SendGrid SMTP test: apikey user and port 587

SendGrid's SMTP relay is at smtp.sendgrid.net on port 587 with STARTTLS (or port 465 with implicit TLS, or port 2525 as an alternative when 587 is blocked). Unlike most providers, the SMTP username is the literal string apikey (not your email address), and the password is a SendGrid API key that has the "Mail Send" permission enabled.

Getting these two values right accounts for most of the debugging people do with SendGrid SMTP. If you are new to the testing workflow itself, start with what an SMTP test is and what it checks, then come back here for the SendGrid-specific settings.

Recommended settings

Creating a scoped API key for SMTP

SendGrid (now part of Twilio SendGrid) uses API keys for everything, including SMTP. Use a restricted key rather than full access:

1. Log in to the SendGrid dashboard.
2. Go to Settings → API Keys → Create API Key.
3. Name the key (e.g. "SMTP Tester") and select "Restricted Access".
4. Under Mail Send, enable "Mail Send" (the only permission SMTP needs).
5. Click Create & View. Copy the key immediately, since SendGrid only shows it once.
6. Use this key as the SMTP password. The username is always apikey.

A restricted key with only Mail Send enabled can authenticate and relay mail, but it cannot read activity data, manage templates, or touch account settings. That limits the blast radius if the key leaks. Full Access keys work over SMTP too, but there is no reason to use them for a mail relay.

Two details trip people up:

• The API key starts with SG. and is roughly 69 characters long. Copy it with the copy button, not by hand-selecting text, since a missing character silently breaks authentication.
• The password field is the entire key, including the SG. prefix. Do not trim or quote it.

Do not use your SendGrid account password or your Twilio master account password. Those will not authenticate over SMTP.

Two-factor authentication (2FA)

When 2FA is enabled on a SendGrid account, ordinary username/password logins over SMTP stop working. This is by design: SMTP basic auth has no way to answer a second-factor challenge. The fix is exactly what SendGrid intends: use an API key instead. API keys are independent of 2FA and continue to work after you turn on two-factor authentication for the account.

In practice this means:

• Enable 2FA on the account (SendGrid requires it for most accounts anyway).
• Create a scoped API key as described above.
• Use apikey + the API key for all SMTP clients. Never reuse the account login.

If you previously tested with the account password and it worked, then stopped after 2FA was enabled, the account credentials are the problem, not the network or the port.

Sender verification: single sender vs domain authentication

SendGrid refuses to relay mail from an unverified From address, even when authentication succeeds. You have two options:

• Domain Authentication (recommended): add three CNAME records to your DNS. This sets up DKIM signing and makes your domain the envelope sender, improving deliverability. SendGrid shows the exact records and a verification button; DNS propagation usually completes within minutes to a few hours.
• Single Sender Verification: verify an individual email address by clicking a confirmation link. Acceptable for testing but not recommended for production, because single senders cannot DKIM-sign under your domain and recipients see sendgrid.net infrastructure in the headers.

Without either, SendGrid responds with a 550 after AUTH even though the credentials are valid. If you only send test mail from one address, single sender verification is the fastest path; if anything will go to real recipients, authenticate the domain first.

Domain authentication also covers SPF alignment: SendGrid publishes include records you add to your SPF, so mailbox providers see the return-path, DKIM, and From domain all pointing at your domain. That combination is what keeps legitimate mail out of spam folders.

Testing with SMTP Tester

1. Set host to smtp.sendgrid.net, port 587, security STARTTLS.
2. Username: apikey. Password: paste your API key.
3. From: an address on a domain you have verified in SendGrid (Sender Authentication).
4. To: any recipient (or your own address to verify delivery).
5. Click Run. A successful test shows 235 Authentication successful followed by 250 Ok with a message ID after DATA.

Reading the transcript stage by stage:

• EHLO: the server advertises STARTTLS and AUTH PLAIN/LOGIN.
• STARTTLS + TLS handshake: encryption is established before any credentials move.
• AUTH: SendGrid returns 235 Authentication successful for a valid apikey + key pair. A 535 here means the credentials are wrong (see below).
• MAIL FROM: the first place a sender-identity mismatch shows up. 550 The from address does not match a verified Sender Identity means auth passed but the From address is not authorized.
• DATA + 250 Ok: SendGrid accepted the message. The response includes a message ID you can search for in the Email Activity feed.

If you want a handshake-only check (credentials and TLS without sending a message), enable that mode in SMTP Tester. It stops after AUTH, which is enough to confirm the API key works.

Common errors

535 "Authentication failed" / "basic authentication is not allowed"

The most frequent SendGrid SMTP error. Causes:

• Wrong username: the SMTP username must be the literal string apikey, not your email address or Twilio SID.
• Wrong password: the password must be a SendGrid API key (starts with SG.), not your account login password.
• 2FA on the SendGrid account: once Two-Factor Authentication is enabled, basic username/password login is blocked. You must use an API key instead, which is the correct approach anyway.
• Key lacks Mail Send permission: if the API key was created with restricted access but "Mail Send" was not enabled, authentication succeeds but sending fails. Recreate the key with the correct scope.
• Truncated or stale key: if your client or config file truncated the key, auth will fail. Paste the full key. If you deleted or regenerated the key in the dashboard, the old copy stops working immediately.

For a provider-agnostic walkthrough of every 535 variant, see fixing SMTP authentication error 535.

550 "The from address does not match a verified Sender Identity"

Authentication worked, but SendGrid rejected the message because the From address is not authorized. Fix: go to Settings → Sender Authentication and either verify the exact email address as a Single Sender, or authenticate the full domain via DNS (CNAME records). Re-run the test with an address covered by the verification you just completed.

451 "Temporarily unavailable, please try again"

SendGrid is throttling or rate-limiting the connection. Causes include exceeding your plan's sending rate, a burst of messages in a short window, or the account being flagged for review. Check your SendGrid dashboard for alerts, back off, and retry.

Connection timeout on port 587

Some networks and cloud providers block outbound port 587. SendGrid also accepts SMTP on port 2525 (STARTTLS) and port 465 (implicit TLS). Switch to one of those if 587 times out. The trade-offs between the two TLS modes are covered in SMTP port 587 vs 465: STARTTLS or implicit TLS?.

SendGrid sending limits

Limits depend on your plan. Lower tiers cap messages per day or per month, and paid tiers raise the ceiling and add burst capacity. When you exceed a limit, SendGrid either returns a 451 temporary rejection or queues the mail, so a test that passed yesterday can fail today without any config change.

Two checks when sending suddenly fails:

• Look at your usage in the SendGrid dashboard. A scheduled job or a retry loop in your application can exhaust the quota silently.
• Open the Activity Feed and search for the message ID returned by a successful SMTP test to confirm whether SendGrid accepted and delivered it.

Nodemailer example

The same credentials work in any SMTP library. A minimal Node.js example with nodemailer:

import nodemailer from "nodemailer";

const transport = nodemailer.createTransport({
  host: "smtp.sendgrid.net",
  port: 587,
  secure: false, // STARTTLS on 587; use true with port 465
  auth: {
    user: "apikey",           // literal string, not your email
    pass: process.env.SENDGRID_API_KEY,
  },
});

await transport.sendMail({
  from: "hello@your-verified-domain.com",
  to: "you@example.com",
  subject: "SendGrid SMTP check",
  text: "Sent via smtp.sendgrid.net:587",
});

Store the key in an environment variable, not in the source file. To verify credentials without sending anything, await transport.verify() performs the connect, TLS, and AUTH steps only, which mirrors the handshake-only mode in SMTP Tester.

WordPress (WP Mail SMTP) setup

WordPress sites frequently end up on SendGrid because the default wp_mail() path via PHP mail() is unreliable. With the WP Mail SMTP plugin:

1. Choose "Other SMTP" as the mailer.
2. SMTP Host: smtp.sendgrid.net.
3. Encryption: TLS with port 587 (or SSL with port 465).
4. Username: apikey.
5. Password: your SendGrid API key.
6. From Email: an address covered by your Sender Authentication, and enable "Return Path" so bounces align with the same address.

If the plugin reports authentication errors, recheck that the username is exactly apikey. WP Mail SMTP, like every other SMTP client, treats it as an opaque username string.

API key vs SMTP credentials

SendGrid does not issue separate "SMTP credentials" like some providers. The same API key used for the REST API (v3 Mail Send) also works for SMTP, just using apikey as the username. If you see references to "SMTP credentials" in legacy docs or forum posts, they are referring to the old username/password system that has been deprecated. Always use an API key.

Related: SMTP port 587 vs 465: STARTTLS or implicit TLS? explains which port and encryption mode to pick, and fixing SMTP authentication error 535 walks through the 535 error above step by step. For a similar key-pair credential model, see the Mailjet SMTP test guide. If you compare relays before committing, the SMTP Tester vs smtper.net overview covers how transcript-based testing differs from other web-based testers.

Security notes

• Never commit API keys to version control. Use environment variables or a secrets manager.
• Rotate keys regularly and revoke unused ones in the SendGrid API Keys settings.
• Scope keys narrowly: "Mail Send" only is sufficient for SMTP, and a leaked send-only key cannot read your activity data or account settings.
• SMTP Tester redacts your password from the live transcript, so screenshots are safe to share.
• Use STARTTLS or TLS on every connection. Plain port 25 sends credentials unencrypted.

Frequently asked questions

Why is the SMTP username literally "apikey"?

SendGrid abandoned per-account SMTP usernames years ago and moved to API keys for all mail sending. Because an API key alone is the secret, the relay needs a fixed username slot, so SendGrid reserves the literal string apikey for it. Every SendGrid account uses the same username; the API key in the password field identifies you.

Can I use my SendGrid account password as the SMTP password?

No. Account passwords (and Twilio login passwords) are rejected over SMTP with a 535 error. The only accepted password is an API key starting with SG.. If 2FA is enabled, account passwords are blocked from SMTP entirely.

Do I need a different API key for SMTP vs the REST API?

No. One key works for both, as long as it has Mail Send permission. Many teams create a separate restricted key for SMTP anyway, so rotating or revoking the web app's key does not break the mail relay.

Why does my test pass but messages land in spam?

Authentication and delivery are different problems. A 250 response means SendGrid accepted the message, not that the recipient's inbox trusted it. Spam placement usually traces back to missing domain authentication (no DKIM alignment), an unauthenticated shared sending setup, or content and reputation issues. Complete Domain Authentication with the CNAME records, keep your sending volume consistent, and test again from a mailbox on a major provider.

Does the Free plan include SMTP access?

Yes. Every SendGrid plan includes the SMTP relay at smtp.sendgrid.net; what differs between plans is the sending quota and features like dedicated IP addresses. Check your current plan's limits in the dashboard rather than assuming a fixed number.

Port 2525 worked but 587 did not. Is that a problem?

No, it means something between you and SendGrid (often a cloud provider or corporate firewall) blocks outbound 587. Port 2525 offers the same STARTTLS flow, and 465 offers implicit TLS. All three are supported; pick whichever your network allows.