Mailgun SMTP Settings and Configuration (2026)
Native SMTP relay with US and EU region choice
Mailgun is an API-first developer transactional email service acquired by Sinch. SMTP relay and REST API v3 are both first-class capabilities. Distinctive feature: choose US or EU data residency at account setup — different endpoints, different physical infrastructure, GDPR-compliant EU region for European teams.
Mailgun’s Send plans start at $15/month for 10,000 emails (Basic tier). SMTP credentials are generated per-domain, not per-account — each sending domain has its own SMTP user and password. The 30-day trial gives you full functionality up to 100 emails/day before requiring a paid plan. SOC 2 Type II certified with AES-256 at-rest encryption for both US and EU regions.
Quick reference
The essential Mailgun SMTP settings, ready to copy-paste into your email client, mail server, or transactional integration. Pick the endpoint matching your account’s region.
| SMTP server (US region) | smtp.mailgun.org DEFAULT |
|---|---|
| SMTP server (EU region) | smtp.eu.mailgun.org |
| SMTP port (STARTTLS) | 587 RECOMMENDED |
| SMTP port (SSL/TLS) | 465 |
| Alternative port | 2525 (fallback if 587/465 blocked) |
| Legacy port | 25 (STARTTLS, blocked on most cloud hosts) |
| Username | postmaster@your-domain.com (default) or custom SMTP user |
| Password | SMTP password from Domain settings (NOT your API key) |
SMTP configuration
Outgoing mail server
— sending email
Setup steps
- Log into your Mailgun dashboard. If you have both US and EU accounts, confirm you are on the correct region (top-right switcher).
- Navigate to Sending › Domains and add your sending domain. Choose US or EU region at domain creation — this is permanent per domain.
- Add the DNS records Mailgun generates: 2 TXT records (SPF and DKIM), 2 MX records for inbound routing, and 1 CNAME for ownership verification. Wait for all to show Verified status.
- Open the verified domain and go to the SMTP credentials section. Copy the default
postmaster@your-domain.comusername and reveal or reset the SMTP password. - In your email client or WP SMTP plugin, enter host
smtp.mailgun.org(orsmtp.eu.mailgun.orgfor EU), port 587, encryptionSTARTTLS, usernamepostmaster@your-domain.com, password from step 4. - Send a test email. If in sandbox mode (no credit card yet), the recipient must be pre-authorized in Sending › Overview › Authorized Recipients. Add a credit card to exit sandbox and send to any address.
Authentication
Mailgun uses domain-scoped SMTP credentials — a fundamentally different model from account-wide credentials at SendGrid or Postmark. Each verified domain generates its own default SMTP user (postmaster@your-domain.com) with a unique password. You can create additional custom SMTP users per domain for role-based access.
The SMTP password is NOT the API key. Mailgun maintains two separate credential systems:
- API keys: account-wide or restricted-scope keys for REST API v3, webhooks, and dashboard automation. Generated at API Security › API keys. Format is a hex string, no prefix.
- SMTP credentials: per-domain username + password for the SMTP relay. Generated at Sending › Domains › [your domain] › SMTP credentials. Password can be reset without breaking API key access.
This separation is a feature for security segmentation but a common source of authentication confusion for first-time setup.
SPF and DKIM setup
Domain verification is required before Mailgun releases sends to real recipients. Mailgun’s verification wizard is under Sending › Domains › [your domain] › DNS records. Expect DNS propagation of 1 to 24 hours. Full record set generated per domain:
SPF record (TXT)
v=spf1 include:mailgun.org ~all
For EU-region domains, the include is the same (mailgun.org) — the underlying SPF policy covers both US and EU sending infrastructure. If you already have an SPF record, add include:mailgun.org before the last operator. Never publish two separate v=spf1 records on the same domain.
DKIM record (TXT)
Mailgun generates a 2048-bit DKIM public key as a TXT record at k1._domainkey.your-domain.com. The selector name k1 is Mailgun’s default. Choose 2048-bit at domain creation (recommended for modern deliverability) — the 1024-bit legacy option is available but Gmail and Yahoo increasingly flag 1024-bit keys as insufficient for high-volume senders.
MX and ownership records
Two MX records point inbound mail to Mailgun’s servers (only needed if you use inbound routing / receive replies). One CNAME record at email.your-domain.com validates ownership and enables custom tracking URLs. Neither is strictly required for outbound-only SMTP but Mailgun’s verifier flags them as “unverified” until added.
DMARC alignment
Because DKIM signs with your own domain (k1._domainkey.your-domain.com) and SPF includes Mailgun’s authorized senders in your own SPF record, DMARC alignment works out of the box for both relaxed and strict modes. Publishing at least v=DMARC1; p=none; rua=mailto:reports@your-domain.com is now a de facto requirement for inbox placement at Gmail and Yahoo for senders above 5,000/day.
Rate limits & sending caps
| Limit type | Value | Notes |
|---|---|---|
| Trial period (new account) | 100/day, 30 days | Only to authorized recipients. Add credit card to remove sandbox restrictions. |
| Basic plan volume | 10,000/month | $15/month. No daily cap. 1 custom sending domain, 2 API keys, webhooks included. |
| Foundation plan volume | 50,000/month | ~$35/month. Higher deliverability tooling access. |
| Growth plan volume | 100,000+/month | ~$90/month base. Scales into higher tiers for millions of emails. |
| Per-connection message cap | Not disclosed | Mailgun does not advertise a fixed per-SMTP-connection limit. Reconnect if you see 421 throttling errors. |
| Message size (with attachments) | 25 MB | Per-message hard cap for both SMTP and API sends. |
Pricing evolves — verify at mailgun.com/pricing. As of early 2026: Basic tier at $15/month for 10K emails, Foundation around $35/month for 50K, Growth around $90/month for 100K+. Dedicated IP available as add-on starting around $59/month. Optimize plans (deliverability tools like inbox placement testing) are separate from Send plans and start at $49/month.
Common setup gotchas
Wrong region endpoint (US vs EU) causes silent auth failures
US and EU regions are separate infrastructure with separate accounts. If you signed up in EU but point your app at smtp.mailgun.org, or vice versa, you get 535 Authentication failed with no obvious clue why. Check the top-right region switcher in your Mailgun dashboard, and use smtp.eu.mailgun.org for EU accounts.
Using the API key as SMTP password
Mailgun’s API key and SMTP password are separate credentials. Pasting the API key (hex string, no prefix) into the SMTP password field fails with 535 Authentication failed. Go to Sending › Domains › [your domain] › SMTP credentials to reveal or reset the actual SMTP password.
Sandbox mode blocks sends to unverified recipients
New Mailgun accounts start in sandbox mode: SMTP works, but sends are only delivered to email addresses you pre-authorize in the dashboard. Test emails to arbitrary recipients silently disappear. Add a valid credit card at Account › Billing to exit sandbox mode — you are not charged until you exceed your plan’s included volume.
Port 25 blocked on major cloud hosts
Never use port 25 for SMTP submission. Heroku, DigitalOcean, AWS EC2 (outbound port 25 restricted by default), and Google Cloud all block it. Use 587 (STARTTLS, recommended), 465 (SSL/TLS), or 2525 as fallback.
Suppression list persistence across attempts
Bounces, spam complaints, and unsubscribes are stored per-domain in Mailgun’s suppression list. If an address bounces once, subsequent sends to that address are silently dropped (never delivered) until you manually remove it from Sending › Suppressions. Useful for compliance, surprising if you did not know it existed.
Domain-scoped credentials mean each domain is a separate setup
Unlike SendGrid or Postmark where one API key covers all domains, Mailgun requires you to generate SMTP credentials per verified domain. Managing 5 sending domains means 5 sets of SMTP passwords. Store them in your secret manager with clear naming conventions.
Migrating SMTP setups
To Mailgun (from another provider)
Choose your region (US or EU) before adding domains — this cannot be changed later per domain. Update your app’s SMTP config to smtp.mailgun.org:587 (or smtp.eu.mailgun.org:587), change username to postmaster@your-domain.com, and paste the SMTP password from the domain’s credentials page. Complete the DNS record set (SPF, DKIM, MX, ownership) and wait for Verified status. Plan for 4 to 24 hours of parallel operation with your old provider active during DNS propagation.
From Mailgun (to a different provider)
Postmark is the common migration target for teams wanting simpler pricing and lower latency for transactional-only workloads. SendGrid if you want a broader ecosystem with Marketing Campaigns co-located. Amazon SES if you need cheapest cost at scale (100k+ per month). For EU data residency specifically, Brevo (French company, EU-hosted by default) is a natural alternative if you were on Mailgun EU. Plan for 2 to 3 hours to reconfigure DNS, update app credentials, and verify.
Frequently asked questions
What is Mailgun’s SMTP server address and port?
Mailgun’s US-region SMTP host is smtp.mailgun.org. For EU-region accounts, use smtp.eu.mailgun.org. Recommended port is 587 with STARTTLS. Alternatives: 465 (implicit TLS / SSL), 2525 (STARTTLS fallback), and 25 (STARTTLS, but blocked on most cloud hosts). Use port 587 unless a firewall specifically requires another.
What is the difference between smtp.mailgun.org and smtp.eu.mailgun.org?
These are separate physical infrastructure in different data residency regions. smtp.mailgun.org serves Mailgun’s US region (accounts hosted in the US). smtp.eu.mailgun.org serves the EU region for GDPR-compliant European data residency. Accounts are region-locked at signup — you cannot migrate a US account to EU or vice versa. Check the top-right region switcher in your Mailgun dashboard to confirm your region, and use the matching endpoint. Using the wrong endpoint fails with 535 Authentication failed.
Why is my Mailgun SMTP username postmaster@ and not my email address?
Mailgun uses per-domain SMTP credentials, not account-wide credentials. When you verify a sending domain, Mailgun automatically creates a default SMTP user in the format postmaster@your-domain.com. You can create additional custom SMTP users per domain (with any username you like) at Sending › Domains › [your domain] › SMTP credentials. The default postmaster@ user is universal and works for most setups.
Can I use my Mailgun API key as the SMTP password?
No. Mailgun maintains two separate credential systems: API keys (for REST API v3) and SMTP passwords (for the SMTP relay). Pasting your API key into the SMTP password field returns 535 Authentication failed. Go to Sending › Domains › [your domain] › SMTP credentials to reveal or reset the actual SMTP password. This separation is intentional — you can rotate the SMTP password without breaking API access, and vice versa.
Why am I getting sandbox mode errors from Mailgun?
New Mailgun accounts start in sandbox mode: your SMTP config works, but sends are only delivered to email addresses you have pre-authorized in Sending › Overview › Authorized Recipients. Sends to any other address are silently dropped. To exit sandbox mode, add a valid credit card at Account › Billing — you are not charged until you exceed your plan’s included monthly volume (10,000 on Basic, 50,000 on Foundation, etc.).
How much does Mailgun cost for SMTP?
Send plans start at $15/month for the Basic tier covering 10,000 emails/month with no daily cap. Foundation tier around $35/month covers 50,000/month. Growth tier around $90/month covers 100,000+/month, scaling into higher volumes. Dedicated IP add-on around $59/month is recommended above 100k/month for reputation control. All Send plans include SMTP relay and REST API v3 — pricing is by volume, not by feature.
Does Mailgun support IMAP or POP3?
No. Mailgun is a send-only transactional email relay. It has no inbox — IMAP and POP3 are protocols for retrieving mail from a mailbox, and Mailgun does not host mailboxes. Mailgun does support inbound routing (receive emails at a domain, parse them, forward to your webhook or app) as a distinct feature, but this is a receive-and-process pattern, not a mailbox you read with a mail client. See our email settings cluster for IMAP/POP3 configuration by mailbox provider.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
