import (EmailSettings, Reporter, ReportError, build_report, is_due, parse_recipients,
+                             send_email)
+from hogwatch.web import make_server
+
+PATH = {"node": "Upstairs", "gateway": "Main", "chain": ["Upstairs", "Main"], "radio": "5 GHz", "wired": False}
+LINK = "on the wireless link between the Upstairs and Main eeros, 5 GHz"
+
+
+def seed(db, t0=1_000_000.0):
+    """Four dropouts on the eero link (one during a game), one past the eeros, and one slowdown."""
+    db.set_meta("eero_path", json.dumps(PATH))
+    busy = json.dumps([{"name": "<script>alert(1)</script>", "owner": None, "node": "Upstairs", "on_link": True,
+                        "this_pc": False, "down_mbps": 12.0, "up_mbps": 0.1}])
+    rows = [(t0 + i * 600, t0 + i * 600 + 5, "eero_link", LINK, 5, 5, None, None, 0.4,
+             "League of Legends" if i == 0 else None, busy) for i in range(4)]
+    rows.append((t0 + 3000, t0 + 3002, "internet", "past your eeros (AT&T's line or the wider internet)",
+                 2, 0, 260.0, None, 0.4, None, "[]"))
+    db.executemany("INSERT INTO hiccup(start_ts, end_ts, where_, where_text, rounds, lost, worst_ms, worst_lan_ms, "
+                   "worst_node_ms, game, busy) VALUES(?,?,?,?,?,?,?,?,?,?,?)", rows)
+    db.execute("INSERT INTO incident(start_ts, end_ts, kind, peak_ms, normal_ms, loss_pct, headline, details) "
+               "VALUES(?,?,?,?,?,?,?,?)", (t0 + 100, t0 + 112, "eero_link", 30.0, 15.0, 40.0,
+                                           "The connection dropped out between your eeros.", "{}"))
+    db.execute("INSERT INTO eero_event(ts, unit, kind, detail) VALUES(?,?,?,?)", (int(t0 + 200), "Upstairs", "reconnected", "{}"))
+
+
+class TempDirTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.dir = Path(self.tmp.name)
+        self.db = DB(self.dir / "t.db")
+
+    def tearDown(self):
+        self.db.conn.close()
+        self.tmp.cleanup()
+
+
+class RecipientTests(unittest.TestCase):
+    def test_parses_lists(self):
+        self.assertEqual(parse_recipients("a@b.com, c@d.org;e@f.net"), ["a@b.com", "c@d.org", "e@f.net"])
+        self.assertEqual(parse_recipients("  "), [])
+
+    def test_rejects_junk(self):
+        for bad in ("nope", "a@b", "a@b.com, <x@y.com>", "a b@c.com@d"):
+            with self.assertRaises(ReportError):
+                parse_recipients(bad)
+
+
+class SettingsTests(TempDirTest):
+    def test_password_is_encrypted_and_never_returned(self):
+        s = EmailSettings(self.dir / "email.json")
+        loaded = s.save({"to": "me@example.com", "from": "me@gmail.com", "password": "abcd efgh ijkl mnop"})
+        self.assertTrue(loaded["password_set"])
+        self.assertNotIn("password", loaded)
+        self.assertNotIn("password_dpapi", loaded)
+        self.assertNotIn("abcd", (self.dir / "email.json").read_text())
+        self.assertEqual(s.password(), "abcd efgh ijkl mnop")
+
+    def test_blank_password_keeps_saved_one_and_clear_removes_it(self):
+        s = EmailSettings(self.dir / "email.json")
+        s.save({"password": "first"})
+        s.save({"to": "x@y.com", "password": ""})
+        self.assertEqual(s.password(), "first")
+        s.save({"clear_password": True})
+        self.assertIsNone(s.password())
+
+    def test_bad_values_rejected(self):
+        s = EmailSettings(self.dir / "email.json")
+        with self.assertRaises(ReportError):
+            s.save({"to": "not-an-email"})
+        with self.assertRaises(ReportError):
+            s.save({"smtp_port": "abc"})
+        with self.assertRaises(ReportError):
+            s.save({"from": "me at gmail"})
+
+
+class ReportContentTests(TempDirTest):
+    def test_counts_reasons_and_advice(self):
+        seed(self.db)
+        r = build_report(self.db, 999_000, 1_010_000)
+        self.assertEqual(r["counts"], {"dropouts": 5, "slowdowns": 1, "reconnects": 1})
+        self.assertTrue(r["subject"].startswith("HogWatch: 5 dropouts and 1 slowdown since"))
+        self.assertIn(f"4 {LINK}", r["text"])
+        self.assertIn("1 during a game", r["text"])
+        self.assertIn("Game: League of Legends", r["text"])
+        self.assertIn("The connection dropped out between your eeros.", r["text"])
+        self.assertIn("Ethernet cable between those two eeros", r["text"])  # 4 of 5 on one link -> advice
+        self.assertIn("Upstairs eero reconnected", r["text"])
+
+    def test_device_names_are_escaped_in_html(self):
+        seed(self.db)
+        r = build_report(self.db, 999_000, 1_010_000)
+        self.assertNotIn("<script>", r["html"])
+        self.assertIn("&lt;script&gt;", r["html"])
+
+    def test_wired_link_gets_cable_advice(self):
+        seed(self.db)
+        self.db.set_meta("eero_path", json.dumps(dict(PATH, wired=True, radio=None)))
+        self.assertIn("both ends of the cable", build_report(self.db, 999_000, 1_010_000)["text"])
+
+    def test_all_clear(self):
+        r = build_report(self.db, 0, 100)
+        self.assertTrue(r["subject"].startswith("HogWatch: all clear"))
+        self.assertIn("Everything ran normally", r["text"])
+
+
+class SendTests(unittest.TestCase):
+    SETTINGS = {"to": "me@example.com, you@example.com", "from": "me@gmail.com", "username": "",
+                "smtp_host": "smtp.gmail.com", "smtp_port": 587}
+
+    def test_starttls_login_and_send(self):
+        with mock.patch("hogwatch.report.smtplib.SMTP") as smtp_cls:
+            smtp = smtp_cls.return_value
+            smtp.__enter__.return_value = smtp
+            to = send_email(self.SETTINGS, "abcd efgh ijkl mnop", "Subj", "text", "<p>html</p>")
+        self.assertEqual(to, ["me@example.com", "you@example.com"])
+        smtp_cls.assert_called_once_with("smtp.gmail.com", 587, timeout=30)
+        smtp.starttls.assert_called_once()
+        smtp.login.assert_called_once_with("me@gmail.com", "abcdefghijklmnop")  # spaces from Google's display removed
+        msg = smtp.send_message.call_args[0][0]
+        self.assertEqual(msg["To"], "me@example.com, you@example.com")
+        self.assertEqual(msg["Subject"], "Subj")
+        self.assertTrue(msg.is_multipart())
+
+    def test_port_465_uses_tls_from_the_start(self):
+        with mock.patch("hogwatch.report.smtplib.SMTP_SSL") as ssl_cls, mock.patch("hogwatch.report.smtplib.SMTP") as plain:
+            ssl_cls.return_value.__enter__.return_value = ssl_cls.return_value
+            send_email(dict(self.SETTINGS, smtp_port=465), "pw", "s", "t", "h")
+        ssl_cls.assert_called_once()
+        plain.assert_not_called()
+
+    def test_rejected_login_explains_app_passwords(self):
+        with mock.patch("hogwatch.report.smtplib.SMTP") as smtp_cls:
+            smtp = smtp_cls.return_value
+            smtp.__enter__.return_value = smtp
+            smtp.login.side_effect = smtplib.SMTPAuthenticationError(535, b"bad credentials")
+            with self.assertRaisesRegex(ReportError, "App Password"):
+                send_email(self.SETTINGS, "wrong", "s", "t", "h")
+
+    def test_missing_pieces(self):
+        with self.assertRaisesRegex(ReportError, "app password"):
+            send_email(self.SETTINGS, "", "s", "t", "h")
+        with self.assertRaisesRegex(ReportError, "send reports to"):
+            send_email(dict(self.SETTINGS, to=""), "pw", "s", "t", "h")
+
+
+class ScheduleTests(unittest.TestCase):
+    def test_once_a_day(self):
+        morning, night = dt.datetime(2026, 9, 25, 9, 0), dt.datetime(2026, 9, 25, 2, 0)
+        self.assertTrue(is_due(morning, "2026-09-24", startup=False, send_hour=8))
+        self.assertFalse(is_due(morning, "2026-09-25", startup=True, send_hour=8))   # already sent today
+        self.assertFalse(is_due(night, "2026-09-24", startup=False, send_hour=8))    # running overnight: wait for 8 AM
+        self.assertTrue(is_due(night, "2026-09-24", startup=True, send_hour=8))      # just started: send now
+        self.assertTrue(is_due(night, None, startup=True, send_hour=8))
+
+    def test_daily_send_records_status_and_covers_since_last(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            db = DB(Path(tmp) / "t.db")
+            settings = EmailSettings(Path(tmp) / "email.json")
+            settings.save({"to": "me@example.com", "from": "me@gmail.com", "password": "pw"})
+            rep = Reporter(db, settings, threading.Event())
+            with mock.patch("hogwatch.report.send_email", return_value=["me@example.com"]) as send:
+                result = rep.send(daily=True)
+            self.assertTrue(result["ok"])
+            self.assertEqual(send.call_args[0][1], "pw")
+            st = rep.status()
+            self.assertEqual(st["last_daily"], dt.date.today().isoformat())
+            self.assertIsNone(st["last_error"])
+            with mock.patch("hogwatch.report.send_email", side_effect=ReportError("server down")):
+                self.assertFalse(rep.send(daily=False)["ok"])
+            self.assertEqual(rep.status()["last_error"], "server down")
+            self.assertEqual(rep.status()["last_daily"], dt.date.today().isoformat())  # failure doesn't erase success
+            db.conn.close()
+
+
+class ApiProtectionTests(TempDirTest):
+    """The dashboard now holds email settings, so it must refuse other sites' requests."""
+
+    def setUp(self):
+        super().setUp()
+        with socket.socket() as s:
+            s.bind(("127.0.0.1", 0))
+            self.port = s.getsockname()[1]
+        self.settings = EmailSettings(self.dir / "email.json")
+        self.reporter = Reporter(self.db, self.settings, threading.Event())
+        self.server = make_server(self.port, {}, {"db": self.db}, on_shutdown=lambda: None,
+                                  reporter_ref={"r": self.reporter})
+        threading.Thread(target=self.server.serve_forever, daemon=True).start()
+
+    def tearDown(self):
+        self.server.shutdown()
+        self.server.server_close()
+        super().tearDown()
+
+    def request(self, method, path, host=None, headers=None, body=None):
+        conn = http.client.HTTPConnection("127.0.0.1", self.port, timeout=5)
+        h = {"Host": host or f"127.0.0.1:{self.port}"}
+        h.update(headers or {})
+        conn.request(method, path, body=json.dumps(body) if body is not None else None, headers=h)
+        resp = conn.getresponse()
+        data = resp.read()
+        conn.close()
+        return resp.status, data
+
+    def test_foreign_host_is_refused(self):
+        # DNS rebinding: another site's domain pointed at 127.0.0.1.
+        self.assertEqual(self.request("GET", "/api/email", host=f"evil.example:{self.port}")[0], 403)
+        self.assertEqual(self.request("GET", "/api/email")[0], 200)
+        self.assertEqual(self.request("GET", "/api/email", host=f"localhost:{self.port}")[0], 200)
+
+    def test_post_needs_header(self):
+        body = {"to": "attacker@example.com"}
+        self.assertEqual(self.request("POST", "/api/email", body=body)[0], 403)
+        self.assertEqual(self.settings.load()["to"], "")
+        status, data = self.request("POST", "/api/email", headers={"X-HogWatch": "1", "Content-Type": "application/json"},
+                                    body={"to": "me@example.com", "password": "secret-pw"})
+        self.assertEqual(status, 200)
+        self.assertNotIn(b"secret-pw", data)
+        self.assertEqual(self.settings.load()["to"], "me@example.com")
+
+    def test_settings_response_never_contains_password(self):
+        self.settings.save({"to": "me@example.com", "password": "secret-pw"})
+        status, data = self.request("GET", "/api/email")
+        self.assertEqual(status, 200)
+        self.assertNotIn(b"secret-pw", data)
+        self.assertTrue(json.loads(data)["settings"]["password_set"])
+
+    def test_bad_input_is_a_clear_error(self):
+        status, data = self.request("POST", "/api/email", headers={"X-HogWatch": "1"}, body={"to": "nope"})
+        self.assertEqual(status, 400)
+        self.assertIn("email address", json.loads(data)["error"])
+
+    def test_preview_renders(self):
+        seed(self.db, t0=__import__("time").time() - 3600)
+        status, data = self.request("GET", "/api/email/preview")
+        self.assertEqual(status, 200)
+        self.assertIn(b"HogWatch report", data)
+
+
+if __name__ == "__main__":
+    unittest.main()