SparkPost SMTP Settings and Configuration (2026)
Native SMTP relay on smtp.sparkpostmail.com
SparkPost ships a first-party SMTP endpoint on port 587 (STARTTLS) and an alternate 2525 for networks that block 587. Credentials are the literal username SMTP_Injection paired with a SparkPost API key that has the Send via SMTP permission — no separate mailbox, and the same API key can sign every request against the REST API.
SparkPost is a good fit when you want a high-throughput transactional relay with granular subaccount isolation and a generous free ceiling of 100,000 emails/month. If you would rather stay in a strict pay-as-you-go model with no tiered ladder, compare with Amazon SES. If you need a click-and-go developer stack with modern SDKs, look at Postmark, SendGrid, or Resend. For an EU-native option with a comparable free tier, Brevo is worth a look.
Quick reference
| SMTP server | smtp.sparkpostmail.com (US) · smtp.eu.sparkpostmail.com (EU) |
| Port (STARTTLS) | 587 RECOMMENDED |
| Port (SSL/TLS implicit) | Not offered — use STARTTLS on 587 or 2525 |
| Alternative port | 2525 (STARTTLS, for networks that block 587) |
| Username | Fixed literal SMTP_Injection (case-sensitive) |
| Password | SparkPost API key with the Send via SMTP permission enabled |
SMTP configuration
SparkPost SMTP relay
Route wp_mail(), your MTA, or any client library through SparkPost’s SMTP injection endpoint with STARTTLS on 587.
Setup steps
- In the SparkPost dashboard open Configuration › Sending Domains, add your sending domain, then publish the SPF include:sparkpostmail.com mechanism and the DKIM CNAME record that SparkPost generates (scph<selector>._domainkey).
- Under Configuration › API Keys create a new key, enable the Send via SMTP permission, and (optionally) restrict it to the subaccount and IP range that will call the relay.
- In your app or MTA set the SMTP host to smtp.sparkpostmail.com (or the EU equivalent) on port 587, enable STARTTLS, and use username SMTP_Injection with the API key as password.
- Send a test message from your verified sending domain. Watch Signals Analytics › Events and confirm the injection, delivery and (if enabled) open/click events land within a minute.
- Once the test succeeds, add a valid credit card if you expect to cross 100,000 messages per month on the free plan, and swap the sandbox sparkpostbox.com From address for your verified domain.
Authentication
SPF and DKIM setup
SparkPost signs outbound mail with a DKIM key that is scoped to your sending domain using an account-specific scph<selector> prefix. You publish one CNAME record for DKIM and one SPF include for the bounce path — SparkPost handles the key material and rotation.
; SPF (add the include to an existing SPF record; keep exactly one TXT record) yourdomain.com. IN TXT "v=spf1 include:sparkpostmail.com ~all" ; DKIM (CNAME — the scph<selector> value is shown in the SparkPost dashboard ; when you add your sending domain; example selector: scph0421) scph0421._domainkey.yourdomain.com. IN CNAME scph0421.dkim.sparkpostmail.com. ; Bounce (Return-Path) subdomain — use a dedicated subdomain, never the root bounces.yourdomain.com. IN CNAME sparkpostmail.com.
After you save the records, click Verify in the sending-domain screen. SparkPost re-queries DNS, marks SPF and DKIM as passing, and flips the domain to Ready to send. Give resolvers up to 30 minutes before you retry if the first check fails.
DMARC alignment
SparkPost does not provision a DMARC record on your behalf. Publish your own single record at _dmarc.yourdomain.com, start at p=none with an rua reporting address, then move to quarantine and finally reject once your reports are clean. Because the DKIM signature is scoped to your sending domain and SPF uses SparkPost’s bounce subdomain, DKIM alignment is the reliable path for DMARC pass — make sure the From header uses the same domain (or a subdomain) as the DKIM d= tag. Since February 1, 2024 Gmail and Yahoo enforce DMARC and a <0.3% spam-complaint rate for bulk senders, so a working DMARC policy is table stakes.
Rate limits & sending caps
| Limit | Value | Notes |
|---|---|---|
| Recipients per SMTP injection | 1,000 total | Across To, Cc, Bcc and archive-list recipients combined. Chunk larger sends client-side. |
| Message size | 20 MB | HTML, plain-text body, attachments and inline images combined per message. |
| Concurrent SMTP connections | No hard published cap | SparkPost recommends reusing each connection for up to 100 messages; idle connections are closed after 1 minute. |
| Sandbox sending | 5 messages, lifetime | Via sparkpostbox.com to the account owner’s verified address only. Real traffic requires a verified sending domain. |
| Free-plan monthly cap | 100,000 messages / month | Full feature access. A valid credit card is required once you cross this ceiling; hourly caps are not published, over-quota returns SMTP error 420. |
SparkPost does not publish per-hour SMTP throughput ceilings — caps are enforced on daily and monthly windows, and API-side rate limiting is signalled per endpoint with HTTP 429. Enterprise / High-Volume contracts (3M+/month) add contractual burst-rate guarantees.
Common setup gotchas
The SMTP username is a literal, not your email address
The AUTH LOGIN username for SparkPost is the exact case-sensitive string SMTP_Injection. Pasting your account email or the API-key label into the username field is the single most common cause of 535 auth failures. For subaccounts, append :X-MSYS-SUBACCOUNT=<subaccount_id> to that same fixed prefix; the password is always the API key with the Send via SMTP permission.
US and EU accounts hit different endpoints
Accounts created at eu.sparkpost.com will silently fail against the US relay. Set the host to smtp.eu.sparkpostmail.com for SMTP and https://api.eu.sparkpost.com/api/v1 for REST. The two regions do not share API keys, sending domains or event history.
Bounce domain must be a dedicated subdomain
SparkPost requires the Return-Path bounce domain to be a subdomain like bounces.yourdomain.com with its own CNAME to SparkPost’s bounce host. Pointing the root domain, or reusing a subdomain that already owns an MX record, triggers the “invalid bounce domain” error at verification and blocks sending. Set it up alongside the DKIM CNAME on first configuration.
Sandbox domain is capped at five test messages
Every new account gets sparkpostbox.com as a sandbox From domain, but only 5 messages total can be sent through it, and only to the account owner’s verified address. Any real customer traffic requires a verified sending domain and, past 100,000 messages/month, a valid credit card on file.
Migrating SMTP setups
Moving to SparkPost
Migrating in from SendGrid, Postmark, Amazon SES or Brevo is a swap of host, port and credentials plus a fresh DNS pass. Add your sending domain in Configuration › Sending Domains, publish the SPF include and the scph<selector> DKIM CNAME, and create an API key with the Send via SMTP permission. Update your app or MTA to point at smtp.sparkpostmail.com on port 587 with username SMTP_Injection and the API key as password. Run a canary send first, then switch traffic gradually so you can watch bounce and complaint rates in Signals Analytics without polluting reputation on a fresh IP or subaccount.
Moving away from SparkPost
Before flipping DNS or SMTP credentials, export your Suppression List (bounces, unsubscribes and complaints) through Recipients › Suppression List or the /api/v1/suppression-list endpoint, then re-import it into the destination provider so hard bounces do not restart. Snapshot your templates via /api/v1/templates so substitution syntax can be translated. Publish the new SPF include and DKIM records on your sending domain before lowering TTL on the SparkPost ones, and keep both records live during a 72-hour overlap so in-flight traffic completes cleanly. Compare destinations on Amazon SES for pure cost, Postmark for transactional focus, or SendGrid for a broader marketing stack.
Frequently asked questions
What is the SparkPost SMTP hostname and which ports does it accept?
Use smtp.sparkpostmail.com for US accounts and smtp.eu.sparkpostmail.com for accounts created at eu.sparkpost.com. Both regions accept STARTTLS on port 587 (recommended) and on port 2525 as an alternative when 587 is blocked by an upstream firewall. SparkPost does not publish an implicit-TLS port 465 endpoint, so always enable STARTTLS in your client rather than SSL/TLS on connect.
How do I authenticate over SMTP — what goes in the username and password fields?
The username is the fixed, case-sensitive literal string SMTP_Injection. The password is a SparkPost API key that has the Send via SMTP permission enabled in Configuration › API Keys. Your account email is never used for SMTP authentication. Subaccounts append :X-MSYS-SUBACCOUNT=<id> to the username so the injection is scoped to the correct tenant.
How do I switch my SMTP configuration from the US to the EU SparkPost region?
Create the account (and API key) at eu.sparkpost.com — regions do not share credentials, sending domains, or event history. Then change the host in your app or MTA to smtp.eu.sparkpostmail.com and, on the REST side, base URL https://api.eu.sparkpost.com/api/v1. Republish the sending-domain DNS records against the EU account before you cut over.
Why am I getting a 535 authentication error when I try to send through SparkPost SMTP?
The most common cause is putting your email address or the API-key label into the username field. It must be the literal string SMTP_Injection. Other frequent causes are using an API key that does not have the Send via SMTP permission, using a US API key against the EU endpoint (or vice versa), or forgetting to append the :X-MSYS-SUBACCOUNT=<id> suffix for a subaccount-scoped key. Regenerate the key with the correct permission and confirm the region before you retry.
Can I send from a SparkPost subaccount over SMTP, and how do I scope credentials?
Yes. Create the API key inside the subaccount (or create it in the parent and assign it a subaccount) with the Send via SMTP permission, then authenticate with username SMTP_Injection:X-MSYS-SUBACCOUNT=<subaccount_id> and that API key as password. Bounces, complaints, sending-domain verifications and Signals Analytics metrics stay isolated to that subaccount — useful for multi-tenant SaaS or agency setups.
How many recipients and how large a message can I inject in one SMTP session?
A single SMTP injection can address up to 1,000 recipients across To, Cc, Bcc and archive-list fields combined, and the total payload (HTML, plain-text, attachments and inline images) is capped at 20 MB. Beyond that, chunk client-side into multiple injections. SparkPost also recommends reusing each SMTP connection for up to 100 messages and closes idle connections after about one minute, so keep-alive plus batching is the pattern to aim for on high-volume mailers.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
