Fix SMTP 535 Error in Mailgun | Emaillistchecker.io

Why does SMTP 535 authentication denied happen in Mailgun with token refresh?

You're automating email sends via Mailgun SDK. Everything works for 30 days. Then, without warning, your app starts failing with SMTP 535: Authentication denied.

This isn’t a network hiccup. It’s a credential expiration trap. The Mailgun API key used for SMTP authentication has a 30-day lifespan. If your system doesn’t refresh it, every subsequent connection fails — even if the key was valid yesterday.

Fixing SMTP 535 authentication denied in Mailgun SDK token refresh issue means addressing the gap between key expiration and renewal. Without a proper token refresh mechanism, your app sends emails with dead credentials. That’s why automated systems break after 30 days.

Key takeaways

Mailgun API keys expire every 30 days, requiring proactive refresh to prevent SMTP 535 errors.
Missing token refresh in Mailgun SDK implementations is a common cause of authentication failures in long-running applications.
Automated token refresh must be implemented in the app logic — relying on static keys leads to predictable delivery failure after 30 days.

How to detect if your Mailgun SDK is failing token refresh

You’re seeing SMTP 535 errors after 30 days of deployment, even with valid credentials — that’s a strong signal your Mailgun SDK isn’t refreshing the API token. If the SDK uses a static token or lacks a refresh callback, authentication will fail after the token expires. Check your initialization code and logs for this pattern.

Check for signs of failed token refresh

Scan your outbound email logs for repeated 535 Authentication Denied errors within 24–72 hours after a known token expiration window (e.g., 30 days post-deployment).
Look for a pattern: errors appear consistently after a fixed interval, not randomly — this indicates time-based token expiry, not intermittent network issues.
Verify whether the SDK is configured to use a refresh_callback or credential lifecycle handler. If none is set, token refresh is disabled by default.

Validate your SDK initialization

Open your SDK initialization code. If you’re passing the API key directly and not setting a refresh method, you’re using a static token — this is the most common misconfiguration.
Check for implementations of refresh_token() methods or event listeners for token expiration. Absence means the token never updates, leading to 535 errors after expiry.
Test your environment with a known good setup: initialize the SDK with the same credentials in a clean test script. If it works locally but fails in production, isolate the lifecycle management code.

Token refresh is part of the OAuth 2.0 standard defined in RFC 6749. When implementations omit token renewal logic, they violate expected behavior. Mailgun’s documentation requires explicit setup for token refresh — relying on defaults leaves you exposed.

Let’s be honest: a static token is a maintenance time bomb. You don’t need to monitor for failures after deployment — you should avoid them entirely. The fix starts with reviewing your code.

If you’ve ruled out network issues, DNS problems, or misconfigured credentials, and you’re still getting 535 errors at predictable intervals, your token refresh mechanism is broken.

The real-time email verification fix: preempting SMTP failures

You can fix the SMTP 535 authentication denied error in Mailgun by validating your email list in real time before sending. Invalid or outdated addresses increase bounce rates, degrade sender reputation, and can trigger Mailgun’s access throttling or suspension. Using a tool like Emaillistchecker.io’s API to verify addresses upfront removes the risk of failed deliveries and protects your sending reputation.

Preempting SMTP 535 errors through list hygiene

SMTP 535 errors aren’t always about credentials—they often stem from reputational triggers. When a large number of bounces occur due to invalid addresses, Mailgun’s systems can flag your account for suspicious activity, even if the token is correct. This is especially common with outdated lists or those containing role-based or disposable email addresses.

Let’s say your list includes 10,000 addresses, but 1,200 are expired or misspelled. Sending to them doesn’t just waste bandwidth—it builds a pattern of failure. Over time, Mailgun correlates high bounce rates with poor sender reputation, which leads to stricter auth checks, delayed queues, or access denials. The root cause isn’t the token; it’s the list quality.

How real-time verification stops failures before they happen

Real-time email validation prevents this chain of events. By checking each address against live mail servers, you identify and exclude invalid, catch-all, or risky emails before sending. This reduces bounces, keeps your deliverability intact, and maintains a clean sender reputation. The result? Stable SMTP connections and consistent access to Mailgun’s APIs.

Tools like Emaillistchecker.io offer high-accuracy real-time validation (98.9%) with a verification API that integrates directly into your workflow. You can validate large batches or individual emails on demand. The full list is checked against MX records, SMTP servers, and known disposable domains, ensuring only deliverable addresses proceed to send.

For teams already using Mailgun, this is a non-negotiable layer of defense. It’s not just about avoiding 535 errors—it’s about sustaining long-term deliverability. You’re not fixing symptoms; you’re addressing the source. As outlined in the SMTP specification (RFC 5321), server-side auth failures are often tied to sender behavior, not just credentials.

Consider this: a single high-bounce campaign can trigger a throttling event. But with proactive validation, you eliminate that risk. Tools like Emaillistchecker.io’s API allow you to embed verification into your sending pipeline—automatically, reliably, and without interrupting workflows.

When you send only to verified, active addresses, your deliverability improves, your reputation stays strong, and access to systems like Mailgun remains stable—no surprise 535 errors, no blocked campaigns.

Step-by-step: How to properly refresh tokens in the Mailgun SDK

You can fix the SMTP 535 authentication denied error caused by expired tokens by implementing a token refresh strategy that proactively calls Mailgun’s API to renew credentials before they expire. Store the new token securely, check its validity every 25 days via background polling, and log each refresh to detect failures early. This prevents runtime errors without requiring manual intervention.

Set up the token refresh mechanism

Initialize the Mailgun SDK with a custom token refresh function that triggers before the token expires. Mailgun’s API allows you to retrieve new credentials using your API key, so call this endpoint in your app’s authentication routine.
When a new token is retrieved, store it in a secure, encrypted location—never in plaintext source code. Use environment variables, a secrets manager (like AWS Secrets Manager or HashiCorp Vault), or a secure configuration service.
Set up a background job that runs every 25 days to validate the current token’s expiration. This timing accounts for typical token lifespans (often 30 days) and avoids last-minute failures. Use a scheduler like cron or a task runner (e.g., Celery, Bull) for this.
Log every refresh attempt, including the timestamp, status (success/failure), and any error messages. This helps detect if the system fails to renew tokens, which could lead to undetected SMTP 535 errors during production sending.

Validate and monitor

Periodic token renewal is standard practice in enterprise integrations. According to RFC 6749 (OAuth 2.0), token lifetimes are finite, and systems must handle renewals gracefully. This isn’t optional—it’s a requirement for long-term reliability.

The 4 steps described in “Set up the token refresh mechanism”, in order.

Use monitoring tools to alert on failed refresh events. A failed refresh can silently bring down email delivery until manually remedied. Regular validation prevents this. If you're evaluating how well your email list stays clean and deliverable, consider testing inbox placement with tools like inbox placement testing to verify your sender reputation remains healthy after changes to your auth stack.

Remember: even if your code looks correct, a missing log or a misconfigured secret store can break the entire flow. Let’s ensure each step is tested, logged, and monitored. Proper token management isn’t a one-time setup—it’s an ongoing practice.

How email list hygiene prevents SMTP 535 errors indirectly

SMTP 535 errors in Mailgun can stem from sender reputation issues, not just authentication flaws. High bounce rates—especially permanent ones—signal poor list hygiene and trigger protective throttling. By cleaning your list beforehand, you reduce bounces, preserve sender reputation, and lower the odds Mailgun blocks your traffic due to perceived risk. Tools like Emaillistchecker.io catch invalid, role-based, and disposable emails before they cause trouble.

Bounces aren’t just delays—they hurt your standing

You might think a single 535 error is just a glitch, but it often points to deeper issues. When Mailgun sees too many bounces, especially hard ones, it treats your domain as suspicious. This isn’t just about delivery—it impacts reputation scores. A high bounce rate makes Mailgun more likely to reject connections, even when your credentials are correct. It’s not the error itself, but the behavior it reflects that triggers enforcement.

Role addresses like admin@, support@, or sales@ are common culprits. These aren’t real users, and most won’t open messages. Yet they still count as “bounces” if you send to them. Disposable domains (like mailinator.com or temp-mail.org) are worse—they accept emails but never deliver them, meaning every email to them fails. This inflates your bounce rate and undermines your legitimacy. According to Spamhaus, high bounce rates are a red flag in reputation systems.

Clean lists mean fewer problems downstream

Let’s be honest: you don’t want Mailgun to say “authentication denied” because your domain is on a watchlist. That’s not the real issue—it’s the symptom. The true root is poor list hygiene. Tools like Emaillistchecker.io scan your list in bulk and flag invalid, risky, or disposable emails before you send. You can fix these issues in one step—no trial and error. Their bulk verification process identifies and removes problem addresses, so your send rate stays high, bounces stay low, and sender reputation stays strong.

You don’t need perfect delivery every time. You need predictable, reliable delivery. And that starts with knowing who’s actually on your list. By filtering out fake or non-functional addresses early, you avoid the cascading risks that lead to SMTP 535 errors. It’s not about the token—it’s about trust.

Why static API tokens in SDKs are a setup for 535 errors

You're getting SMTP 535 authentication denied errors in Mailgun because your SDK uses a hardcoded API token that never refreshes. Once it expires, the app keeps trying with an invalid key—no alerts, no retries—until email delivery silently stops. This isn’t a bug; it’s a design flaw.

How static keys break email delivery

API tokens in most SDKs are issued with a finite lifetime. Hardcoded values don’t auto-refresh, so they expire—often after 60 to 90 days—without warning.
If your app or script doesn’t handle token refresh logic, the first failed attempt won’t trigger a retry. It just logs an error or fails silently.
Without monitoring or fallbacks, expired tokens go undetected. Your team may only notice when delivery rates drop—often after days or weeks.

Why even auto-refresh fails if you don’t plan for it

Some SDKs include auto-refresh logic, but only if configured properly. Missing the refresh step entirely leaves you vulnerable.
Even if refresh is enabled, poor error handling means a failed update doesn’t trigger a retry. A network hiccup during refresh can leave your app in a broken state.
Mailgun’s SMTP authentication requires a valid token at every connection. If the token is outdated or expired, SMTP 535 kicks in immediately—no grace period, no warnings.

According to the SMTP RFC 5321, authentication failures must be immediate if credentials are invalid. That’s exactly what SMTP 535 means: “Authentication credentials invalid.” No ambiguity.

Let’s be clear: you can’t rely on static tokens. They’re not just outdated—they’re a recurring point of failure. If you’re managing a large email list or sending transactional emails, even one expired key can stop deliveries across your entire system.

The real fix isn’t a one-time patch. It’s designing your app to handle token rotation, detect failures early, and retry intelligently. That includes monitoring for 535 errors in your logs and setting up alerts when delivery drops.

If you're running a high-volume email send, consider verifying your list’s health first—invalid or outdated addresses compound the problem by increasing delivery strain. Use a reliable verification tool like bulk email verification to detect inactive or malformed addresses before they cause SMTP issues.

Integrating Emaillistchecker.io with Mailgun for better deliverability

You can reduce SMTP 535 authentication errors in Mailgun by cleaning your email list before sending. Invalid, catch-all, or risky addresses increase bounce rates, trigger throttling, and strain delivery pipelines—leading to failed authentications. Using Emaillistchecker.io to pre-verify your list ensures only deliverable, engaged addresses are sent through Mailgun, minimizing errors and improving sender reputation.

Pre-send verification prevents pipeline strain

Before sending via Mailgun, run your list through Emaillistchecker.io’s real-time API or bulk verification tool. This step identifies invalid emails, catch-all domains, and high-risk addresses that would otherwise cause hard bounces or trigger ISP filters. Each bounced email costs your delivery rate and signals poor list hygiene to platforms like Mailgun.

Mailgun’s rate limits and access policies react to sending patterns. High bounce volumes—especially from outdated or non-existent addresses—can trigger throttling, temporary access suspension, or even permanent 535 authentication errors. By removing dead addresses upfront, you keep your sending volume stable and predictable.

Aligning list quality with secure authentication

SMTP 535 authentication failures aren't always about the token—they're often symptoms of broader deliverability problems. If Mailgun sees excessive bounces or spam complaints, it may disallow token refreshes or block access entirely, even with a valid key.

By filtering out invalid and risky contacts, you maintain clean sender metrics. This reduces the chance of being flagged as a misbehaving sender. Clean lists consistently improve inbox placement and keep your Mailgun sending reputation intact.

You can verify your list via Emaillistchecker.io’s API for real-time integration with your workflow, or upload a CSV to our bulk verification tool. Both options provide detailed results, including validity status, risk score, and domain type. You’ll know exactly what’s safe to send.

For deeper insight, test actual inbox placement with our inbox placement tool, which simulates real-world delivery across major providers. This ensures your campaigns reach inboxes—not spam folders or dead zones—before you send.

According to DMCA’s email best practices, maintaining list accuracy is foundational to email deliverability. Poor list hygiene is one of the top reasons for delivery failures. Emaillistchecker.io helps you meet that standard through technical accuracy and real-time feedback.

What happens after successful token refresh in Mailgun SDK

Once the Mailgun SDK successfully refreshes the authentication token, it resumes sending emails using the new credentials. The SMTP 535 "authentication denied" error should stop immediately, assuming the new token is valid and correctly applied in your runtime environment. If the error persists, check that the updated token is actually being used during the send operation.

Verify your token type and configuration

Ensure you're not using legacy API tokens; only API keys created in the Mailgun control panel are supported.
Refresh tokens through the Mailgun control panel — never rely on outdated or manually crafted tokens.
Validate the token is correctly passed into the SDK setup — a misconfigured environment variable or hardcoded wrong key can cause continued failures.
Check the SDK's authentication flow: some implementations require explicit token reloads after refresh, not just a cached value.

Confirm runtime application of the new token

Review your application logs for any persistent 535 errors after the refresh — this indicates the new token isn't being used.
Log the token before passing it to Mailgun to confirm it’s the updated one, not a stale copy from memory or config cache.
Ensure the SDK does not reuse old credentials due to improper scope or caching logic — some SDKs hold authentication state across requests without re-checking.
Use a reliable email verification tool like bulk email verification to validate that your sender address and domain are correctly set up and not blocked by deliverability filters.

For reference, the SMTP authentication process follows standard practices defined in RFC 5321 and RFC 5322, which govern how email servers negotiate authentication and accept messages. Misconfigurations in token handling can trigger rejection responses like 535 even when network and domain settings are correct. Monitoring and validating the full authentication chain — from key generation to runtime execution — helps avoid silent failures.

Common mistakes that cause 535 errors even after token refresh

You’re getting SMTP 535 authentication denied in the Mailgun SDK after refreshing your token? That usually isn’t the token’s fault—it’s one of these four errors: using an SMTP password instead of a full access key, missing SPF/DKIM DNS records, sending from an unverified domain, or triggering rate limits without monitoring. Let’s fix those.

Authentication & domain setup got it wrong

Don’t confuse SMTP password with a full API key. The SMTP password only works for sending via SMTP, not for API calls. If you’re using the SDK, you need the full access key from your Mailgun account’s API keys page.
If your domain lacks SPF or DKIM records, Mailgun may reject your requests even with valid credentials. These DNS records are essential for proving you own the sending domain. Check them with tools like MxToolbox or dmarcanalyzer.com—they’re standard industry practices.
Even with the right key, sending from a domain not verified in the Mailgun control panel will result in a 535 error. You need to add the domain in the dashboard and complete verification, which usually involves setting up DNS records.

Rate limits and configuration traps

Mailgun enforces rate limits per domain and IP. If you send too many emails in a short time without monitoring, you’ll hit a temporary block. These are often silent—no clear error message, just a 535 or 550. Check your logs or use the inbox placement test to validate your delivery chain.
Don’t assume refreshes fix everything. A token refresh only fixes expired or revoked credentials. If your domain is blocked due to poor sender reputation or high abuse reports, you’ll still see 535s. Reputation is tracked across domains, not just per key.
Always verify your sending setup end-to-end. Use a tool like email verification API to validate recipient addresses before sending, reducing bounce rate and protecting your sender reputation.

How to automate email verification to prevent future SMTP issues

You can stop SMTP 535 authentication errors and token refresh problems by verifying every email at source—before it hits your Mailgun SDK. Integrate Emaillistchecker.io’s real-time API to validate addresses instantly during sign-up, CRM syncs, or lead capture, filtering out invalid, disposable, or risky emails before they trigger delivery failures. This proactive approach cuts bounce rates and protects sender reputation, which directly impacts inbox placement.

Let’s break down how this works. When a user submits an email in a form, your system queries Emaillistchecker.io’s API instantly. The API checks MX records, verifies syntax, checks if the domain accepts mail, and flags disposable or role-based addresses. If the result is "valid," the email proceeds. If not, you can reject it immediately—no wasted sends, no failed SMTP auth attempts, and no token exhaustion from retry loops.

Verify at the source, not after the fact

Many systems wait until send time to verify emails, which is too late. If your Mailgun SDK receives a bad address during a campaign, it may fail to authenticate due to an invalid recipient, leading to a 535 error—even if your authentication config is correct. That error isn’t about credentials; it’s about sending to a non-existent or blocked address. By validating early, you avoid triggering those errors entirely.

Use AI to detect risky patterns and protect your domain

With Emaillistchecker.io’s in-app AI assistant, you can analyze batches of verified emails for red flags. The tool detects patterns like disproportionate use of disposable domains (e.g., mailinator, temp-mail.org), which are common among spam traps. These domains often get blacklisted, and sending to them harms sender reputation. The AI also flags role accounts (like admin@, sales@) which tend to have poor engagement and high bounce rates.

For example, if 15% of your leads use disposable domains, the system highlights it. You can then adjust your lead qualification process. This level of insight prevents your campaign from being flagged by ISPs and improves long-term deliverability. According to Spamhaus, campaigns with high disposable domain usage are significantly more likely to be rejected by major inboxes.

Start with the real-time API: verify emails on every input—whether through a form, CRM sync, or email import. You can also bulk verify existing lists with Emaillistchecker.io’s bulk verification tool to clean up old data before sending. This is how you build a reliable email system that won’t crash on SMTP auth errors—especially those caused by bad data, not bad code.

Conclusion: Fixing SMTP 535 isn’t just about tokens — it’s about hygiene and automation

SMTP 535 authentication errors often stem from outdated or expired tokens, but they’re a symptom of deeper issues: stale email lists, unverified addresses, and manual processes that break at scale.

Preventing these failures requires more than token refresh logic. It demands proactive email validation, automated credential management, and continuous list hygiene to maintain sending trust and inbox placement.

With 98.9% accuracy, Emaillistchecker.io catches invalid, disposable, and risky addresses before they hit your Mailgun queue, reducing bounces, protecting sender reputation, and ensuring your automated workflows stay reliable.

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does SMTP 535 authentication denied mean in Mailgun?

It means the server rejected your login attempt due to invalid credentials, often because the API token has expired or isn't refreshed properly.

Does Emaillistchecker.io fix SMTP 535 errors?

It doesn’t directly fix authentication issues, but by verifying and cleaning your email list, it reduces bounce rates that can indirectly trigger access restrictions.

How often should I refresh a Mailgun API token?

Mailgun API keys expire after 30 days. You should refresh them before then, ideally using an automated script or callback system.

Can disposable emails cause SMTP 535 errors?

Disposable emails don’t cause 535 errors directly, but they increase bounce rates and degrade sender reputation, which can lead to throttling or authentication issues.

How does list hygiene help with Mailgun deliverability?

Clean lists reduce permanent bounces, which improves sender reputation. This prevents Mailgun from restricting access due to perceived spamming behavior.

Is Emaillistchecker.io compatible with Mailgun?

Yes. You can use Emaillistchecker.io to verify lists before sending via Mailgun, improving inbox placement and reducing delivery failures.

Do I need to re-verify emails after token refresh?

No. Token refresh is an internal SDK mechanism. However, always verify your list prior to sending, regardless of token status.

Can I use Emaillistchecker.io with other email services?

Yes. It supports integrations with Mailchimp, HubSpot, Klaviyo, and SendGrid, among others, for list hygiene and deliverability testing.

What file format does Emaillistchecker.io support for bulk checks?

It accepts CSV, Excel, and plain text files containing email addresses. Each row must contain a single email.

Are Emaillistchecker.io credits reusable if I don’t use them?

Yes. Purchased credits never expire, so you can use them at any time without time pressure.

How accurate is Emaillistchecker.io?

It boasts 98.9% accuracy across real-world email validation, including detection of catch-all, disposable, and role accounts.

Does Emaillistchecker.io show what kind of email failed?

Yes. Each verification returns a verdict — valid, invalid, catch-all, risky, or disposable — so you know exactly why an email failed.