SendGrid SMTP Settings and Configuration (2026)
Native SMTP relay included on every plan, including Free
SendGrid is Twilio’s transactional email flagship — over 190 billion emails processed per month, one of the highest-volume ESPs on the market. SMTP relay and REST Web API v3 are both first-class capabilities; a single API key authenticates against both. The Free plan gives you a permanent 100 emails/day, real production-grade infrastructure, and full domain authentication tooling.
If you already send transactional email or plan to soon, SendGrid is the industry default: consistent deliverability, extensive documentation, mature integrations with every WordPress plugin and language SDK. If you send under 100 emails/day, the Free plan runs indefinitely. Above that, paid plans start at $14.95/month for 40,000 emails/month.
Quick reference
The essential SendGrid SMTP settings, ready to copy-paste into your email client, mail server, or transactional integration.
| SMTP server | smtp.sendgrid.net |
|---|---|
| SMTP port (STARTTLS) | 587 RECOMMENDED |
| SMTP port (SSL/TLS) | 465 |
| Alternative port | 2525 (fallback if 587/465 blocked) |
| Legacy port | 25 (STARTTLS, blocked on most cloud hosts) |
| Username | apikey (literal string, lowercase) |
| Password | Your API key (starts with SG.) |
| TLS version | TLS 1.2 or 1.3 required |
SMTP configuration
Outgoing mail server
— sending email
Setup steps
- Log into your SendGrid dashboard and navigate to Settings › API Keys.
- Click Create API Key, choose Restricted Access, grant only the Mail Send permission, and copy the generated key (starts with
SG.). - Verify your sender identity under Settings › Sender Authentication — either verify a single sender address or complete full Domain Authentication (recommended).
- In your email client or WP SMTP plugin, enter host
smtp.sendgrid.net, port 587, encryptionSTARTTLS. - Set username to the literal string
apikey. Set password to the API key from step 2 (including theSG.prefix). - Send a test email to verify DKIM alignment. Check the Activity Feed in the SendGrid dashboard for delivery confirmation or auth errors.
Authentication
SendGrid uses API key authentication exclusively for SMTP. There is no traditional per-user SMTP password. The username slot always carries the literal string apikey, and the password slot carries your API key. This gives three practical advantages:
- Scoped keys: generate multiple keys per integration, revoke individually without breaking others. For SMTP relay, restrict scope to Mail Send only.
- Universal credentials: the same API key works for SMTP relay, Web API v3, and Marketing Campaigns API. One credential, three interfaces.
- No password rotation pressure: API keys do not expire unless you revoke them. Rotation is your policy choice, not a SendGrid deadline.
SPF and DKIM setup
Domain Authentication is required before sending in volume. SendGrid provides a verification wizard under Settings › Sender Authentication › Authenticate Your Domain. Expect DNS propagation of 4 to 24 hours. Sending without verified DKIM triggers spam placement and, for Gmail/Yahoo senders above 5,000/day, hard delivery failures under the post-February 2024 enforcement rules.
Automated Security (recommended)
SendGrid’s Automated Security setup generates three CNAME records for your domain:
emXXXX.yourdomain.com›uXXXX.wl.sendgrid.net(Return-Path alias, enables SPF alignment for DMARC)s1._domainkey.yourdomain.com›s1.domainkey.uXXXX.wl.sendgrid.net(DKIM selector 1)s2._domainkey.yourdomain.com›s2.domainkey.uXXXX.wl.sendgrid.net(DKIM selector 2)
Keys are 2048-bit with automatic rotation — SendGrid rotates DKIM without service interruption, no manual intervention required. This is the recommended path for 95% of use cases.
Manual Security (advanced)
If you cannot delegate DNS control to SendGrid (compliance, air-gapped environments), Manual Security lets you host your own DKIM public keys as TXT records. You are then responsible for key rotation. Only use if Automated Security is genuinely blocked.
DMARC alignment
Automated Security configures the Return-Path subdomain (emXXXX.yourdomain.com) so SPF alignment for DMARC works out of the box. DKIM alignment is automatic because keys are published under your own domain. Publishing at least v=DMARC1; p=none; rua=mailto:reports@yourdomain.com on your domain is now a de facto requirement for inbox placement at Gmail and Yahoo for senders above 5,000 emails/day.
Rate limits & sending caps
| Limit type | Value | Notes |
|---|---|---|
| Messages per SMTP connection | 5,000 | Open a new connection after reaching the limit. Most mail libraries handle this automatically. |
| Concurrent SMTP connections | 10,000 | Per source server. Rarely a concern for standard app workloads. |
| API endpoint rate | 600/minute | Default across Web API v3. Mail Send endpoint accepts up to 10,000 req/second. |
| Rate limit response | HTTP 429 | Returned with a Retry-After header specifying wait seconds. Honor this header. |
| Daily volume (Free plan) | 100/day | Hard cap, resets at midnight UTC (not rolling window). No paid burst option. |
| Message size (with attachments) | 30 MB | Larger via API multipart uploads. Individual attachment cap: 30 MB. |
Paid plan monthly caps: Essentials 40K at $14.95/month covers 40,000 emails/month. Essentials 100K at $29.95/month covers 100,000/month. Pro tier scales further with dedicated IP add-on ($30/month per IP, automatic 41-day warmup, recommended above 50,000/month). Premier is custom enterprise pricing with SLA and dedicated technical account manager.
Common setup gotchas
Username is apikey, not your email
Single most common failure. Users paste their SendGrid account email or user ID into the username field — instant 535 Authentication Failed error. The username is always the literal string apikey, lowercase, no quotes, regardless of your account email.
Newlines in the API key break SMTP auth
Copy-pasting the API key from a terminal or a wrapped-line editor sometimes introduces line feeds. SMTP is a line-oriented protocol; any linefeed in the password field breaks authentication with a cryptic 535 or timeout. Paste into a plain-text editor first to spot invisible newlines before configuring your SMTP client.
Port 25 is blocked on all major cloud hosts
Never use port 25 for SMTP submission. Heroku, DigitalOcean, AWS EC2 (outbound port 25 restricted by default), and Google Cloud all block it. Use 587 (STARTTLS, recommended), 465 (SSL/TLS), or 2525 as fallback if 587/465 are blocked by a local firewall.
Sender Identity mandatory before first send
A brand-new SendGrid account cannot send anything until you verify at least a Single Sender (one email address) or complete Domain Authentication. Skipping this step returns 550 The from address does not match a verified Sender Identity on every send attempt.
Free tier hard block at 100/day resets at midnight UTC
The Free plan’s 100 emails/day is a hard cap on a fixed reset schedule — not a rolling window. Bursty traffic that hits 100 by noon UTC gets zero sends until the next midnight UTC reset. For production, upgrade to Essentials 40K ($14.95/month) minimum.
Marketing Campaigns UI is billed separately
Essentials and Pro plans cover the Email API (SMTP + Web API + transactional templates). The Marketing Campaigns visual editor is a separate product line with its own pricing. If you are migrating a use case combining broadcasts and transactional (e.g. Mailchimp with Mandrill), plan for two line items on your SendGrid invoice.
Migrating SMTP setups
To SendGrid (from another provider)
Update your app’s SMTP config to smtp.sendgrid.net:587, change username to the literal string apikey, and swap the password for a fresh SendGrid API key with Mail Send scope. Complete Domain Authentication on your sending domain before cutover. Plan for 4 to 24 hours of parallel operation during DNS propagation, with both providers active so no message is dropped.
From SendGrid (to a different provider)
Postmark is the most common migration target for teams wanting lower latency and simpler pricing for transactional-only workloads. Amazon SES is the cheapest at high volume (100k+ per month) if you can absorb the AWS operational overhead. Mailgun if you need EU data residency. Plan for 2 to 3 hours to reconfigure SPF and DKIM records for the new provider, update app credentials, and verify deliverability against a test list.
Frequently asked questions
What is SendGrid’s SMTP server address and port?
SendGrid’s SMTP host is smtp.sendgrid.net. Recommended port is 587 with STARTTLS. Alternative ports: 465 (implicit TLS / SSL), 2525 (STARTTLS fallback when 587 is blocked), and 25 (STARTTLS, but blocked outbound on most cloud hosts like Heroku, AWS EC2, DigitalOcean). Use port 587 unless your network has a specific restriction.
Why is my SendGrid SMTP username ‘apikey’ instead of my email address?
SendGrid uses a fixed-username authentication scheme. The username is always the literal string apikey (lowercase, no quotes), and your actual credential — the API key — goes in the password field. Every SendGrid customer types the same word in the username slot. This lets SendGrid route SMTP authentication through the same gateway that serves the Web API v3, so a single API key works for both interfaces.
How do I generate an API key for SendGrid SMTP authentication?
Log into your SendGrid dashboard, navigate to Settings › API Keys › Create API Key. For SMTP relay, choose Restricted Access and grant only the Mail Send permission — this is least-privilege best practice. The key begins with SG. and is displayed only once at creation. Copy it immediately into your secret manager or SMTP client configuration.
What’s the daily send limit on the SendGrid free plan?
The permanent SendGrid free plan allows 100 emails per day. It is a hard cap that resets at midnight UTC — not a rolling window. If your traffic hits 100 sends by noon UTC, you get zero sends until the next reset window. For higher volume, Essentials 40K at $14.95/month covers 40,000 emails/month, and Essentials 100K at $29.95/month covers 100,000/month.
Why am I getting a 550 sender identity error from SendGrid?
SendGrid requires sender identity verification before any send. Your From: address must belong either to a Single Sender you’ve verified (individual email address) or to a domain you’ve authenticated via the Sender Authentication flow. The 550 error means the From: address in your message does not match any verified sender identity on the account. Fix: either add the specific From: address as a Single Sender, or complete full Domain Authentication.
What’s the difference between SendGrid’s SMTP relay and Web API v3?
SMTP relay uses the standard SMTP protocol (host, port, username, password) — works with any client that speaks SMTP, including WordPress plugins, ecommerce platforms, legacy applications, and any language’s built-in mail library. Web API v3 uses HTTPS POST with JSON payloads — offers finer control (categories, custom_args, send_at scheduling) and higher per-second throughput (up to 10,000 req/sec on Mail Send). Same API key authenticates both.
Should I use port 587 or 465 with SendGrid?
Port 587 with STARTTLS is the modern standard and SendGrid’s recommendation. Port 465 with implicit SSL/TLS is also supported for legacy compatibility. Functionally both are secure — they use the same TLS 1.2 or 1.3 encryption. Use 587 unless a firewall specifically requires 465, or your SMTP client library only supports implicit TLS. Port 2525 is a good fallback if 587 is blocked by your network.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
