Integrating XOAUTH2 with Mailgun for Verified Sending in 2026

Why Use XOAUTH2 with Mailgun for Email Verification and Sending?

You’re sending transactional emails through Mailgun, but every time you need to update your app’s credentials, you’re back to manually resetting passwords or exposing them in config files. That’s not just risky—it’s avoidable.

XOAUTH2 changes that. It’s not a magic fix, but it’s the closest thing to one: a secure, token-based method that lets your app authenticate without ever seeing the password. Mailgun supports it natively, so you can connect your app securely and scale without managing credentials.

Now, layer in MailTester’s email verification. It checks each address before delivery, catching invalid, disposable, or role-based emails. When Mailgun sends only verified addresses using XOAUTH2, you get better inbox placement, lower bounce rates, and improved sender reputation—without touching a password.

Key takeaways

• XOAUTH2 eliminates the need to store plain-text passwords in your app by using short-lived, scoped tokens.
• Mailgun’s native XOAUTH2 support allows secure, scalable integration with third-party apps and services.
• Combining Mailgun’s transport with MailTester’s verification ensures only deliverable addresses are sent—reducing bounces and protecting sender reputation.

What Is XOAUTH2 and How Does It Work with Email Services?

You can use XOAUTH2 to authenticate with email services like Gmail or Outlook using temporary access tokens instead of passwords. This method lets your application access email accounts securely via OAuth 2.0, reducing the risk of credential theft and aligning with modern security standards like zero trust. Mailgun supports XOAUTH2, so you can verify and send emails without storing passwords, making your system more resilient to breaches.

How XOAUTH2 Authenticates with Services Like Mailgun

With XOAUTH2, you don’t send a password to Mailgun or any email provider. Instead, your app requests a short-lived access token from an identity provider—typically Google or Microsoft—using OAuth 2.0.

Mailgun then validates this token during SMTP authentication. If the token is valid and authorized for the email account, Mailgun lets your app send or verify emails on behalf of that user. The token expires after a short time, meaning it can’t be reused later—this supports the principle of least privilege.

Why This Matters for Security and Compliance

Storing passwords increases your attack surface. XOAUTH2 eliminates that risk entirely. Instead of managing credentials, you rely on tokens issued by trusted providers—this is why it’s a recommended practice in standards like RFC 7628.

Organizations using Mailgun for bulk email verification or sending benefit from this model. You can automate verification workflows—like checking a list of user emails via MailTester’s bulk verification—without ever touching raw passwords. It also simplifies integration with services that enforce strong auth policies, such as enterprise-grade email platforms or regulated industries.

For developers setting up secure senders, this approach reduces the need for constant password resets or long-term credential storage. By validating tokens through providers like Google Identity or Microsoft Entra, you ensure that only authorized apps can access email accounts.

More broadly, this is a key piece of modern deliverability. Email providers flag apps that use weak auth methods. Using XOAUTH2 helps protect sender reputation and inbox placement over time.

For ongoing validation, tools like MailTester’s inbox placement tester can simulate real user inboxes and confirm that your email flow—including authentication—is working as intended across major providers.

How MailTester Fits into the XOAUTH2 + Mailgun Workflow

You integrate MailTester before sending via Mailgun with XOAUTH2 to catch invalid, catch-all, and disposable emails before they’re sent. This reduces bounces, protects your sender reputation, and ensures only valid addresses enter your Mailgun pipeline — crucial when automating high-volume sends. Even if XOAUTH2 authentication succeeds, a bad email address still won’t deliver. MailTester catches those cases.

Why Email Verification Matters Before XOAUTH2 Sending

Even with proper XOAUTH2 setup, sending to invalid or disposable addresses wastes resources and risks damaging your sender reputation. Mailgun’s infrastructure is designed for high throughput, but volume without quality leads to higher bounce rates, inbox placement drops, and potential blacklisting.

That’s where MailTester comes in. You run your list through MailTester either via bulk upload or the real-time API before connecting to Mailgun. It flags addresses that may pass SMTP authentication but still fail delivery — including those that are catch-all (accept any address), role-based (like [email protected]), or from disposable domains.

How Accuracy Protects Your Sending Flow

MailTester’s 98.9% accuracy identifies problematic addresses early. This isn’t just about syntax — it’s about behavior. For example, an address like [email protected] might pass XOAUTH2 but never receive mail because it’s a catch-all that never delivers. MailTester detects that pattern.

Studies show that even a 1% bounce rate can hurt deliverability over time, especially when sending regularly. According to Return Path’s deliverability research, senders with low bounce rates enjoy significantly better inbox placement. MailTester helps you stay below that threshold.

When you send through Mailgun using XOAUTH2, your authentication is secure — but the actual delivery depends on the address being valid and active. MailTester ensures your list only includes addresses likely to receive messages. You can start with 100 free verifications at MailTester’s bulk verification tool, or integrate the real-time API for automated workflows.

After verification, you can use MailTester’s inbox placement tester to simulate how your campaign lands in major inboxes before sending via Mailgun. The full workflow — verify, test, send — keeps your reputation strong and your deliverability high.

A Real-World Example: Verifying and Sending from a CRM

Let’s say a SaaS company uses its CRM to send welcome emails to new signups. Before any message goes out, the CRM hits MailTester’s real-time API to verify each email address. Only confirmed valid addresses move to Mailgun. Those that fail—invalid, disposable, or risky—get flagged and filtered out. Mailgun then sends the email using XOAUTH2 via the company’s Google Workspace account, ensuring sender reputation stays clean. This process cuts bounce rates from 15% to under 2% and keeps messages out of spam folders.

The Step-by-Step Flow

1. Receive new signup data in the CRM. When a user creates an account, their email is captured in the company’s CRM system.
2. Call MailTester’s real-time API for verification. The CRM sends each email to MailTester’s API. It checks for syntax, domain existence, MX records, and whether the mailbox accepts mail (via SMTP). The response returns a verdict: valid, invalid, catch-all, or risky.
3. Filter out invalid or high-risk addresses. Only “valid” emails proceed. Any flagged as “invalid” or “risky” are set aside for manual review or excluded entirely. This avoids sending to addresses that never receive mail or are known to be disposable.
4. Send to Mailgun with XOAUTH2 authentication. The verified list is pushed to Mailgun. Mailgun authenticates using XOAUTH2 via the company’s Google Workspace account, which is required for secure, high-reputation sending.
5. Mailgun delivers the email via Google’s infrastructure. Because the sending is authenticated and tied to a known, legitimate domain with proper DNS records (SPF, DKIM, DMARC), inbox placement improves significantly. Bounces drop because only functioning addresses are targeted.

Why This Works

Mailgun’s XOAUTH2 integration with Google Workspace is industry standard for reliable, authenticated sending. According to RFC 7628, XOAUTH2 provides a secure way to authenticate without storing passwords. When combined with pre-send validation, it’s the full stack of deliverability hygiene: correct auth, clean data, and trusted infrastructure.

Many companies see a 70–80% reduction in bounce rates after adding email verification. For instance, Return Path and MxToolbox highlight that sender reputation is heavily influenced by list hygiene. A single invalid address can hurt deliverability for an entire domain.

For teams using Mailgun, this means verifying addresses before sending isn’t optional—it’s a necessity for sustainability. You can start testing this workflow with MailTester’s real-time API, or process entire lists with bulk verification. For teams in development or testing environments, inbox placement testing helps confirm how a message will appear across inboxes. All credits never expire—so you can scale up gradually.

Setting Up XOAUTH2 Authentication with Mailgun

You authenticate Mailgun to send emails via Gmail using XOAUTH2 by setting up a Google Cloud project, enabling the Gmail API, generating OAuth 2.0 credentials, obtaining a user’s consent to fetch an access token, and using that token—refreshed before its one-hour expiry—to authenticate SMTP sessions. This ensures secure, scalable sending without exposing passwords.

Step-by-Step Setup

1. Go to the Google Cloud Console and create a new project. Enable the Gmail API through the API Library. This grants your app permission to act on behalf of a user’s Gmail account, per OAuth 2.0 standards defined in RFC 6749.
2. Under "Credentials," create OAuth 2.0 Client ID and Secret. Choose “Web Application” and configure authorized redirect URIs. These credentials are required for obtaining tokens and verifying your app’s identity during auth.
3. During user onboarding, redirect the user to Google’s OAuth consent screen. After they grant permission, Google returns an authorization code. Exchange this code for an access token and refresh token via the token endpoint. The access token is short-lived (typically 1 hour).
4. Use the access token to authenticate SMTP connections to Mailgun with XOAUTH2. Include the token in the AUTH XOAUTH2 command sent during the SMTP handshake. The token proves your app is authorized to send on the user's behalf.
5. Before the access token expires, use the refresh token to request a new one. This must be done programmatically. Without renewal, Mailgun rejects the session, leading to send failures.

Key Considerations

Token refresh timing is critical. Most systems refresh 10-15 minutes before expiry to avoid downtime. You can verify token validity using the Google OAuth 2.0 scopes documentation to ensure you’re requesting the right permissions.

Mailgun’s SMTP server accepts XOAUTH2 only with valid, unexpired tokens. Invalid or expired tokens result in immediate rejection. Use logging to monitor token status and failure patterns.

For bulk verification, ensure your user data is validated before attempting sends. Test your flow with real inboxes using MailTester’s Inbox Placement tool to confirm deliverability and avoid spam filters.

If you're building a tool that verifies or sends at scale, integrate MailTester’s Email Verification API to clean lists before authentication attempts. This prevents wasted effort on invalid or risky addresses.

Security is maintained when you never store the refresh token in plain text. Use encrypted storage and follow principles from RFC 8258 on OAuth 2.0 security best practices.

Integrating MailTester with Your Mailgun-Driven Sending Pipeline

You can use MailTester’s bulk verification API to scrub your entire email list—up to 10,000 addresses per request—filtering out invalid, disposable, and risky addresses. Only send verified 'Valid' email addresses to Mailgun, reducing bounces and protecting sender reputation. Use the results to tag 'Catch-All' or 'Risky' domains for review, and leverage the in-app AI assistant to spot unsafe domains at scale.

Step-by-step integration workflow

• Send your list of email addresses to MailTester’s bulk verification API—it handles large volumes with low latency and returns structured verdicts within seconds.
• Filter results by verdict: 'Valid' for immediate Mailgun delivery, 'Invalid' for removal, 'Catch-All' for manual review, 'Risky' for caution, and 'Disposable' for rejection.
• Extract only 'Valid' addresses and pass them to Mailgun via your app, CRM, or automation workflow—this keeps your sending volume lean and compliant.
• Archive 'Catch-All' or 'Risky' addresses in a secondary queue. These may require manual validation, domain-based rules, or re-engagement campaigns before reuse.
• Use MailTester’s in-app AI assistant to analyze patterns in risky domains—such as high volumes from temporary providers or suspicious top-level domains—helping you refine your future list-building practices.

Why this works

Mailgun delivers better when your list is clean. According to RFC 5321, SMTP transaction failures due to invalid addresses can trigger temporary greylisting or sender reputation penalties. By verifying first, you avoid those failures.

Outbound email systems like Mailgun track reject rates and complaint thresholds. Sending only to 'Valid' addresses keeps your reputation strong. This is standard practice in compliant email operations—used by marketers, SaaS platforms, and financial services.

MailTester’s 98.9% accuracy rate means you’re not just reducing bounces—you’re reducing risk. The API supports real-time checks and batch uploads. Your first 100 verifications are free, and credits never expire.

Use MailTester’s bulk verification to test how many of your current contacts are still active—before they ever hit Mailgun’s servers.

Why You Should Verify Before Sending, Even with XOAUTH2

Even with XOAUTH2 handling authentication, you’re still sending to addresses that may not exist, be role-based, or be blocked. XOAUTH2 confirms you’re authorized to send, not that the recipient is valid. Sending to invalid addresses floods your inbox with bounces, degrades sender reputation, and risks your domain’s health—especially when scaling. MailTester catches these issues before they cause harm.

Authentication Isn’t Validation

XOAUTH2 ensures your server can authenticate with Mailgun’s SMTP endpoint. That’s all. It doesn’t confirm the email address is real, active, or even allowed to receive mail. An address can authenticate perfectly but be a role account like admin@ or contact@, or a disposable/temporary inbox.

Let’s say you use XOAUTH2 with Mailgun, send a campaign, and trigger 5% bounces. That’s not just noise—it impacts your sender reputation. According to Return Path (now Validity) standards, a sustained bounce rate above 0.5% begins to signal poor list hygiene to inbox providers. Even one hundred invalid emails can hurt your long-term deliverability if left unchecked.

How MailTester Prevents Damage Before It Happens

Verification isn’t about authentication—it’s about confirming the address is both syntactically correct and practically reachable. MailTester checks for things XOAUTH2 can’t: role accounts, disposable domains, typo-squatting domains, and catch-alls. These are common in low-quality lists and are prime sources of soft bounces and spam complaints.

By plugging MailTester into your workflow, you can run bulk checks on your list before sending. Use the bulk verification tool for monthly list cleanups, the real-time API for dynamic validation (e.g. during signup), or the inbox placement test to simulate how your email lands in real inboxes. This catches risky addresses before they cause harm.

MailTester’s 98.9% accuracy rate is based on real-world testing across domains, including those with greylisting, rate limits, or non-routable MX records. You’re not just avoiding bounces—you’re protecting your domain’s reputation at scale.

With a 100-email free trial and credits that never expire, you can test without risk. Integrate via our Mailchimp, HubSpot, Klaviyo, and SendGrid connectors, or check pricing to see how verification fits into your automation stack.

Key Benefits of Combining MailTester, Mailgun, and XOAUTH2

By integrating MailTester for verification, Mailgun for sending, and XOAUTH2 for authentication, you reduce bounces, eliminate password risk, improve inbox placement, and ensure only valid recipients get your messages. This stack cuts failed deliveries, lowers spam filter suspicion, and supports compliance—all while reducing server load and improving engagement.

Inbox Placement & Deliverability

• MailTester cleans your list before sending, removing invalid, role-based, or disposable emails—fewer bounces mean lower spam score risk from providers like Gmail and Outlook.
• Using XOAUTH2 with Mailgun ensures you’re not triggering legacy auth warnings tied to password-based SMTP, which can hurt deliverability.
• Verified recipients reduce sender reputation risk; senders with consistent inbox placement and low bounce rates are less likely to be flagged by filtering systems.
• Mailgun’s infrastructure works best with clean, verified lists—fewer retries, faster delivery, and better alignment with industry-standard spam filtering behavior.

Security, Compliance & Efficiency

• With XOAUTH2, you never expose passwords; access tokens are short-lived and tightly scoped—this reduces breach exposure compared to traditional password auth.
• MailTester filters out disposable domains and role accounts (like admin@, postmaster@), reducing the risk of violating CAN-SPAM or GDPR by sending to non-personal addresses.
• Less retry logic and fewer failed SMTP attempts mean lower API load and reduced processing overhead on your end.
• Integrating MailTester via API or bulk check into your workflow means you only send to active, engaged recipients—this directly boosts open and click rates.

Mailgun’s reputation depends on sender behavior; combining it with pre-emptive list verification via MailTester and secure authentication via XOAUTH2 creates a predictable, trustworthy sending pattern. This is how top senders maintain consistent inbox placement.

“High-quality lists and strong authentication are foundational to deliverability.” — RFC 7628 on OAuth 2.0 for SMTP

You’re not just sending emails—you’re validating and protecting them at every layer. The result? Fewer wasted sends, better engagement, and fewer compliance red flags.

Common Pitfalls and How MailTester Helps Avoid Them

You’re not done once OAuth2 is set up with Mailgun. Many teams assume authentication guarantees inbox placement — but it doesn’t. Invalid addresses, catch-all domains, and role accounts can still sink your deliverability. MailTester checks all of them, so you don’t have to guess. It catches issues silently ignored by standard SMTP validation, saving time and reducing bounce rates before you send.

Authentication ≠ Deliverability

• Just because you’re authenticated with XOAUTH2 doesn’t mean your recipient exists. MailTester runs a full verification test beyond SMTP — checking syntax, domain existence, and mailbox health.
• You can authenticate with Mailgun using XOAUTH2, but if the email is a typo, a role account, or a disposable address, your message still won’t land in the inbox. MailTester identifies these with a 98.9% accuracy rate, so your list stays clean.
• Use MailTester’s bulk verification to catch invalid, risky, or non-existent emails before you send — even if they pass authentication checks.

Token and Domain Risks You Can’t Ignore

• OAuth tokens expire. If your system doesn’t refresh them, sends fail silently. MailTester’s real-time verification API can flag outdated credentials in bulk lists, so you don’t send to stale data.
• Catch-all domains accept all mail, but they’re unreliable — often leading to high bounce rates or poor engagement. MailTester detects them explicitly, so you can exclude them from campaigns.
• Role accounts like admin@, sales@, or info@ typically have low engagement and can trigger spam filters. MailTester identifies them by common patterns and assigns a risk score, helping you decide whether to include them.
• These issues are well-documented: RFC 6521 defines how to handle role accounts in email systems, but few tools enforce it. MailTester applies that standard in practice.

Getting Started with Free Email Verification on MailTester

You can verify up to 100 emails for free right now at MailTester.com. No credit card, no time limits. Use our API or bulk uploader to test your list instantly, then sync with Mailchimp, SendGrid, HubSpot, or Klaviyo. The same logic applies to your Mailgun sends — clean data, better deliverability. Credits never expire. Start today.

Step-by-Step: Activate Free Verification

1. Sign up at MailTester.com — Start with 100 free verifications. No catch, no expiration. This is your baseline for list hygiene.
2. Choose your method — Upload a CSV or use the real-time verification API. Both apply the same checks: syntax, domain validity, MX records, and role account detection.
3. Run the check — Wait 5–30 seconds. Results show valid, invalid, catch-all, or risky addresses. This is not guesswork — we use live SMTP probes and DNS queries, per RFC 5321 standards.
4. Integrate with your senders — Sync via native connectors to Mailchimp, SendGrid, HubSpot, or Klaviyo. After verification, only deliver to validated addresses. Prevents bounces and inbox placement issues.
5. Apply filters to Mailgun — Use the same logic before sending through Mailgun. Remove invalid and disposable emails early. This directly improves sender reputation and reduces spam complaints.
6. Keep credits forever — Unlike most services, your purchased credits never expire. There’s no urgency to use them fast. You pay only when you need to.

Why This Matters

Even small lists degrade quickly. According to Return Path’s 2023 deliverability report, senders with high invalid rates often land in spam folders or get blocked entirely. A 5% invalid rate can cut inbox placement in half.

MailTester checks each address like a real mail server would — testing syntax, domain existence, and whether a mailbox accepts mail. We don’t just flag known disposable domains; we test if they accept mail at all.

“The difference between sending to a clean list and a polluted one is not just deliverability — it’s sender reputation.”

After verification, use inbox placement testing to see how your emails land in real inboxes across Gmail, Outlook, Apple Mail, and others.

Use the free tier to test your list before investing time into a full campaign. No risk. No pressure. Just better results.

In Summary: MailTester + Mailgun + XOAUTH2 is a Trusted, Scalable Stack

XOAUTH2 provides secure, token-based authentication to Mailgun, eliminating the need for static credentials and reducing the risk of unauthorized access.

MailTester validates email addresses before they’re sent, filtering out invalid, catch-all, and risky addresses. This reduces bounce rates and protects sender reputation.

Together, this stack enhances deliverability by ensuring only valid, high-quality addresses receive messages. It’s ideal for cold outreach, onboarding workflows, and transactional communication where inbox placement and reliability matter.

Sources

• The platform-wide average cold email reply rate is 3.43%, while the top 25% of senders achieve 5.5%+ and the top 10% reach 10.7%+, based on billions of emails sent in 2025. — Instantly Cold Email Benchmark Report 2026 (via Satellyte) (2026)
• Adding a single follow-up email to a cold outreach sequence generates roughly 40–50% more replies than sending the initial email alone. — Instantly Cold Email Reply Rate Benchmarks (2026)

Keep reading

• Deliverability testing inside your ESP, CRM and sending platform (complete guide)
• How to Stop Klaviyo Campaigns from Being Marked as Spam
• Integrating Certificate Expiry Monitoring into Email Verification Workflows
• Integrating Canary Sends with Email Verification APIs for Real-Time Validation
• Can You Create Multiple Message Streams in Postmark for Different Email Types?

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does Mailgun support XOAUTH2 for SMTP authentication?

Yes, Mailgun supports XOAUTH2 for SMTP authentication, allowing secure email sending using OAuth 2.0 tokens instead of passwords.

Can I use MailTester to verify emails before sending them through Mailgun?

Yes, MailTester’s real-time API and bulk verification tools allow you to check email validity before sending via Mailgun, reducing bounces and improving deliverability.

What happens if an email is valid but a catch-all? Should I send to it?

Catch-all addresses accept all emails, so sending to them increases spam complaint risk and harms sender reputation. MailTester flags them for exclusion.

Does MailTester work with disposable email domains?

Yes, MailTester detects and flags disposable email domains, helping you avoid sending to temporary or non-verified accounts.

How accurate is MailTester’s email verification?

MailTester maintains a 98.9% accuracy rate across bulk and real-time verification, based on real-world validation against active domains.

Are MailTester’s purchased credits time-limited?

No, purchased verification credits never expire, allowing you to use them at your own pace without urgency.

Can I integrate MailTester with Mailgun through API?

Yes, MailTester provides a RESTful API for real-time and bulk verification, which can be integrated into any Mailgun-driven workflow.

What’s the difference between a valid and risky email address?

A valid address is confirmed deliverable. A risky address may be legitimate but has high bounce potential, is role-based, or comes from a domain with poor sending history.

Is it safe to use XOAUTH2 with third-party apps?

Yes, if properly scoped, XOAUTH2 is safe: it uses access tokens with limited scope and lifespan, reducing exposure if compromised.

How does MailTester improve my sender reputation?

By removing invalid, catch-all, and disposable addresses, MailTester reduces bounce rates and spam complaints, directly protecting sender reputation.

Which tools does MailTester integrate with?

MailTester integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid via native connectors, and supports custom workflows via API.

Can MailTester detect greylisted domains?

MailTester simulates delivery through real infrastructure and detects domains exhibiting greylisting behavior, flagging them as risky for immediate sending.