Postfix Relayhost Through SES or Mailgun Hybrid Setup 2026

Why Use a Hybrid Relayhost Setup with SES and Mailgun?

You’re hitting deliverability walls despite clean lists and well-crafted content. One provider handles all your emails — but that’s a bottleneck. What if you could split the load strategically, using the right tool for the right job?

Postfix relayhost through SES or Mailgun hybrid setup isn’t about complexity. It’s about control. Running everything through a single relay introduces single points of failure, limits your routing options, and can degrade sender reputation if volume spikes or domains are flagged.

A hybrid setup uses AWS SES for high-volume transactional mail — low cost, high throughput, reliable delivery across major inboxes. Mailgun takes over for time-sensitive campaigns, offering real-time analytics, robust routing rules, and granular feedback loops. Together, they distribute risk and improve inbox placement without sacrificing sender reputation.

Key takeaways

• Using both SES and Mailgun as Postfix relayhosts reduces reliance on a single provider, improving resilience and route flexibility.
• SES excels at low-cost, high-volume transactional email delivery; Mailgun offers deeper campaign analytics and better tracking for outreach.
• Proper SPF/DKIM alignment and DMARC policy enforcement across both platforms are essential to maintain consistent sender reputation.

What Is a Postfix Relayhost and How Does It Fit Here?

You use a Postfix relayhost to route all outgoing email through a trusted third-party service like Amazon SES or Mailgun instead of sending directly from your server. This improves deliverability, avoids blacklisting, and reduces infrastructure overhead. Postfix acts as a local mail gateway, forwarding messages through the relayhost based on rules you define.

Understanding the Role of Postfix and Relayhost

Postfix is a widely used open-source Mail Transfer Agent (MTA) responsible for handling the transmission of email. It listens for outgoing messages and applies rules before sending them over SMTP to their final destination. A relayhost is the intermediate server that Postfix forwards all outbound mail to—instead of connecting directly to recipient mail servers.

Using a relayhost like Amazon SES or Mailgun means your mail doesn’t originate from your server’s IP, which helps avoid deliverability issues tied to shared or poorly maintained IPs. This setup is common in environments where sender reputation is critical, like transactional mail or marketing campaigns.

How Conditional Routing Enables Hybrid Workflows

In a hybrid setup, Postfix doesn’t route all mail through SES or Mailgun indiscriminately. Instead, you define conditions—such as recipient domain, message content type, or volume thresholds—using transport maps. These maps tell Postfix: “Send emails to @gmail.com through SES, but route internal company emails directly.”

For example, you might route high-volume newsletters through SES and lower-priority administrative messages via your own server if they don’t require high throughput. This level of control optimizes cost, improves scalability, and aligns with best practices for sender reputation management.

According to RFC 5321, email routing should follow clear, predictable paths to avoid abuse. Using a relayhost aligns with this principle by centralizing outbound mail through a monitored, well-maintained service. Platforms like SES also enforce strict authentication (SPF, DKIM, DMARC), reducing the risk of spoofing and improving inbox placement.

Before relying on any email delivery system, verify your list. Invalid or risky addresses increase bounce rates and hurt sender reputation. Use tools like MailTester to validate your email list in bulk, test inbox placement, or integrate verification into your workflow via the API. You can start with 100 free verifications or explore pricing options tailored to your volume.

Verify your list and integrate real-time checking to ensure only valid addresses reach your relayhost—keeping your delivery rate high and your reputation clean.

How Does Postfix Relayhost Handle SES and Mailgun Separately?

You can route emails through AWS SES and Mailgun independently in Postfix using separate relayhost settings in transport maps, each with its own authentication (AWS IAM keys for SES, Mailgun API keys for Mailgun), endpoints (587 with STARTTLS for both), and rate limits. This lets you send transactional mail via SES and transactional or campaign emails via Mailgun, keeping their logs, tracking, and delivery behavior isolated and manageable.

Separate Auth and Endpoint Configuration

SES requires AWS credentials (access key and secret) and uses port 587 with STARTTLS. Mailgun uses an API key and can accept mail on port 587 or 2525. While both use standard SMTP authentication, the credential systems differ fundamentally. Misconfiguring these—using an API key where an AWS secret is expected—results in immediate rejection. Always validate credentials using tools like AWS SES documentation or Mailgun’s API reference.

Postfix doesn’t natively support multiple relay hosts per message; instead, it uses transport maps to determine which relay host applies based on sender, recipient domain, or other criteria. This routing happens before delivery, so you can direct all emails from [email protected] to Mailgun, while [email protected] flows through SES—separately and securely.

Granular Routing and Independent Management

Leveraging transport maps, you define rules like: “If the sender domain is yourcompany.com and the recipient is on a mailgun.com list, use the Mailgun relay.” This enables you to manage each service’s rate limits, sending reputation, and bounce tracking independently. For example, if Mailgun hits its daily throttle, only campaign emails are affected—transactional mail via SES keeps flowing.

Use this setup when you need different performance SLAs, analytics, or compliance controls. A high-volume e-commerce platform might use SES for order confirmations (low latency, low cost) and Mailgun for newsletters (rich tracking, A/B testing). This hybrid model isn’t just flexible—it’s scalable and resilient to provider-specific outages.

Always verify your email lists before sending to reduce bounces and protect sender reputation. MailTester’s bulk verification helps identify invalid, catch-all, or disposable addresses early—keeping your sending domains clean and trusted.

Set Up Your Hybrid Relayhost: Step-by-Step Process

You can run a Postfix relayhost setup using both Amazon SES and Mailgun by configuring SPF with both services via include, setting up a transport map to route emails by domain, enabling SASL authentication for each provider, and defining relayhost entries in main.cf. You’ll test the config with postfix check and monitor /var/log/mail.log for delivery status and authentication issues. This hybrid approach gives you redundancy and better deliverability for transactional and bulk mail.

DNS and Authentication Configuration

1. Update your SPF record to include both SES and Mailgun using the include mechanism. For example: v=spf1 include:amazonses.com include:mailgun.org ~all. This ensures both services are authorized to send on your behalf, reducing the risk of your emails being marked as spoofed.
2. Set up DKIM selectors separately for each provider. Use different selectors (like ses and mailgun) and publish the respective public keys in DNS under selector._domainkey.example.com. This allows recipient servers to verify authenticity from either service.
3. Create /etc/postfix/transport and define routing rules: for example, [email protected] smtp:[smtp.mailgun.org]. Run postmap transport to generate the map file used by Postfix.

Relayhost and SASL Setup

4. Enable SASL authentication for both SES and Mailgun by creating /etc/postfix/sasl_passwd with entries like:
   smtp.amazonses.com user:password
smtp.mailgun.org user:password. Then run postmap sasl_passwd.
5. Update main.cf to include: smtp_sasl_auth_enable = yes, smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd, and smtp_tls_security_level = may (or may for opportunistic TLS).
6. Define relayhost entries. Use relayhost = [smtp.amazonses.com]:587 as the default, and add conditional routing in the transport map or use smtp_generic_maps for domain-based rules.
7. Test the configuration with postfix check. If no errors, reload Postfix with systemctl reload postfix to apply changes.
8. Monitor /var/log/mail.log for authentication failures, connection issues, or delivery status. Use tools like MXToolbox to check DNS records and ensure your SPF and DKIM are correctly published.

For high-volume sending, validate your list ahead of time to reduce bounce rates and improve reputation. Use MailTester’s bulk verification to clean your list and catch invalid or risky addresses before sending. This ensures each send contributes positively to your sender reputation.

Critical Setup Considerations for Sender Reputation

You can’t hybridize Postfix relayhost through SES and Mailgun without managing SPF, DKIM, and sending behavior carefully. Mixing both services in one SPF record risks alignment failures, while shared keys or erratic sending patterns can damage reputation across both. Treat them as separate senders: independently aligned, independently monitored.

SPF and DKIM: Keep Them Isolated

• Do not combine SES and Mailgun in a single SPF record unless you use include:amazonses.com and include:mailgun.org with a redirect=none mechanism. A single SPF record with both can break alignment, especially if one service is not authorized to send from the other's IP.
• Use separate DKIM keys for SES and Mailgun. This allows you to rotate keys independently, and prevents a compromise on one from affecting the other. If one key is exposed, you can revoke it without impacting the other’s deliverability.
• Always verify SPF alignment using tools like MXToolbox or RFC 7208, which defines how SPF checks are performed. Misalignment leads to rejected or marked emails.

Maintain Clean Sending Behavior

• Use distinct From addresses or domains for SES and Mailgun. Sending through both from the same domain — even with different sender identities — can lead to cross-contamination if one suffers a reputation hit.
• Monitor volume trends. Sudden spikes from either service can trigger throttling. SES, for instance, enforces rate limits (e.g., 14 messages per second per IP), while Mailgun applies similar limits. Sudden changes in volume signal spam behavior.
• Check inbox placement regularly. Use tools like inbox placement testing to verify real-world delivery. Even with correct headers, poor engagement or high feedback loops can trigger filters.
• Don’t reuse the same email list across both services without verifying list health. A list with high bounce or complaint rates on one platform can drag down the reputation of both if they share sender reputation signals.

Finally, ensure you’re verifying your email lists regularly. A single bad address can harm a campaign, and unchecked lists grow stale. Use bulk verification to clean outdated or invalid addresses before sending. Keep your sender reputation clean from the ground up.

How MailTester Improves Your Hybrid Send Strategy

You can significantly reduce bounce rates, protect sender reputation, and improve inbox placement in a Postfix relayhost setup using SES and Mailgun by verifying your email list upfront and testing deliverability in real-world conditions. MailTester’s 98.9% accuracy catches invalid, role, disposable, and catch-all addresses before they’re sent, preventing spam traps and wasting send volume.

Prevent Bounces and Protect Reputation with Bulk Verification

Before sending to your hybrid setup, scrub your list with MailTester’s bulk verification. Invalid addresses, disposable domains, and catch-all setups will fail before they ever hit Mailgun or SES. This reduces hard bounces—common when sending to non-existent or role-based addresses like [email protected]. A single bounce from a bad address can impact your sender reputation, especially on platforms like Amazon SES, which monitor feedback loops closely.

Let’s be clear: you don’t want to send to a user who doesn’t exist. MailTester identifies these with precision, meaning fewer rejected messages and a cleaner sender score. Industry best practices—like those from RFC 5321—emphasize the importance of validating recipients before submission. Skipping validation increases risk. MailTester makes that validation scalable and consistent.

Real-Time Check and Inbox Placement Testing for Better Delivery

During user signups or list updates, use the real-time verification API to validate each address as it’s added. This stops problematic emails from ever entering your pipeline. No more accidental captures by spam traps or disposable domains used for account harvesting.

Then, test how well your campaigns land. Use MailTester’s inbox placement to see how emails from Mailgun and SES actually perform across Gmail, Outlook, and other providers. You’ll catch issues like filtering, subject line triggers, or low sender trust scores before your full campaign launches. This step is more effective than relying solely on internal logs or provider dashboards—which only show delivery, not inbox placement.

MailTester’s 98.9% accuracy isn’t just a number—it means it flags risky patterns early. Catch-all domains may deliver, but they often generate soft bounces or are flagged as suspicious. By catching these before sending, you avoid long-term deliverability decay caused by low engagement or repeated failures.

The result? A smoother hybrid workflow where SES handles transactional reliability and Mailgun manages campaigns—both improved by clean, verified data and real-world inbox testing.

Common Pitfalls and How to Avoid Them

You're using Postfix with both SES and Mailgun as relayhosts? Great. But mixing them without care can break delivery, spike bounces, or trigger spam filters. Avoid SPF conflicts, DKIM clashes, misconfigured credentials, and quota surprises by following these specific, actionable steps. Let’s get it right.

SPF and DKIM Conflicts

• Don’t stack multiple SPF records. Use one TXT record with include mechanisms only. Over 255 characters breaks validation—keep it under the limit defined in RFC 4408.
• Never use the same DKIM selector (like default) for both SES and Mailgun. If you do, signatures conflict, and some receivers reject your mail. Use distinct selectors (e.g., ses, mg) or separate domains for signing.

Security and Monitoring

• Store your relayhost credentials in /etc/postfix/sasl_passwd with strict permissions: chmod 600 /etc/postfix/sasl_passwd. Never leave them readable by others—plaintext exposure invites abuse.
• Monitor each service’s sending limits. SES has a default 14,000 messages per 24-hour period with sandbox mode, while Mailgun enforces daily quotas. Exceeding these blocks delivery. Use logging (e.g., smtpd_tls_session_cache_database) to track usage and adjust load timing.
• Verify your email list regularly. Invalid or non-deliverable addresses hurt sender reputation. Use bulk verification tools like MailTester’s list verification to clean your database before sending.

Remember: a hybrid relay setup works only if configured with precision. Each misstep—whether in DNS, file permissions, or rate limits—directly impacts inbox placement. Test your setup with real inboxes. Use tools like MailTester’s inbox placement tester to simulate delivery across Gmail, Outlook, and others.

When you’re done, check that you’re not relying solely on one provider. Distribute volume, manage feedback loops, and keep your reputation clean—one verified email at a time.

How to Monitor and Troubleshoot Deliverability

You need real-time visibility into delivery status, logs, and error codes. Use Postfix’s built-in tools like mailq to spot stuck messages, enable delivery notifications from SES and Mailgun, and parse their logs or webhooks to catch bounces and rejections. Then test actual inbox placement with tools like MailTester to see how your emails land in Gmail, Outlook, and Apple Mail — adjusting content or structure to reduce spam flags before sending to live audiences.

Track messages and delivery status

• Check mailq regularly to spot messages stuck in Postfix’s queue — a sign of delayed delivery or policy issues.
• Use postsuper -d to manually remove undeliverable messages from the queue when needed.
• Enable receipt notifications in AWS SES and Mailgun to confirm when messages are accepted by their servers.
• Monitor SES Delivery Reports and Mailgun’s Webhook logs to capture bounce reasons (e.g., 550 No such user) and SMTP error codes for debugging.

Test and refine inbox placement

• Use MailTester’s inbox placement tester to simulate how your email lands in top inboxes like Gmail, Outlook, and Apple Mail — see real-time spam scores and delivery results.
• Review the results: low scores or spam flags usually point to content issues like excessive HTML, suspicious links, or missing sender authentication.
• Adjust message content or structure (e.g., remove trigger phrases, fix image-only layouts) and re-test before full deployment.
• For larger campaigns, run bulk list verification first with MailTester’s email list verify to clean out invalid or risky addresses.

Deliverability isn’t set-and-forget. The key is continuous validation. Tools like Postfix’s logging and SES/Mailgun’s reporting give you the raw data; MailTester helps turn that data into actionable insight. A message that passes SPF and DKIM can still end up in spam. Only inbox testing reveals that. And it’s not just about avoiding bounces — it’s about building trust with inbox providers.

Proper monitoring turns reactive fixes into proactive improvement. You’re not just sending emails; you’re managing reputation.

Refer to RFC 5322 for standard email format and deliverability expectations, and explore official documentation from AWS or Mailgun for SMTP error code meanings. Use your verification API for automated list cleansing, and integrate directly with platforms like Mailchimp or SendGrid via MailTester’s integrations for end-to-end reliability.

Comparison of Real Email Services in a Hybrid Setup

You can use AWS SES as a relayhost for high-volume transactional emails with strong authentication via AWS IAM, while running Mailgun for campaigns and analytics via API or SMTP—each excels in its domain. SendGrid is better suited for automated workflows with dynamic templates, and Brevo offers full-stack control with enterprise routing and dashboards. Let’s break down what each excels at, how they authenticate, and when you should use them.

Service Capabilities in Practice

When setting up a hybrid relayhost system, your choice of service affects deliverability, cost, and operational control. AWS SES is optimized for predictable, high-volume transactional flows—ideal for user registration, password resets, or order confirmations. It uses AWS IAM credentials for secure access and requires strict SPF/DKIM alignment for sender reputation.

Mailgun shines when you need deep campaign analytics and reliable SMTP delivery for newsletters or event reminders. It supports both API key and SMTP authentication with TLS, enabling secure integration into systems that rely on standard email protocols.

SendGrid excels in automation workflows, especially when you need dynamic content templating or multi-step triggered emails. It accepts API keys or SMTP with TLS, and its infrastructure scales well for time-sensitive, content-rich campaigns.

Brevo (formerly Sendinblue) offers a unified platform with email, SMS, and CRM features. It supports both API key and SMTP authentication, making it suitable for teams managing full customer journeys from welcome sequences to retention campaigns.

For any hybrid setup, you’ll want to validate sender domains, maintain strong SPF/DKIM alignment, and monitor feedback loops. Misconfigured authentication is a common cause of bounce rates above 5% in transactional flows.

Before sending, verify your lists to avoid hard bounces from invalid or non-existent addresses. You can test your sender reputation and inbox placement with inbox placement tools or validate large lists using bulk verification. The API integrates easily into workflows, while integrations with platforms like SendGrid or Mailgun let you run checks inline. Credits you buy never expire—there’s no pressure to use them fast. Learn more about pricing at our pricing page.

Best Practices for Long-Term Stability

You can keep your Postfix relayhost setup with SES and Mailgun stable over time by routing traffic by purpose, cleaning your lists before sending, rotating DKIM keys, and monitoring both services’ limits. These steps reduce bounce rates, avoid throttling, and maintain sender reputation. Let’s break down how.

Domain and Traffic Segregation

• Assign dedicated subdomains for transactional and marketing mail: use mail.transact.example.com and mail.mkt.example.com for clear traffic separation.
• Configure separate SPF records and DKIM selectors per subdomain to avoid conflicts and improve deliverability attribution.
• Use RFC 5321 compliance as a baseline for SMTP routing rules — this ensures compatibility with major email providers.

Verification and Ongoing Maintenance

• Run your email lists through MailTester before sending. Bulk verification identifies invalid addresses and catch-alls, reducing bounce rates by up to 70% in practice — a common issue with unverified lists.
• Use MailTester’s bulk verification tool to clean high-volume lists and detect disposable domains.
• Rotate DKIM keys every quarter. This reduces the risk of long-term key exposure and strengthens long-term security posture.
• Check both SES and Mailgun dashboards daily for warning messages about delivery rates, complaint ratios, or volume spikes. Reduce sending volume proactively when limits approach.
• Set up automated alerts for sudden increases in bounces or spam complaints — these are early indicators of list or authentication drift.
• Test inbox placement with MailTester’s inbox tester quarterly to verify that your messages reach primary inboxes across Gmail, Outlook, and Apple Mail.

Consistent list hygiene and strict authentication control are not optional — they’re baseline requirements for sustained deliverability.

If you’re using email marketing tools like Mailchimp, HubSpot, or Klaviyo, leverage MailTester’s integrations to plug verification into your workflow before campaigns launch. You can run 100 free verifications at no cost — no expiry, no trial limits. That’s enough to test your first list and refine your process. Once you’re confident, scale with paid credits. Keep your reputation intact.

Conclusion: A Flexible, Resilient, and Deliverable System

Combining Postfix as a relayhost with AWS SES and Mailgun as hybrid backends delivers the scale of cloud infrastructure, the visibility of detailed delivery analytics, and the granular control of SMTP routing—without vendor lock-in.

Routing outbound mail through multiple providers separates workload risks. If one provider hits rate limits or faces temporary blacklisting, the other continues handling mail. This design protects sender reputation and ensures consistent deliverability across high-volume campaigns.

Pair this architecture with regular list hygiene—verified via MailTester’s bulk verification and inbox testing—and you reduce bounce rates, avoid spam traps, and maintain strong inbox placement. This isn’t a shortcut. It’s a deliberate, scalable approach to reliable, compliant email delivery.

Sources

• In their first week of sending, warmed-up inboxes achieve 91.3% inbox placement versus 68.4% for unwarmed inboxes — a 22.9-point gap, based on data from 833K+ managed inboxes. — MailDeck Cold Email Warm-Up Study (833K+ inboxes) (2026)
• Warming up a new domain for 4–6 weeks before full-volume sending reduces spam placement by up to 35%. — Lemlist data (via WarmForge deliverability statistics) (2025)

Keep reading

• Sender reputation, IP warm-up and sending infrastructure (complete guide)
• Best Practices for Evaluating Sender Reputation Across Multiple Email Verification Signals
• Cloudmark Reputation Lookup API for Real-Time Sender Risk Assessment
• Microsoft 365 Internal Email Sender Score Analyzer 2026
• Shared IP Pool Impact on ESP Spam Filter Ratings in 2026

Keep reading

• Mailgun vs Amazon SES Setup Complexity for Developers in 2026
• Step-by-Step DNS Setup for Email Sending with AWS SES
• SPF Record Setup for Amazon SES Email Deliverability
• SPF Record Setup for AWS SES in 2026

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use both SES and Mailgun with the same Postfix installation?

Yes, Postfix supports multiple relay hosts through transport maps, allowing you to route traffic based on content, domain, or volume to SES, Mailgun, or other services.

What happens if one relay host fails?

Postfix automatically retries delivery based on default retry policies. Failures to one service won’t block the other, as long as transport routing is properly configured.

Do I need separate From addresses for SES and Mailgun?

We recommend using separate From addresses or domains to avoid cross-contamination of sender reputation and ensure proper SPF/DKIM alignment.

How do I avoid exceeding SES or Mailgun sending limits?

Monitor daily sending volume via the respective dashboard. Use queuing or rate-limiting via Postfix’s smtp_destination_rate_delay and retry mechanisms to stay within thresholds.

Is a hybrid setup more complex than a single provider?

Yes—setup requires more configuration, especially around routing, DNS, and authentication. But it offers greater reliability and flexibility at scale.

Can MailTester help with hybrid send testing?

Yes. Use MailTester’s inbox-placement testing to validate how messages sent via SES or Mailgun land in real inboxes, and verify your list to prevent bounces and spam traps.

How often should I verify my email list?

Verify lists before major campaigns and maintain a continuous hygiene process. For large lists, use the bulk verification API for 98.9% accurate screening.

What’s the risk of using a catch-all domain in my list?

Catch-all domains accept any email, increasing bounce and spam rates. They often lead to soft bounces, spam traps, or reputation damage. Use MailTester to detect them early.

Do I need a custom domain for Mailgun and SES?

Yes. Both services require domain authentication via TXT records and SPF/DKIM setup to prevent spoofing and ensure delivery.

Can I integrate MailTester with Postfix directly?

Not directly, but MailTester’s real-time API and bulk verification tools make it easy to clean lists before Postfix sends, improving overall deliverability.

Are disposable email addresses dangerous for send campaigns?

Yes—disposable domains are often associated with spam traps or low engagement. Use MailTester to detect and remove them before sending.

How do I test if my hybrid setup is working?

Send test messages to external domains, check Postfix logs for relayhost routing, and use MailTester’s inbox tests to confirm delivery and inbox placement.