MailerSend SMTP Settings and Configuration (2026)
Native SMTP relay on smtp.mailersend.net
MailerSend ships a first-party SMTP relay at smtp.mailersend.net on port 587 (STARTTLS) with per-user auto-generated credentials. TLS 1.2 or 1.3 is mandatory since June 3, 2024.
MailerSend spun off from MailerLite in 2019 as a developer-first transactional ESP, and the SMTP relay is treated as a peer to the REST API rather than a legacy fallback. Use it when you need drop-in compatibility with existing mailers (WordPress wp_mail, PHPMailer, Nodemailer, Postfix, ActionMailer) without rewriting to the JSON API. If you want a code-only workflow or MCP-native agent tooling, prefer the API tab. If you are comparing before you commit, the closest peers are Postmark (higher price, best-in-class inbox rates), Brevo (bundled marketing + transactional), and SendGrid (deepest enterprise tooling). For a like-for-like developer-first alternative see Resend.
Quick reference
| SMTP server | smtp.mailersend.net |
| Port (STARTTLS) | 587 RECOMMENDED |
| Port (SSL/TLS implicit) | Not officially documented |
| Alternative port | 2525 (best-effort, when ISP blocks 587) |
| Username | Auto-generated per SMTP user (not your account email) |
| Password | Auto-generated, shown once at SMTP user creation (case-sensitive) |
SMTP configuration
MailerSend SMTP relay
Drop-in transactional relay for apps, CMSes and legacy mail libraries. Uses SMTP AUTH LOGIN over STARTTLS on port 587. Credentials are decoupled from your login and can be rotated per environment.
Setup steps
- Sign up at app.mailersend.com, verify your email and add your sending domain under Domains › Add domain.
- Publish the two 2048-bit DKIM CNAME records, the SPF record and the Return-Path CNAME (default host
mta.) that the dashboard generates, then click Verify DNS. - Open Domains › {your domain} › SMTP users, click Generate new user and copy the username plus password immediately. MailerSend only displays the password once.
- Configure your app with host smtp.mailersend.net, port 587, encryption STARTTLS, and the credentials from step 3.
- Send a test message from a verified
Fromaddress, then check Activity for the delivery event and thex-message-id.
Authentication
MailerSend enforces DKIM + SPF verification at the domain level before any production send. Trial accounts can only send to addresses on the same verified domain until the account passes manual review.
SPF and DKIM setup
MailerSend generates a per-account SPF include and two 2048-bit DKIM CNAMEs during domain setup. Paste the exact values from the dashboard, the SPF include is merged with any existing record so you keep a single v=spf1 line.
; SPF (TXT on the root domain), exact value copied from the MailerSend ; domain screen. It typically includes _spf.mailersend.net. example.com. IN TXT "v=spf1 include:_spf.mailersend.net ~all" ; DKIM (two CNAMEs, 2048-bit), host and target generated per domain ; Example shape (replace selectors and target with the values MailerSend shows): mlsend1._domainkey.example.com. IN CNAME mlsend1.dkim.mailersend.net. mlsend2._domainkey.example.com. IN CNAME mlsend2.dkim.mailersend.net. ; Return-Path CNAME for bounce handling (default host: mta) mta.example.com. IN CNAME mailersend.net.
DMARC alignment
DMARC is not created automatically. MailerSend recommends publishing your own _dmarc TXT record and offers a built-in DMARC monitoring tool (GA since December 9, 2025) that ingests aggregate reports and visualizes authentication results per source. Start in p=none, use MailerSend's report parser to catch any legitimate senders you forgot to authenticate, then move to p=quarantine and eventually p=reject. Because MailerSend uses per-account SPF and per-domain DKIM, both alignment checks pass by default once the DNS is published.
Rate limits & sending caps
| Limit | Value | Notes |
|---|---|---|
| Emails per day (Free) | 100/day, 500/month | Trial cap is also 100/day until account approval. |
| Recipients per API call | 50 to, 10 cc, 10 bcc | Enterprise gets 50/50 cc/bcc. Trial accounts limited to 1 cc and 1 bcc. |
| API rate (transactional) | 120 rpm on POST /v1/email | General endpoints capped at 60 rpm. Accounts under review throttled to 10 rpm. |
| Bulk email rate | 10-60 rpm plan-dependent | Free/Hobby 10, Starter 15, Professional 30, Enterprise 60. |
| Message size | 25 MB per attachment | HTML body 2 MB, text body 2 MB, subject 998 chars max. |
MailerSend publishes per-minute API caps and per-day plan quotas but does not document a per-hour email cap or a concurrent-SMTP-connection ceiling. Assume the API rate limit is the effective throughput ceiling for SMTP as well, since the relay ultimately funnels into the same send pipeline.
Common setup gotchas
Trial sandbox blocks unverified recipients
Fresh accounts stay in a sandbox capped at 100/day and can only send to addresses on your verified domain until MailerSend approves the account. Plan for a 24-72h manual approval window and expect to be asked for a sending-use description with URLs to opt-in forms and unsubscribe flows.
Two DKIM CNAMEs, not one
Since MailerSend switched to 2048-bit keys you must publish two DKIM CNAME records plus SPF and the Return-Path CNAME. Adding only the first record leaves the domain in unverified state and API sends will fail with 422 domain not verified. Compare with Postmark, which uses a single DKIM TXT record.
429 storms on new IPs during warm-up
Accounts flagged under review are throttled to 10 rpm on POST /v1/email and 1 rpm on POST /v1/bulk-email. Handle Retry-After headers, back off exponentially, and prefer the bulk endpoint until reputation is healthy. This is stricter than the equivalent warm-up behaviour on SendGrid or Brevo.
SMTP credentials are separate from API tokens
The SMTP username/password shown once at SMTP user creation is not the Bearer API token and cannot be regenerated from the token list. Store it in your secrets manager immediately. MailerSend only displays it once. If you lose it, delete the SMTP user and create a new one.
Migrating SMTP setups
To MailerSend
Coming from Mailgun, SendGrid or Postmark? The move is largely a DNS + credentials swap. Verify your domain in MailerSend and publish the two 2048-bit DKIM CNAMEs, the SPF include and the Return-Path CNAME before flipping traffic. MailerSend refuses to relay for unverified domains. Then update your mailer host to smtp.mailersend.net:587 and drop in the auto-generated SMTP user. Because credentials are account-wide, you can cut over multiple sending domains with one credential pair. Budget 24-72h for the account-approval sandbox on brand-new tenants. If your legacy TLS stack still speaks TLS 1.0/1.1 you must upgrade first: MailerSend has rejected those versions since June 3, 2024.
From MailerSend
If MailerSend is not the right fit, typically because you need dedicated IPs cheaper, richer marketing tooling or a stricter deliverability SLA, the migration is symmetric. Set up SPF/DKIM at the new provider (Postmark, Amazon SES, SparkPost or Resend) alongside the MailerSend records, warm up traffic gradually, then flip the SMTP host in your app. Keep MailerSend live for at least 7 days after cutover so you can compare bounce/complaint deltas and read the DMARC aggregate reports from MailerSend's built-in monitoring tool before deleting the domain.
Frequently asked questions
What is the SMTP hostname and port for MailerSend?
The hostname is smtp.mailersend.net and the recommended port is 587 with STARTTLS. Port 2525 is accepted as a fallback when ISPs block 587. There is no officially documented implicit-TLS endpoint on port 465.
Which TLS versions does MailerSend's SMTP relay accept in 2026?
Only TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 have been disabled on smtp.mailersend.net since June 3, 2024. Legacy libraries such as old PHPMailer builds or .NET Framework 4.5 without SchUseStrongCrypto will fail with connection-reset errors until you upgrade the TLS stack.
Where do I find my MailerSend SMTP username and password?
They are generated in the app under Domains, then your domain, then SMTP users. Click Generate new user and copy both values immediately. MailerSend only displays the password once and it is not the same as your API token. Store it in a secrets manager or rotate it by deleting and recreating the SMTP user.
Can one MailerSend SMTP user send from multiple verified domains?
Yes. SMTP credentials are account-wide and are not bound to a specific verified domain. You can reuse a single SMTP user across every domain you have verified, as long as the From header of each message points to a domain that has passed DKIM and SPF verification.
How do I fix authentication failed errors on smtp.mailersend.net?
The three common causes are: using your account login instead of the generated SMTP user, pasting the API token in the password field, or negotiating an old TLS version. Regenerate the SMTP user, confirm your client is set to STARTTLS on port 587, and ensure TLS 1.2 or higher is enabled. If sends still fail with 422 domain not verified, republish both DKIM CNAMEs and the SPF record.
Does MailerSend support implicit TLS on port 465?
Not officially. MailerSend documents STARTTLS on port 587 and lists 2525 as a fallback in its own SMTP-ports blog post, but does not publish an implicit-TLS 465 endpoint. Assume 465 is unsupported and configure your mailer for STARTTLS on 587 instead.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
