Skip to main content
SMTP sessions authenticate with an SMTP credential, a username and password, over an encrypted connection. A credential is bound to one verified domain.

​
Creating a credential

Create and manage SMTP credentials in the dashboard under SMTP credentials. Each credential belongs to a single domain.
The password is shown only once, when the credential is created. Store it in a secrets manager or environment variable. If you lose it, create a new credential and remove the old one.

​
Authenticating

Most clients ask for a username and password and handle the AUTH exchange for you. Provide:
  • Username. Your SMTP credential’s username, followed by @ and the domain it is bound to, for example [email protected].
  • Password. The credential’s secret.
The username must include the domain. mailkube splits the authentication identity on the @ to determine which verified domain you are sending for, so a bare username such as myapp01 fails authentication.
curl speaks SMTP as well as HTTP, which makes it a quick way to check a credential end to end:
--ssl-reqd makes STARTTLS mandatory, so curl aborts rather than falling back to plaintext. Drop the @example.com from --user and the same command returns 535 5.7.8 AUTH invalid. Every authentication failure returns the same reply, 535 5.7.8 AUTH invalid. A wrong password, an unknown user, a malformed username, an inactive domain or organization, and a connection from outside the credential’s source-IP allowlist (when you configured one) are deliberately indistinguishable, so the reply never confirms which part was wrong. Check the credential and its configuration rather than parsing the reply. The password is not your API key: API keys authenticate the REST API, and SMTP uses a separate credential. Always authenticate over a TLS-protected connection (STARTTLS on port 587) so the credentials are never sent in the clear. See Connection.

​
Matching the From address

The message From address must use the domain your credential is bound to. Sending from another domain is rejected with 550 From address must match authenticated domain <domain>. See Error codes.