Mailjet SMTP test — API key and secret key on port 587

Mailjet provides SMTP relay at in-v3.mailjet.com on port 587 with STARTTLS (or port 465 with implicit TLS, or port 25 without encryption). The SMTP username is your Mailjet API key and the password is your secret key, both found on the API keys page of the dashboard.

Recommended settings

Port 587 with STARTTLS is the default choice. Use port 465 if your network blocks outbound 587. Port 25 works but is more likely to be filtered by intermediate networks, so treat it as a last resort.

Finding your credentials

1. Log in to the Mailjet dashboard.
2. Open the account settings and find the API keys page.
3. Copy the API key (public) and reveal the secret key.
4. The API key is the SMTP username; the secret key is the SMTP password.

These are the same credentials used for the Mailjet REST API (v3/v3.1). Unlike some providers, Mailjet does not issue separate SMTP-only credentials. One pair covers both interfaces.

Why Mailjet uses an API key and secret key pair

Most SMTP servers expect a single password tied to a mailbox. Mailjet instead authenticates you as an API consumer: the API key identifies the account, and the secret key proves you are allowed to send from it. This has three practical consequences:

• There is no "SMTP password" separate from your dashboard login password. If you type your Mailjet account password into the password field, authentication fails with a 535 error.
• The secret key carries full API permissions, not just SMTP send. Anyone holding it can read campaign data through the REST API.
• Regenerating the pair invalidates both values at once. Any application using the old pair stops authenticating until you update it.

Testing with SMTP Tester

1. Host: in-v3.mailjet.com, port 587, security STARTTLS.
2. Username: your API key. Password: your secret key.
3. From: a verified sender address or an address on a verified domain.
4. To: any recipient (or your own address to verify delivery).
5. Click Run. A 235 2.7.0 OK response confirms authentication.
6. A 250 OK after DATA means Mailjet accepted the message for delivery.

Run the test in handshake-only mode first if you just want to confirm credentials without delivering a message. Switch to a full send to verify that Mailjet accepts the From address and check where the message lands in your inbox.

Reading the transcript

Each stage of the conversation tells you something specific:

• Connect and STARTTLS: the server greets with 220 and advertises STARTTLS after EHLO, then the connection upgrades to TLS.
• AUTH: 235 2.7.0 OK means the API key and secret key pair was accepted. A 535 here points at the credential problems listed below.
• MAIL FROM / RCPT TO: 250 responses mean Mailjet accepts your sender and recipient. A rejection at MAIL FROM is almost always the sender-validation issue described later.
• DATA: the server returns 354 (go ahead), then 250 after the message body, meaning Mailjet queued the email.

If authentication succeeds but a later stage fails, the error is about senders, recipients, or account policy rather than credentials.

Common errors

535 "Authentication failed"

• Using your account login password: the SMTP password is the secret key from the API keys page, not your Mailjet login password.
• Swapped username and password: the API key (shorter, public) is the username; the secret key (longer) is the password.
• API key deactivated: if you regenerated credentials, the old pair no longer works.
• Sub-account credentials: if you use Mailjet sub-accounts, each has its own API/secret key pair. Use the credentials from the correct sub-account.

550 "Sender not allowed" / "Sender address rejected"

The From address is not validated in your Mailjet account. Options:

• Add a sender: in the dashboard, add the address under sender addresses and click the validation email Mailjet sends to it.
• Verify a domain: add the domain, publish the SPF and DKIM records, and wait for the DNS check to pass.

Mailjet requires sender validation to prevent abuse, so there is no way to skip this step. The SMTP test will authenticate fine (235) and then fail at MAIL FROM until the sender is confirmed.

421 "Service temporarily unavailable" / rate limiting

Mailjet throttles sending based on your plan and account reputation. New accounts start with a conservative burst rate that increases as bounce and spam-complaint rates stay low. A 421 with a retry hint means the server asked you to slow down: back off and retry after a pause, and make sure your application honors retry intervals rather than hammering the relay.

Connection timeout

• Ensure you are using in-v3.mailjet.com (not legacy hostnames).
• Port 587 is standard. Try 465 if your network blocks 587.
• Port 25 works but sends credentials in the clear if STARTTLS is not enforced. Avoid it.

Sender validation vs domain authentication

Mailjet offers two levels of sender control:

• Validated sender address: an individual email address confirmed by clicking a validation link Mailjet emails to that address. Quick to set up, suitable for testing and small applications. Any other address on the same domain still gets rejected.
• Authenticated domain: you prove ownership of a domain with DNS records (SPF and DKIM, described below). Once the domain is verified, any local part on that domain can send, and Mailjet signs messages with DKIM automatically.

Sender-address validation answers "may this exact address send?" Domain authentication answers "does this organization control the domain?" For production workloads, authenticate the domain. Individual sender validation is fine for the initial SMTP test.

SPF and DKIM records for Mailjet

When you add a sending domain in the Mailjet dashboard, the domain management page shows the DNS records to publish:

• SPF: an SPF record that includes Mailjet's sending infrastructure, typically a TXT record on the domain such as v=spf1 include:spf.mailjet.com ~all. Merge it into an existing SPF record if you already have one, since a domain may only publish a single SPF record.
• DKIM: a TXT record under a selector hostname that Mailjet specifies on the same page. The exact selector and value are generated per domain, so copy them from the dashboard rather than reusing a record from another provider.
• Validation record: Mailjet may also require a lightweight TXT record to confirm domain ownership before DKIM verification can complete.

After publishing the records, trigger the DNS check in the dashboard. Propagation can take anywhere from minutes to several hours depending on your DNS provider's TTL. Once DKIM verifies, Mailjet signs messages sent over SMTP, which improves inbox placement at providers that expect authenticated bulk mail.

DMARC is optional but worth adding once SPF and DKIM are in place, so that unauthenticated mail spoofing your domain gets rejected rather than delivered.

Mailjet SMTP headers

Beyond the standard envelope, Mailjet reads custom headers to control tracking, campaigns, and templating. These work over plain SMTP, so you can use them from any library:

A minimal example that attaches a message to a campaign and tags it for webhook correlation:

X-Mailjet-Campaign: onboarding-2026-08
X-MJ-CustomID: signup-4821
X-MJ-EventPayload: {"plan": "pro"}

Template variables and X-MJ-TemplateID are more natural fits for the REST API, but they work over SMTP when you want one code path for everything.

Testing with nodemailer

A minimal Node.js script using the same settings:

import nodemailer from "nodemailer";

const transport = nodemailer.createTransport({
  host: "in-v3.mailjet.com",
  port: 587,
  secure: false, // STARTTLS on 587
  auth: {
    user: process.env.MAILJET_API_KEY,
    pass: process.env.MAILJET_SECRET_KEY,
  },
});

await transport.sendMail({
  from: "test@your-verified-domain.com",
  to: "you@example.com",
  subject: "Mailjet SMTP test",
  text: "Sent via in-v3.mailjet.com on port 587.",
  headers: {
    "X-Mailjet-Campaign": "smtp-test",
  },
});

console.log("accepted by Mailjet");

For port 465, set secure: true. The headers block is where Mailjet's extension headers go. If transport.verify() passes but sendMail() fails, the credentials are fine and the problem is the sender address or account status.

Sandbox and restricted accounts

New Mailjet accounts may have sending restricted to verified recipient addresses until the account is reviewed. If sends fail with a policy error after successful AUTH, check your account status in the dashboard. You may need to complete identity verification or contact Mailjet support before the relay accepts messages to arbitrary recipients.

Mailjet SMTP vs REST API

Both interfaces use the same API key / secret key pair:

• SMTP (in-v3.mailjet.com): works with any SMTP client. Good for WordPress plugins, application frameworks, and legacy systems.
• REST API (api.mailjet.com/v3.1/send): richer feature set, including templates, personalization, bulk sending, and scheduling.

For credential testing and connection debugging, SMTP Tester shows the full SMTP conversation, which is useful for confirming your setup before integrating with the REST API.

Sending limits and rate limits

Mailjet separates volume limits from burst rate:

• Volume: the free plan allows 200 emails per day and 6,000 per month. Paid plans raise the monthly volume by tier.
• Burst rate: how fast Mailjet accepts messages per second, governed by account reputation. New accounts are throttled harder.
• Recipients per message: each To, Cc, and Bcc address counts against your volume.

Check your current limits and usage in the account overview section of the dashboard. If you regularly hit throttling, batch sends through a queue rather than sending inline from request handlers.

Sending from WordPress

The most common path is the WP Mail SMTP plugin:

1. Install and activate WP Mail SMTP, then open the plugin settings.
2. Choose "Other SMTP" as the mailer.
3. SMTP host: in-v3.mailjet.com. Encryption: TLS (STARTTLS). Port: 587.
4. Enable authentication. Username: your API key. Password: your secret key.
5. Set the From Email to a validated sender address or an address on your authenticated domain, and force the From Email so WordPress does not substitute the site default.
6. Save and use the plugin's email test to send a message to yourself.

The usual WordPress failure mode is the From address: the plugin defaults to wordpress@yourdomain.com, which Mailjet rejects with 550 unless the domain is authenticated. Fixing sender validation clears most of these errors. If the password field misbehaves because the secret key contains special characters, define the credentials as constants in wp-config.php.

Security notes

• The secret key grants both SMTP and full API access. Treat it as a sensitive credential.
• Do not commit API keys or secret keys to version control. Use environment variables.
• Regenerate credentials if compromised. Both the API key and secret key change together.
• SMTP Tester redacts your password (secret key) from the live transcript.
• Consider creating a sub-account with limited permissions for applications that only need sending access, and rotate the sub-account keys independently.

Related guides

• What is an SMTP test? covers the handshake stages in general terms.
• SMTP port 587 vs 465 explains which port and encryption mode to pick.
• Fixing SMTP authentication error 535 walks through the 535 error step by step.
• For another API-key-as-password relay, see the SendGrid SMTP test and Mailgun SMTP test guides.

Frequently asked questions

Do I need two credentials instead of one password?

Yes. Mailjet always authenticates SMTP with the API key as the username and the secret key as the password. There is no SMTP-specific password and no way to authenticate with your dashboard login.

Can I create separate credentials for SMTP and the REST API?

No. One key pair covers both interfaces on a given account. To limit what an application can do, create a sub-account (availability depends on your plan) and use its key pair. Sub-account keys can be regenerated independently without touching your primary account.

What is a Mailjet sub-account and how do its keys work?

A sub-account is a secondary Mailjet account nested under your primary one, with its own API key, secret key, sender validation, and statistics. Teams use them to isolate products or environments: staging gets its own pair, production gets another. Credentials from one sub-account do not work against another, which is worth remembering when a 535 error appears after switching environments.

Why does authentication pass but sending fail with "sender not allowed"?

Mailjet validates the From address independently of credentials. A valid key pair proves who you are; a validated sender address or authenticated domain proves what you may send as. Complete one of the two in the dashboard and the MAIL FROM stage will return 250.

How fast can I send, and what happens if I exceed the rate?

Burst rate depends on your plan and reputation, and it is lower for new accounts. When Mailjet throttles you, the server returns a 421 with a retry indication rather than dropping the message silently. Implement retry with backoff on that response and queue messages instead of sending them synchronously.

Can I test my Mailjet setup without sending a real email?

Yes. Run SMTP Tester in handshake-only mode: it connects, upgrades to TLS, authenticates, and closes without transmitting a message. To check sender validation, run a full test addressed to yourself and confirm delivery.