Postmark SMTP Settings and Configuration (2026)
Native SMTP relay optimized for transactional deliverability
Postmark is a transactional email specialist acquired by ActiveCampaign in 2022. Consistently ranked at the top for inbox placement speed and reliability — the reason SaaS, fintech, and healthcare teams pick it when password resets, order confirmations, and 2FA codes have direct revenue impact. Distinctive architecture: Message Streams enforce hard separation between transactional and broadcast traffic on separate SMTP hosts.
Postmark uses simple pricing: $15/month for the Basic plan (10,000 emails), scaling to lower per-unit rates at higher tiers. The Free Developer plan (100 emails/month, no overages) is testing-only — not a production path. All plans include 45 days of full message content and event history, dedicated onboarding help, and top-tier support. Premium pricing versus SendGrid or Mailgun, but you pay for guaranteed inbox placement on time-critical email.
Quick reference
The essential Postmark SMTP settings. Postmark uses two distinct SMTP hosts — one for transactional traffic and one for broadcast (marketing) traffic. Pick the host matching your message type.
| SMTP server (transactional) | smtp.postmarkapp.com DEFAULT |
|---|---|
| SMTP server (broadcasts) | smtp-broadcasts.postmarkapp.com |
| SMTP port (STARTTLS) | 587 RECOMMENDED |
| SMTP port (SSL/TLS) | 465 |
| Alternative port | 2525 (fallback if 587/465 blocked) |
| Auth option 1 | Server API Token as BOTH username AND password |
| Auth option 2 | SMTP Token: Access Key = username, Secret Key = password (per-stream) |
| Stream selector (with API Token) | Header X-PM-MESSAGE-STREAM: {stream_id} |
SMTP configuration
Outgoing mail server
— sending transactional email
Setup steps
- Sign up at postmarkapp.com. The Free Developer plan (100 emails/month) is enough for setup and testing.
- Create a Server from your dashboard. Servers isolate credentials and reputation per project or environment (e.g. Production, Staging).
- Verify your sending domain: Sender Signatures › Add Domain. Add the DKIM TXT record and Return-Path CNAME that Postmark generates to your DNS. Verification takes 15 minutes to 4 hours.
- Copy your Server API Token from Server › API Tokens. This single token acts as both SMTP username and SMTP password.
- In your email client or WP SMTP plugin, enter host
smtp.postmarkapp.com, port 587, encryptionSTARTTLS, username = your Server API Token, password = the same Server API Token. - Send a test email using a
From:address on your verified domain. Check the Activity feed in your Postmark dashboard for delivery confirmation, bounce, or spam classification — full event data available for 45 days on every plan.
Message Streams — Postmark’s distinctive architecture
Postmark enforces a hard separation between Transactional and Broadcast traffic through Message Streams. Each Server has at least one Transactional stream (default) and can add Broadcast streams for marketing sends. This separation exists for one reason: transactional deliverability. Broadcast sends have higher complaint rates, which would drag down transactional inbox placement if they shared IP reputation.
- Transactional stream: default, uses
smtp.postmarkapp.com, optimized for one-to-one messages (password resets, receipts, notifications). - Broadcast stream: requires
smtp-broadcasts.postmarkapp.comhost. Optimized for one-to-many marketing sends. Uses different sending IPs to isolate reputation. - Custom streams: plan-limited (Basic: 1 broadcast, higher tiers: multiple). Useful for isolating traffic by product line or client for agencies.
To route through a specific stream via SMTP, you have two options:
- Add a header:
X-PM-MESSAGE-STREAM: broadcast(or your custom stream ID) in your outgoing message. Works with the Server API Token auth method. - Use a per-stream SMTP Token: generate an SMTP Token from the stream’s Settings page. The token is stream-scoped — no header needed. Required if your SMTP client cannot inject custom headers (some WordPress plugins).
Authentication
Postmark offers two SMTP authentication methods. Choose based on your client’s capabilities and your stream-routing needs.
Option 1: Server API Token (default, simplest)
The Server API Token is a single credential that acts as both SMTP username and SMTP password. Found at Server › API Tokens. Uses the default Transactional stream unless you inject the X-PM-MESSAGE-STREAM header. Same token works for the REST API and SMTP relay.
Option 2: SMTP Token (per-stream credentials)
Generate an SMTP Token from a specific stream’s Settings page. Returns an Access Key (SMTP username) and a Secret Key (SMTP password). Stream-scoped: the token only routes through its own stream, no header needed. Required for broadcast sends via SMTP clients that cannot set custom headers.
Critical: the Secret Key is displayed only once at generation. Copy immediately into your secret manager. If lost, generate a new SMTP Token — recovery is not possible.
SPF and DKIM setup
Domain verification is required before Postmark releases sends to real recipients. Postmark’s verification wizard is under Sender Signatures › Add Domain. Expect DNS propagation of 15 minutes to 4 hours.
DKIM record (TXT)
Postmark generates a DKIM public key with a timestamped selector (e.g. [timestamp]pm._domainkey.your-domain.com). Keys are 1024-bit by default with quarterly manual rotation recommended. Note: 1024-bit is weaker than the 2048-bit standard now expected by Gmail and Yahoo for high-volume senders — if you send above 5,000/day, request 2048-bit key generation via Postmark support.
Custom Return-Path (CNAME)
To enable SPF alignment for DMARC (relaxed mode), configure a custom Return-Path subdomain: add a CNAME record at pm-bounces.your-domain.com pointing to pm.mtasv.net. Without this CNAME, Postmark uses its own return-path domain (*.pm.mtasv.net), which fails SPF alignment.
SPF record
v=spf1 include:spf.mtasv.net ~all
If you already have an SPF record, merge include:spf.mtasv.net before the last operator. Never publish two separate v=spf1 records.
DMARC alignment
With DKIM signed by your domain and Return-Path CNAME configured, relaxed DMARC alignment works out of the box. Strict DMARC alignment is not achievable through the standard Postmark setup — if you require strict alignment for compliance, contact Postmark support for advanced configuration. Publish at least v=DMARC1; p=none; rua=mailto:reports@your-domain.com on your sending domain; sustained non-alignment triggers hard failures at Gmail and Yahoo for senders above 5,000/day.
Rate limits & sending caps
| Limit type | Value | Notes |
|---|---|---|
| Free Developer plan | 100/month | Hard cap, no overages. Testing only — not a production path. |
| Basic plan volume | 10,000/month | $15/month. Roughly $1.50 per thousand at this tier. |
| Volume tiers scale down per-unit cost | ~$0.81/1,000 at 300K | Per-unit price drops as monthly volume grows. |
| Recipients per message | 50 | Hard cap per single message. |
| Messages per API batch | 500 | Batch send limit for the REST API. SMTP has no explicit batch equivalent. |
| Message data retention | 45 days | Full message content + event history on every plan, free by default. |
Dedicated IP: $50/month, recommended from 300,000 emails/month. Automatic warmup over 3-6 weeks. Postmark’s shared IP pools are excellent-reputation by design, so dedicated IP is rarely needed below 300K/month — unlike SendGrid or Mailgun where dedicated IP becomes valuable at 50-100K/month.
Common setup gotchas
Server API Token goes in BOTH username AND password fields
Postmark’s simplest auth pattern is unusual: your Server API Token acts as both the SMTP username and SMTP password. Some SMTP clients reject this (they expect distinct values). If your client fails with 535 Authentication failed using the same token in both fields, switch to Option 2 (SMTP Token) which returns a distinct Access Key and Secret Key.
Broadcast sends need a different SMTP host
Broadcast (marketing) sends route through smtp-broadcasts.postmarkapp.com, not the default smtp.postmarkapp.com. If you send broadcast content through the transactional host, delivery may fail or the message may hit spam. Use the broadcast host with a broadcast-stream SMTP Token, or add the X-PM-MESSAGE-STREAM: broadcast header via the transactional host with your Server API Token.
DKIM keys are 1024-bit by default — weak for high-volume senders
Postmark generates 1024-bit DKIM keys as the default. Gmail and Yahoo now expect 2048-bit for senders above 5,000/day. Below that volume, 1024-bit is still accepted but flagged in some deliverability reports. Request 2048-bit key generation via Postmark support if you send at scale. Quarterly manual key rotation is also recommended — unlike SendGrid or SES which rotate automatically.
Free Developer plan has a hard 100-email monthly cap
Unlike Mailgun’s daily-reset trial or SendGrid’s 100/day permanent free, Postmark’s Free Developer plan is 100 emails per month total with no overages permitted. Once 100 are sent, sending stops until the next billing cycle. This is intentional — Postmark positions the free tier as evaluation only, not a production sending path. WordPress sites with meaningful traffic hit the cap within 1-2 days.
Sender Signature vs Domain verification
Postmark supports two verification patterns: Sender Signature (verify a single From: address) or Domain (verify the whole domain via DKIM + Return-Path). Signature is faster for testing but does not enable DMARC alignment — only Domain verification does. Always use Domain verification in production.
Port 25 is blocked on cloud hosts
Never use port 25 for SMTP submission. Heroku, DigitalOcean, AWS EC2 (outbound port 25 restricted by default), and Google Cloud all block it. Use 587 (STARTTLS, recommended), 465 (SSL/TLS), or 2525 as fallback.
Migrating SMTP setups
To Postmark (from another provider)
Update your app’s SMTP config to smtp.postmarkapp.com:587 and use your Server API Token as both username and password. Verify your sending domain via Sender Signatures › Add Domain, add the DKIM TXT and Return-Path CNAME to your DNS. Plan for 15 minutes to 4 hours of DNS propagation. For marketing sends, create a Broadcast stream and either add the X-PM-MESSAGE-STREAM header or generate a stream-specific SMTP Token. Keep your old provider active during the parallel period.
From Postmark (to a different provider)
Common triggers for leaving Postmark: cost at scale (Postmark premium pricing beats you above 100K/month), or you need marketing broadcasts co-located with transactional under one product. SendGrid for broader ecosystem with Marketing Campaigns. Mailgun for API-first teams wanting managed deliverability tools with EU data residency option. Amazon SES for aggressive cost optimization above 50K/month if your team has AWS operational maturity. Plan for 2 to 3 hours to reconfigure DNS, update app credentials, and verify.
Frequently asked questions
What is Postmark’s SMTP server address?
Postmark uses two distinct SMTP hosts based on message type. Transactional: smtp.postmarkapp.com (default, for password resets, receipts, notifications). Broadcast: smtp-broadcasts.postmarkapp.com (for marketing sends). Recommended port is 587 with STARTTLS. Alternatives: 465 (SSL/TLS) and 2525 (STARTTLS fallback). Global infrastructure — no region selection needed.
How do I authenticate to Postmark SMTP?
Two options. Option 1 (simplest): use your Server API Token as both the SMTP username AND the SMTP password — the same value in both fields. Found at Server › API Tokens. Routes through the default Transactional stream. Option 2 (per-stream): generate an SMTP Token from a stream’s Settings page — returns an Access Key (username) and Secret Key (password), stream-scoped. Use Option 2 if your SMTP client cannot inject the X-PM-MESSAGE-STREAM custom header.
What are Postmark Message Streams and do I need to configure them?
Message Streams are Postmark’s mechanism to separate transactional and broadcast (marketing) traffic on distinct SMTP infrastructure and IP pools. This isolation protects transactional deliverability from marketing complaint rates. Every Server has a default Transactional stream — if you only send transactional email, no configuration needed. If you also send broadcasts, create a Broadcast stream, then either add the header X-PM-MESSAGE-STREAM: broadcast to your outgoing messages or use a stream-specific SMTP Token routed through smtp-broadcasts.postmarkapp.com.
What is the difference between Postmark’s Server API Token and SMTP Token?
The Server API Token is a Server-level credential that works for both the REST API and SMTP relay (used as both username and password in SMTP). It routes through the default Transactional stream unless you inject a stream header. The SMTP Token is a stream-scoped credential specific to the SMTP interface: it returns a distinct Access Key (username) and Secret Key (password), and always routes through its assigned stream. Use SMTP Token when your client cannot set custom headers or when you want to segment credentials per stream for security.
How much does Postmark cost?
Free Developer plan: 100 emails/month, hard cap, no overages — testing only. Basic plan: $15/month for 10,000 emails (~$1.50 per thousand). Volume tiers scale down per-unit cost significantly — roughly $0.81 per thousand at 300K/month. Higher pricing than SendGrid or Mailgun in raw dollars, but you pay for guaranteed transactional deliverability. Every plan includes 45 days of full message content and event history, dedicated onboarding, and top-tier support. Dedicated IP available at $50/month from 300K/month volume.
Why should I use Postmark over SendGrid, Mailgun, or Amazon SES?
Postmark wins on transactional deliverability reliability. Password resets, order confirmations, 2FA codes arrive in inbox at higher rates and lower median latency than any other major provider. Ideal for SaaS, fintech, healthcare, and ecommerce where missed transactional email directly impacts revenue or user experience. You pay premium pricing (~2x SendGrid/Mailgun per-email) for the peace of mind that time-critical email lands on time. Do NOT pick Postmark if you send high-volume marketing broadcasts as your primary use case — SendGrid or Mailgun serve that use case with lower total cost.
Does Postmark support IMAP or POP3?
No. Postmark is a send-only transactional email relay. It has no inbox — IMAP and POP3 are protocols for retrieving mail from a mailbox, and Postmark does not host mailboxes. Postmark does support inbound email processing as a distinct feature (receive emails at a Postmark inbound address, parse them, POST to your webhook), but this is a receive-and-process pattern for building email-triggered workflows, not a mailbox you read with a mail client.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
