November 9, 2026
If your app sends password resets, receipts, login codes, or other transactional messaging with Mailgun over SMTP with an old version of TLS, Mailgun won’t be able to accept them after March 1, 2027.
This change applies to SMTP sending only. Here’s what’s changing, and how to update.
Table of contents
Table of contents
What’s changing with Mailgun SMTP and TLS?
Starting March 1, 2027, Mailgun SMTP will only accept connections over TLS 1.2 or higher. Connections that use TLS 1.0 or 1.1 will be rejected, and those messages won’t be sent.
Why is Mailgun retiring TLS 1.0 and 1.1?
TLS 1.0 dates back to 1999. Both 1.0 and 1.1 have known weaknesses causing major browsers to drop these protocols in 2020, and the IETF to formally deprecate them in 2021 (RFC 8996). Sending messages over these protocols puts your messages, and your SMTP credentials, at risk in transit.
Requiring TLS 1.2 or higher protects every sender on the platform, not just the ones who already made the switch.
Does this change affect you?
Senders who send to Mailgun over SMTP and whose mail server, app, or email library negotiates TLS 1.0 or 1.1. will be impacted. Senders who send only through the Mailgun API do not need to make any updates.
Mailgun monitors SMTP traffic for old TLS versions. If Mailgun detects old TLS on your account, admins will get an email and see a banner in their Mailgun account dashboard.
Older environments known to impact TLS:
- Windows Server 2008 or 2012, where TLS 1.2 isn’t on by default
- .NET Framework 4.5 or earlier
- Outdated OpenSSL builds, or legacy apps and plugins that pin an old TLS version
We recommend you move to TLS 1.2 or higher as soon as possible. For most customers, this means updating a setting in the mail server, application, or email library you use to connect to Mailgun.
What happens if I don’t update TLS?
After the cutoff, Mailgun can’t accept SMTP connections that use TLS 1.0 or 1.1 which will impact messages you attempt to send. That includes email your customers count on, like password resets and receipts.
How to update to TLS 1.2
Follow the steps below to make sure you’re updated.
Find everything that sends over SMTP
Many teams have more than one app sending through the same Mailgun account. Check all apps and instances where your Mailgun SMTP credentials or smtp.mailgun.org appear:
- Your own apps and services, including staging and background workers
- Mail servers or relays, like Postfix, that forward mail to Mailgun
- CMS plugins, ecommerce platforms, and other tools configured with your SMTP login
- Vendor or legacy systems, like CRMs, ERPs, scanners, or monitoring tools, that send alerts
Check your environment
In the example curl below, you will see the SMTP chat to verify which TLS you are currently using:
openssl s_client -connect smtp.mailgun.org:587 -starttls smtp -tls1_2
A successful handshake prints the certificate chain and “Protocol : TLSv1.2” or higher.
How do I know I’m fixed?
Use the code samples below to validate that your service is running TLS 1.2 or later when connecting to Mailgun for message sending via SMTP.
Python (smtplib)
Node.js (Nodemailer)
.NET Framework
On .NET 4.5, add this line before you connect. Version 4.6 and later use TLS 1.2 by default.
Postfix relay
If Postfix relays your mail to Mailgun, set the minimum protocol in main.cf (Postfix 3.6 or later), then reload Postfix:
Pro tip: Want TLS on the other leg of the trip too? Add the X-Mailgun-Require-TLS header and Mailgun will only send your message to the recipient’s server over a secure connection.
Wrapping up
Remember, all your changes and updates need to be completed before March 1, 2027. Our support team is available to help ensure your accounts are ready to send on TLS 1.2
