Mailgun SMTP Will Reject TLS 1.0 and 1.1 From 1 March 2027

Mailgun will stop accepting SMTP connections that use TLS 1.0 or TLS 1.1 on 1 March 2027. From that date, Mailgun SMTP will only accept connections over TLS 1.2 or higher, and in the words of its announcement, messages sent over the older protocols "won't be sent".

The change only concerns SMTP. Mailgun says senders that use only its HTTP API do not need to change anything. The risk sits with older applications, servers and plugins that still negotiate an outdated TLS version without anyone noticing.

What Mailgun is changing

Mailgun's SMTP servers listen on ports 25, 465, 587 and 2525, according to its documentation. Port 465 requires a TLS connection from the start, while the other ports accept a plain connection that can be upgraded with STARTTLS. Until now, the documentation did not state a minimum TLS version. From 1 March 2027, any SMTP session that tries to use TLS 1.0 or 1.1 will be refused, and the message will not be delivered.

The announcement uses the US endpoint, smtp.mailgun.org, in its examples. It does not say separately how the change applies to the EU endpoint or to the Australian region that went live on 10 November 2026. Senders on those regions should assume the same rule and test their own endpoint.

Who is most exposed

Most modern stacks already use TLS 1.2 or 1.3 by default. The systems at risk are the ones nobody has touched for years. Mailgun points to older Windows Server releases such as 2008 and 2012, where TLS 1.2 is not enabled by default, .NET Framework 4.5 and earlier, outdated OpenSSL builds, and legacy applications or plugins pinned to an old protocol version. It also tells senders to check staging environments and background workers, Postfix or other relays, CMS and e-commerce plugins, and vendor systems that send through Mailgun, such as CRM, ERP, scanners and monitoring tools.

Action checklist

• List every system that sends through Mailgun SMTP, including scripts, relays, plugins, devices and vendor tools using your credentials.
• Test each one with the command Mailgun provides: openssl s_client -connect smtp.mailgun.org:587 -starttls smtp -tls1_2. A working connection shows the certificate chain and TLS 1.2 or higher.
• Update the runtime where needed: move .NET Framework 4.5 applications to 4.6 or later, update OpenSSL, and enable TLS 1.2 on older Windows servers.
• Set a minimum version in your client or relay, for example the minimum TLS version option in Nodemailer or the protocol settings in Postfix, so a fallback to an older version cannot happen silently.
• Watch your Mailgun dashboard and admin inbox for the warning Mailgun sends when it detects old TLS on an account.
• Consider the API for systems that are hard to update, since API sending is not affected by this change.

Part of a wider move

TLS 1.0 and 1.1 have been formally deprecated by the IETF since 2021, and browsers and most cloud providers dropped them years ago. Email has been slower, because SMTP clients are often embedded in software that is rarely updated. Mailgun's cut-off is a reminder to check every sending path, not only the main application. Our guide to SSL and TLS for email covers certificates, STARTTLS, MTA-STS and TLS reporting, and our reference on email ports and protocols explains the difference between ports 465 and 587. If you are comparing providers, see our Mailgun review.

Sources

1. Mailgun: Mailgun SMTP is moving to TLS 1.2, 9 November 2026 (primary source)
2. Mailgun documentation: Send via SMTP
3. Mailgun: new AU region goes live on 10 November 2026
4. IETF RFC 8996: Deprecating TLS 1.0 and TLS 1.1

Related on SMTPedia

• SSL/TLS for email: setup, certificates, MTA-STS, DANE and TLS-RPT
• Email ports and protocols in 2026: SMTP, IMAP and POP3
• 550 Must Issue STARTTLS: causes and fix