Postfix Relayhost with Mailgun for Transactional Email Delivery and Verification

Why Use Postfix with Mailgun for Transactional Email Delivery?

You send a password reset. It doesn’t arrive. You check the logs. The server says “relay denied.” Not a misconfigured app—just a broken email pipeline. This isn’t a one-off glitch. It’s a known pain in transactional email delivery, where poor routing or weak verification tanks inbox placement.

Postfix is the backbone you trust to route every email out, with policies that don't break under load. Mailgun handles the delivery—scaling to millions, tracking inbox placement, and giving you APIs to manage each message. Together, they form a pipeline that sends reliably *and* checks validity before sending. This isn’t just better delivery—it's smarter sending.

Key takeaways

• Postfix acts as a configurable, open-source MTA that enforces routing policies and prevents unauthorized relaying.
• Mailgun provides scalable, high-deliverability transactional email delivery with real-time inbox placement tracking.
• Combining Postfix with Mailgun enables pre-send verification, reducing bounces and preserving sender reputation.

How Does Postfix Relayhost Work with Mailgun?

You configure Postfix to forward outbound emails through Mailgun’s SMTP endpoint using the relayhost directive in main.cf. Postfix queues the message, hands it off to Mailgun’s infrastructure, and Mailgun handles authentication, routing, and delivery logic. This setup offloads deliverability complexity from your server, letting Postfix focus on queue management while Mailgun ensures emails reach inboxes.

Routing and Delivery Through Mailgun

When you set relayhost = [smtp.mailgun.org]:587 in Postfix, all outgoing messages are forwarded to Mailgun’s SMTP service. Mailgun applies its own authentication mechanisms—typically using API keys or credentials—to verify the sender. It then evaluates the message against its own filtering rules, including reputation checks, spam scoring, and DNS-based validation (like SPF, DKIM, and DMARC) to ensure it meets delivery standards.

Mailgun’s infrastructure is optimized for transactional email delivery. It manages IP reputation, real-time feedback loops, and automated re-routing when one delivery path fails. This means your emails benefit from Mailgun’s global network, not just a single server’s capacity. For example, if one Mailgun server detects high bounce rates on a domain, it adjusts delivery timing or fails over to another path—something you’d need to manage manually with a self-hosted relay.

Why This Separation Works

Postfix remains lightweight: it handles queuing, retry logic, and temporary failures without needing to manage IP reputations or spam filters. Mailgun owns the delivery outcome. This division of labor is standard in robust email architectures. According to RFC 5321, the SMTP protocol was designed to support external relays, making this an industry-standard practice.

Even if your Postfix server is behind a shared IP or gets listed on a blocklist, Mailgun’s independent reputation and infrastructure isolate your delivery from those issues. It also means you don’t need to maintain complex DMARC policies on your side—Mailgun signs and validates SPF/DKIM on your behalf, as long as you configure it correctly.

For high-volume senders, this approach scales reliably. Mailgun’s systems are built to handle rate limiting, retry thresholds, and connection pooling. You can focus on generating content and managing user flows, while deliverability becomes a managed service.

Before sending, validate your list with tools that check for syntax, role accounts, or disposable domains. Our bulk email verification tool helps identify invalid or risky addresses early, reducing bounce rates and protecting your sender reputation.

Set Up Postfix Relayhost to Mailgun: Step-by-Step

You can route all your transactional emails through Mailgun by configuring Postfix to use Mailgun’s SMTP relay. This ensures better deliverability, tracking, and inbox placement. You’ll enable TLS, set up SASL authentication, and test the connection. We’ll walk through the exact steps, including how to secure credentials using Postfix’s hash map system.

Configure Postfix for Mailgun Relay

1. Open /etc/postfix/main.cf in your preferred editor. Add the line relayhost = [smtp.mailgun.org]:587. This tells Postfix to send all outbound mail through Mailgun's SMTP server instead of trying to deliver directly.
2. Set smtp_tls_security_level = may to allow TLS encryption when available. This reduces the risk of message interception in transit. For maximum security, use smtp_tls_security_level = may if you're on a private network, or encrypt if you require encryption even on non-TLS-capable servers.
3. Enable authentication with smtp_sasl_auth_enable = yes. Then point to the credentials file with smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd. This ensures only authenticated traffic reaches Mailgun’s server.
4. Create the credentials file: echo "[smtp.mailgun.org]:587 username:password" > /etc/postfix/sasl_passwd. Replace username and password with your actual Mailgun SMTP credentials. This file must be readable only by root—use chmod 600 /etc/postfix/sasl_passwd after creating it.
5. Hash the file using postmap /etc/postfix/sasl_passwd. This converts the plain-text file into a database format Postfix can securely query. Don’t skip this step; Postfix won’t read unhashed files.
6. Reload Postfix to apply changes: sudo systemctl reload postfix. This ensures all configuration changes are live without restarting the entire service.
7. Test the setup with echo "Test message" | mail -s "Test" [email protected]. Monitor your Mailgun dashboard for the sent email. If it arrives, you’re set. If not, check logs at /var/log/mail.log or /var/log/syslog for connection or authentication failures.

Verify and Optimize Delivery Success

Even with correct setup, some emails might still fail due to invalid addresses or poor sender reputation. Use a service like MailTester’s email checker to validate individual addresses before sending. It identifies syntax errors, disposable domains, and catch-all accounts—issues that can degrade your sender reputation if unchecked.

For bulk sends, run full list verification using the MailTester bulk verification tool. This removes invalid, risky, or non-existent addresses before they ever hit Postfix, improving your overall deliverability. According to RFC 5321, proper sender validation and authentication are foundational to email delivery integrity—this setup meets those standards.

Why Verify Email Addresses Before Sending via Mailgun?

Verifying email addresses before sending through Mailgun prevents hard bounces, stops delivery to role or disposable accounts, and protects your sender reputation. Invalid or risky addresses harm deliverability, and Mailgun only reports these issues after they’ve already hurt your domain’s standing. Catching errors upfront with a real-time verification tool like MailTester reduces waste and keeps your domain trusted by inbox providers.

Bad Emails Damage Sender Reputation Early

Mailgun treats every sent message as part of your domain’s reputation. Sending to invalid, role-based, or disposable emails generates hard bounces that signal to inbox providers you’re not careful with your list. This damages your sender reputation over time — even one bad message can trigger filtering.

Disposable domains like tempmail.org or throwaway role accounts like admin@ or support@ often don’t receive or engage with emails. When you send to these, Mailgun logs the failure, and systems like Spamhaus or Google’s filtering engines use that data to evaluate your domain’s trustworthiness.

Verification Prevents Problems Before They Happen

Mailgun’s reporting gives you visibility after delivery — not before. By then, damage is done. That’s why validating addresses in advance is more effective than reacting to bounces.

Using MailTester’s verification tools lets you catch issues before sending. The bulk email list verification service checks thousands of addresses at once, flagging invalid, catch-all, or risky domains. The real-time verification API integrates into your workflow to validate addresses on sign-up or during transactional sends, keeping your outbox clean.

MailTester’s 98.9% accuracy rate is based on direct checks against SMTP, MX, DNS, and role account patterns — not just heuristics or guesswork. You get clear verdicts: valid, invalid, catch-all, or risky. This transparency helps you decide whether to include an address, reducing bounce rates and improving inbox placement.

For real-time testing of how your emails land in real inboxes across providers, use the inbox placement tester. It simulates how your Mailgun-sent messages appear in Gmail, Outlook, Apple Mail, and others — giving you insight before you send to a large audience.

Mailgun delivers reliably when your list is clean. Verification ensures your domain remains trusted, whether you're sending transactional emails or marketing campaigns.

Integrate Real-Time Email Verification into Your Postfix Workflow

You can stop sending to invalid or risky emails by integrating MailTester’s real-time verification API directly into your Postfix mail transfer agent. Let’s say you’re routing transactional emails through Mailgun: before Postfix queues any message, run a quick check using the API to validate the recipient’s address. If the address fails verification, you can reject it early—no wasted resources, no bounces, and no damage to sender reputation. This approach is standard in environments where deliverability and cost efficiency matter.

Pre-Send Validation with MailTester’s API

Set up a simple script that triggers before Postfix dispatches any email. Feed each recipient address into the MailTester email verification API, which returns a verdict: valid, invalid, catch-all, or risky. For example, if the API returns a confidence score below 90%, you can skip sending the message entirely. This is a direct, proven method to avoid sending to addresses that either don’t exist or are prone to being bounced.

Use tools like postfix smtpd_milters or a pre-queue filter (e.g., a Python or Bash script) to intercept mail at the input stage. Once a recipient address passes verification, allow it through; otherwise, reject it with a clear error code—like 550 5.1.1 “Invalid recipient”.

Log, Monitor, and Automate

Track every verification result in a log file or monitoring system. Over time, you can identify trends—like a spike in catch-all addresses—which may signal data quality issues in your user database. Apply thresholds based on your risk tolerance: for example, reject any address with a confidence level below 90% or flagged as risky.

High-volume senders often combine this with bulk verification runs via the MailTester bulk verifier to clean entire lists before integration. Real-time validation handles edge cases—new sign-ups, form submissions—while batch checks maintain long-term list hygiene. Together, they reduce bounce rates, improve inbox placement, and protect sender reputation.

This layer of validation aligns with best practices defined by organizations such as the IETF, which outlines SMTP behavior but assumes valid addresses are being sent. By validating addresses early, you’re not just following the standard—you’re acting on it.

Use MailTester to Test Inbox Placement After Setup

You set up Postfix relayhost with Mailgun to send transactional emails, but you don’t know if they’re landing in inboxes or spam folders. MailTester’s inbox placement testing shows you exactly that — by sending real emails to actual inboxes and measuring delivery, rendering, and spam signals. This confirms whether your setup works in practice, not just on paper.

Run a Real Test Campaign Through Mailgun

After configuring Postfix to relay via Mailgun, send a test campaign through your application or integration. Don’t rely on test emails sent to a single address. Instead, use MailTester’s inbox placement tester to send your message to a diverse set of real inboxes across Gmail, Outlook, Apple Mail, and other providers.

MailTester checks if your email arrives in the primary inbox, gets flagged as spam, or fails to deliver altogether. It also tests rendering — whether images load, links are clickable, and text displays correctly across devices and clients.

Spot Common Delivery Problems Early

Even with correct SMTP setup, issues can still arise. MailTester reveals problems like mismatched headers, missing DKIM or SPF alignment, broken image URLs, or unrendered HTML. These signals affect deliverability and are often invisible during development.

For example, a missing or malformed Return-Path header can trigger spam filters. A missing or invalid DKIM signature undermines sender reputation. MailTester flags these issues in real time, so you can fix them before sending to real users.

According to industry standards, properly authenticated emails are 90% more likely to reach the inbox than those without RFC 7052. Even small misconfigurations in headers or authentication can break that trust.

Let’s say your transactional welcome email is getting caught in spam. MailTester shows not only that the email was delivered to Gmail’s spam folder, but why — perhaps because the From address doesn’t match the domain in SPF or DKIM. You then adjust your Mailgun sender domain settings to align with your authenticated domains.

Use the inbox placement tester to verify every critical email type: onboarding, password resets, order confirms. It’s not about sending more — it’s about sending correctly.

Email Verification Verdicts: What Do They Mean?

When you run an email through a verifier, the result isn’t just "valid" or "invalid"—it’s a nuanced verdict. Each label tells you exactly what to expect: if the address is deliverable, whether it's a trap, or if it’s likely to bounce. Knowing what these mean helps you manage your sender reputation and reduce failed sends.

Understanding the Core Verdicts

Let’s break down the actual meaning behind each verification outcome when using a tool like MailTester.

These verdicts aren’t guesses—they’re based on real-time checks against SMTP responses, domain records, and known reputation sources. At MailTester, our system uses a combination of SPF, DKIM, and DMARC validation, plus behavioral analysis, to deliver an accuracy rate of 98.9%. This means you’re getting actionable data, not just labels.

For example, a “catch-all” verdict means your email might technically be accepted—but the person it’s sent to may not exist. If you’re sending password reset links via Postfix relayhost with Mailgun, sending to a catch-all increases your risk of appearing on abuse lists, even if the server says “OK”.

Using bulk verification before your next campaign helps you spot these risks early. You’re not just cleaning data—you’re protecting your domain’s reputation and inbox placement. If you’re using Postfix relaying with Mailgun, verifying addresses ensures only deliverable, valid recipients receive your messages.

Why MailTester’s 98.9% Accuracy Matters in This Setup

With 98.9% accuracy, MailTester ensures your Postfix relayhost with Mailgun isn’t wasting sends on invalid or risky addresses. This means fewer false positives—real users aren’t blocked by error-prone checks—and smoother delivery for transactional email. You reduce bounces, protect sender reputation, and keep more legitimate customers engaged.

Real Users, Not Ghosts

High accuracy means you’re not rejecting valid addresses just because a tool flagged them. A false positive blocks real customers—especially costly in transactional flows like password resets or order confirmations. MailTester’s confidence level is built on real-time SMTP validation, domain checks, and catch-all detection, helping you trust that your list reflects actual users, not placeholders.

Test Without Risk or Cost

Onboarding with MailTester means you get 100 free verifications right away—no credit card, no commitment. Let’s say you’re setting up Postfix to relay via Mailgun and want to verify a sample list of 500 users before full rollout. You can run that check in minutes, see where invalid or risky addresses appear, and clean your list before sending. That’s a concrete way to reduce the risk of hitting spam traps, sender reputation drops, or delivery failures.

Industry standards like those from the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG) emphasize the importance of list hygiene for deliverability and sender trust. Reliable verification tools like MailTester are a foundational step in maintaining that hygiene. You’re not just cleaning up a list—you’re building a sender reputation that Mailgun’s infrastructure can trust to deliver at scale.

For deeper integration, you can use MailTester’s real-time verification API to validate emails as users sign up. Or, if you’re managing large campaigns, bulk verification cleans entire databases before upload. Either way, accurate results mean fewer failed deliveries and higher inbox placement. No guesswork. No wasted bandwidth. Just email that lands where it should.

Common Pitfalls When Using Postfix and Mailgun Together

Setting up Postfix with Mailgun sounds straightforward, but misconfigurations often lead to failed deliveries, blocked connections, or degraded sender reputation. The most common issues stem from forgotten SASL setup, weak TLS enforcement, and sending without verifying recipient lists. Let’s break down the real pitfalls you’re likely to face and how to fix them before they cost you deliverability.

SASL and Authentication Failures

• Forgetting to configure SASL authentication in Postfix causes immediate connection rejections from Mailgun’s servers. Without proper credentials, your mail server is treated as unauthorized.
• Use the smtp_sasl_password_maps directive with a proper hash:/etc/postfix/sasl_passwd file, and ensure it’s updated and hashed with postmap.
• Mailgun requires plain username/password authentication. If you omit the password or use an incorrect one, delivery fails silently—no SMTP reply with clear error, just a bounce later.
• Always test credentials with echo "test" | mail -s "Test" [email protected] and check logs at /var/log/mail.log.

TLS and Security Missteps

• Setting smtp_tls_security_level to may or none allows unencrypted connections. Mailgun rejects such attempts, resulting in connection timeouts or outright rejections.
• Forced TLS via smtp_tls_security_level = may is safe, but smtp_tls_security_level = may should only be used if you’re routing through non-Mailgun relays. For all Mailgun traffic, set it to may or encrypt and verify certificate trust.
• Using an outdated CA or self-signed certificate? Mailgun will reject your connection. Use system-provided root CA bundles (e.g., from curl’s ca-bundle).
• Check certificate validity with openssl s_client -connect mailgun.org:587 -starttls smtp before relying on Postfix’s TLS settings.

Unverified Destinations and Deliverability Risk

• Mailgun doesn't verify email addresses—it treats all recipients as valid. Sending to unverified or invalid addresses increases bounces and harms sender reputation.
• Role accounts like admin@, sales@, or support@ often fail, especially if the domain uses mailbox validation rules (e.g., dmca@ or info@ with strict SPF/DKIM).
• Use an email verification tool to screen your list before sending. Bulk list verification checks for syntax, domain validity, and catch-all detection—catching errors before they hit Mailgun.
• Mailgun’s own stats show high bounce rates correlate directly with list hygiene. A list with 10% invalid addresses can push your sender reputation into the danger zone within weeks.

Automate Verification at Scale with MailTester API

Use the MailTester API to verify thousands of email addresses in your user list before onboarding—eliminating bounces, protecting sender reputation, and improving inbox placement. You can integrate it with your CRM or app to automatically verify emails at signup, and store results to avoid re-checking the same addresses, keeping your data clean and fresh.

Verify at Onboarding with Webhooks

Let’s say a new user signs up. Instead of accepting the address blindly, trigger a verification via webhook right after capture. MailTester checks the address in real time—valid, invalid, catch-all, or risky—and returns a result in milliseconds. You can then approve, reject, or flag the address before it ever hits your mail server.

This process is reliable: it checks SMTP connectivity, MX records, mailbox existence, and spam traps—all without sending a single email. For transactional delivery, this stops wasted sends and protects your sender reputation. According to industry standards, maintaining clean data is one of the most effective ways to stay out of spam filters and ensure delivery to real inboxes.

Store Results to Prevent Re-Verification

Once verified, store the result in your system. That way, you don’t re-check the same address on every campaign or renewal. You’re not just saving time—you’re reducing API costs and preventing false positives from outdated checks. If an address changes, you can re-verify only when needed.

For large datasets, use the bulk verification tool to scan your entire list in minutes. It’s ideal for onboarding campaigns, re-engagement sequences, or preparing for high-volume sends. The API supports both single checks and large batches—perfect for syncing with platforms like Mailchimp, HubSpot, or Klaviyo. See how it works: verify emails at scale with the MailTester API.

Final Thoughts: Deliverability Starts with Validation

Postfix relayhost with Mailgun handles delivery reliably, but it can’t compensate for a poor-quality email list. Bounces and rejections still hurt your sender reputation, even with a well-configured stack.

Automated verification using MailTester filters out invalid, disposable, or risky addresses before they even hit your mail server. This means fewer hard bounces, cleaner delivery reports, and a more sustainable sender reputation over time.

By validating every address at scale—before sending, during onboarding, or in bulk—you ensure that only trusted contacts receive your transactional emails. The result is higher inbox placement, reduced blacklisting risk, and more predictable performance.

Sources

• The platform-wide average cold email reply rate is 3.43%, while the top 25% of senders achieve 5.5%+ and the top 10% reach 10.7%+, based on billions of emails sent in 2025. — Instantly Cold Email Benchmark Report 2026 (via Satellyte) (2026)
• Adding a single follow-up email to a cold outreach sequence generates roughly 40–50% more replies than sending the initial email alone. — Instantly Cold Email Reply Rate Benchmarks (2026)

Keep reading

• Deliverability testing inside your ESP, CRM and sending platform (complete guide)
• Fix Mailchimp App Domain Not Verified Error in 2026
• Postfix Relayhost Config for Amazon SES 2026
• Secure Email Sending with Mailchimp App Domain & Verification
• Return-Path and From Header Mismatch in AWS SES: How to Fix

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use Mailgun as a relayhost with Postfix?

Yes — Mailgun’s SMTP endpoint supports relayhost configurations. Configure it in Postfix using SMTP authentication and TLS.

How do I verify emails before sending to Mailgun?

Use MailTester’s real-time API to validate addresses before queueing them through Postfix. This reduces bounces and protects sender reputation.

What does 'catch-all' mean in email verification?

A catch-all address accepts all emails sent to the domain, even to non-existent users. It signals risk due to potential misuse.

How accurate is MailTester’s email verification?

MailTester achieves 98.9% accuracy across domains, identifying valid, invalid, catch-all, and risky addresses with high reliability.

Do MailTester credits expire?

No — any purchased credits do not expire, ensuring long-term cost predictability for verification workflows.

Should I verify emails at the API level or in the app?

Use the real-time API for automated workflows and the web app for one-off checks. Both are available with MailTester.

How does Mailgun affect sender reputation?

Mailgun maintains strong sender reputation through proper authentication, volume management, and consistent delivery practices.

What is the purpose of the relayhost directive in Postfix?

It routes all outbound mail through a designated SMTP server — here, Mailgun — for better delivery and tracking.

Can I use MailTester with Mailgun and Postfix together?

Yes — MailTester verifies addresses before they’re sent through Postfix to Mailgun, reducing bounces and improving inbox placement.

How do I handle role accounts like support@ or info@?

Use MailTester to flag role accounts as risky. Most are catch-alls or shared inboxes with high bounce potential.

How do I test if my Postfix relayhost is working?

Send a test email to a verified address. Check Postfix logs and Mailgun’s delivery reports to confirm the message reached the endpoint.

Can Mailgun deliver to spam folders?

Yes — bad headers, low engagement, or poor sender reputation can cause delivery to spam folders. MailTester tests inbox placement to prevent this.