Fix Mailgun DNS 550 5.1.3 Errors | Email List Validation

Why Are You Seeing 550 5.1.3 Errors in HubSpot When Using Mailgun?

You sent a campaign through HubSpot using Mailgun, and now you’re staring at a 550 5.1.3 error. No bounce notification. No user complaint. Just a dead end. You’re not alone.

This specific error means the recipient’s mail server rejected your email because it doesn’t recognize the sender address as valid for their domain. When you’re using Mailgun with HubSpot, that rejection almost always traces back to a misconfigured DNS setup — not HubSpot, not Mailgun itself, but how they’re told to talk to each other.

Think of it like sending a letter through a courier service with a fake return address. The post office doesn’t deliver it, not because the sender’s wrong, but because they can’t verify the sender’s legitimacy. Your email delivery fails the same way — not due to content, but because the technical handshake between domains hasn’t happened correctly.

You’ll learn step by step how to fix the root causes: missing or incorrect SPF, DKIM, and DMARC records; mismatched sender addresses; and how to validate your setup so your campaign actually lands in the inbox — not the spam pile or the silent graveyard of rejected messages.

Key takeaways

550 5.1.3 errors occur when Mailgun’s sender address isn’t recognized as valid in the recipient’s domain, usually due to missing or incorrect DNS records.
Improper SPF, DKIM, or DMARC configuration for your Mailgun domain is the most common cause of these errors when integrating with HubSpot.
Correcting sender address formatting and validating DNS records with tools like MxToolbox ensures Mailgun is recognized as an authorized sender, preventing delivery failure.

What Does 550 5.1.3 Mean in the Context of Mailgun + HubSpot?

The 550 5.1.3 SMTP error means the recipient server permanently rejected your message because it couldn’t verify the sender’s domain, not because the email address is invalid. In Mailgun + HubSpot setups, this usually points to missing or misconfigured DNS records like SPF, DKIM, or DMARC, which fail to authenticate the sending domain. The receiving server sees the envelope-from address as unapproved and blocks delivery before it even reaches the inbox.

Why It’s Not About the Recipient

Let’s be clear: 550 5.1.3 rarely means the email address doesn’t exist. It’s a sender-side failure. If you’re using HubSpot to send through Mailgun, the server receiving your message is checking whether your domain is authorized to send on behalf of the sender address. Without valid DNS authentication, even a perfectly formatted email gets blocked.

Think of it like showing up at a secure building with a fake badge. The door doesn’t care if you're knocking on the right office—it just won’t let you in. Same with email: if the sender’s domain isn’t proven legitimate via DNS records, the receiving server assumes it’s spoofing and rejects the full message.

Common Root Causes in Mailgun + HubSpot

The most frequent culprits are missing or incorrect SPF records, misconfigured DKIM signing, or DMARC policies set to reject. For instance, Mailgun’s recommended SPF record must include include:mailgun.org, and it must be added to your domain’s DNS. If you’re using HubSpot to send from your domain via Mailgun, that’s your domain’s SP, DKIM, and DMARC you’re responsible for—not just Mailgun’s.

Many teams assume Mailgun handles everything once connected. But HubSpot is setting the envelope-from address, and that address must be verifiable via DNS. If the domain isn’t properly aligned (and the records match the sending service), the error appears. RFC 5321 defines 550 as a permanent failure — no retries help; you must fix the config.

Pro tip: always test your DNS configuration using tools like MxToolbox or Mail-Tester before launching campaigns. Even a small typo in your SPF record can trigger a 550 error.

If you’re seeing a spike in 550 5.1.3 errors across HubSpot campaigns, check your domain’s DNS record alignment first. Fixing it can mean the difference between a blocked message and 100% deliverability. If you're unsure if your list contains invalid or poorly matched addresses, you can verify your entire list in bulk with bulk email list cleaning to ensure only verified senders are used.

How Mailgun, HubSpot, and DNS Authentication Work Together

When you send a campaign from HubSpot using Mailgun, your messages travel through Mailgun's SMTP service, but the recipient’s server checks your domain’s SPF, DKIM, and DMARC records to verify legitimacy. If those records don’t explicitly allow Mailgun to send on your behalf, the server rejects the email with a 550 5.1.3 error—commonly indicating a misconfigured or missing sending authorization.

Mailgun’s Role in the Delivery Chain

HubSpot doesn’t send emails directly; it routes them through Mailgun’s SMTP servers. That means Mailgun acts as the actual sender, and the recipient’s email server treats Mailgun as the origin of the message—not HubSpot.

Because the message comes from Mailgun, the recipient’s mail server must confirm that your domain permits Mailgun to send on its behalf. If it doesn’t, the message fails, regardless of content, timing, or campaign setup.

Why SPF, DKIM, and DMARC Matter

SPF (Sender Policy Framework) tells receiving servers which IP addresses or services are authorized to send emails for your domain. If Mailgun’s IPs aren’t listed in your SPF record, the sender is blocked.

DKIM adds a cryptographic signature to each email. The receiving server checks that signature against your domain’s public key. If the key doesn’t match what Mailgun used, the email fails authentication.

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together. It instructs mail servers what to do when either check fails—typically, reject the message.

These three are industry-standard practices, enforced by most modern email providers. Misconfiguration here is a leading cause of delivery failures. You can verify your records using public tools like MXToolbox or RFC 7208 (SPF) and RFC 6376 (DKIM).

Even if your list has valid addresses, poor DNS configuration will still result in 550 5.1.3 bounces. Fixing SPF/DKIM is a prerequisite to reliable delivery—no amount of list hygiene or campaign optimization fixes broken authentication.

If you're unsure whether your domain’s records are correctly configured for Mailgun, test your setup with a dedicated verification tool. Bulk email list cleaning tools can help you identify invalid or high-risk addresses before sending, but they won’t fix DNS issues. Correctly configured DNS records are a non-negotiable baseline for any outbound campaign.

Common DNS Configuration Mistakes with Mailgun

Mailgun DNS configuration issues causing 550 5.1.3 in HubSpot campaigns usually trace back to misaligned SPF, DKIM, or DMARC settings—especially when SPF doesn’t include include:mailgun.org, DKIM keys aren’t published with the correct selector, or DMARC policies block Mailgun’s sending IP. Let’s walk through the top pitfalls and how to fix them.

SPF: The Foundation of Sender Trust

Don’t use a blank or conflicting SPF record—every sending domain must have one.
Ensure your SPF record includes include:mailgun.org to authorize Mailgun’s IP ranges.
Multiple SPF records trigger a permanent failure; only one SPF record is allowed per domain.
Use RFC 7208 as a reference when building your SPF syntax.

DKIM and DMARC: Alignment Is Key

Fail to publish the DKIM public key in DNS, and inbound mail servers will reject your messages as unverified.
Verify the selector in your DKIM record exactly matches Mailgun’s configured selector (e.g., mailgun or default).
Don’t set DMARC to reject without first allowing Mailgun in the policy—this blocks legitimate mail from your domain.
Use a DMARC policy like p=quarantine or p=none during setup to test without disrupting delivery.

Envelope-From and Sender Identity

Never use role addresses like admin@ or support@ as the envelope-from address—these are blacklisted or flagged by most providers.
Ensure the envelope-from domain is valid, publicly resolvable, and has proper DNS records.
Mailgun requires a verified sender identity—double-check that your sending address is listed in Mailgun’s dashboard.
Use a dedicated, routable domain for sending; avoid personal email domains or disposable ones.

Consistency between SPF, DKIM, and DMARC alignment is not optional—it’s the core of inbound trust.

These aren’t just technical checkboxes. They’re gateways to inbox placement. Even one misstep can trigger a 550 5.1.3 error—especially when sending through HubSpot, which enforces strict sender policies. Use your email verification tool to catch invalid addresses before they hit the filter queue. Clean your list with precision before campaign launch.

Verify Sender Address Validity Before Sending via Mailgun

You can't rely on Mailgun's SMTP to catch invalid or risky sender addresses. Just because Mailgun accepts the message doesn’t mean it will reach the inbox. Verify deliverability early with real-time validation to rule out role accounts, disposable domains, or catch-all addresses that harm sender reputation and trigger 550 5.1.3 errors. Even a correctly formatted envelope-from can fail if the underlying address is problematic.

Mailgun Accepts Invalid Envelope-Froms — But Delivery Doesn’t Follow

Mailgun’s SMTP layer is permissive. It will accept a message even if the sender’s address is a role account like admin@ or support@, a disposable email, or a catch-all domain. The mail server doesn’t validate the actual deliverability or reputation of the sender before relaying it.

That’s why you still get bounces or 550 5.1.3 errors even after Mailgun says “sent.” The final recipient server checks the sender’s legitimacy — if the address is known to be low-quality or abused, it blocks or rejects the message. This is especially true for inbound filtering systems used by HubSpot and enterprise email providers.

Validate the Full Send Pipeline — Sender and Recipient

Let’s be clear: sender validity is not just about the From: header. The Envelope-From (also known as MAIL FROM) in SMTP is what determines if the sender is authenticated and trusted. If that address is disposable, role-based, or associated with high spam volumes, even a properly authenticated domain won’t save you.

Use real-time email verification to screen both sender and recipient addresses before sending. Tools like Email List Validation's API check for common red flags: role accounts (like info@), disposable domains, catch-alls, and malformed addresses. This step is critical before routing through Mailgun for HubSpot campaigns.

Industry standards like RFC 5322 and RFC 7208 emphasize sender legitimacy. While you can’t fully control how a recipient filter treats your domain, you can prevent your own sends from triggering automatic rejection by ensuring the envelope sender is viable and reputable.

How to Test Deliverability Before Deploying to HubSpot

You can avoid Mailgun DNS configuration issues causing 550 5.1.3 errors in HubSpot by running inbox-placement tests before sending full campaigns. These tests send real messages through Mailgun to inboxes at Gmail, Outlook, and Yahoo, showing whether your setup or sender reputation is blocking delivery. If you catch a problem early, you prevent bounces and wasted sends.

Send Real Test Messages to Real Inboxes

Don’t rely on tools that only check syntax or domain records. The only way to know if your emails land in the inbox is to send them there. Inbox-placement testing simulates real delivery conditions, using actual Mailgun infrastructure and real recipient inboxes. You’ll see the final outcome: delivered, spam, or blocked.

This process reveals whether your Mailgun DNS configuration—like SPF, DKIM, or MX records—is properly set and respected by receiving servers. Even if your domain passes a basic test, inconsistencies in your SPF record or a misaligned DKIM key can still trigger a 550 error. A test catches these before your campaign runs.

Identify Problems Before You Send to Everyone

Many deliverability issues stem from sender reputation, not just technical setup. If your Mailgun domain or IP has ever been associated with spam, even proper DNS settings won’t help. Inbox-placement tests measure inbox placement rate (IPR) across major providers, giving you a real-world benchmark for deliverability.

Tools like inbox-placement testing show you exactly where your setup fails. Was the email flagged by Gmail? Is Outlook blocking it under a 550 5.1.3 error? The report provides root-cause insights. You can test multiple variations—different From addresses, headers, or content—without risking your brand reputation.

Industry standards from organizations like DMARC Analyzer confirm that sender reputation and technical alignment together determine inbox placement. A single misconfiguration can push you into spam filters even with a clean list. Testing before deployment isn’t optional—it’s essential.

Let’s be real: fixing issues post-campaign is more expensive than preventing them. Use inbox-placement tools to stress-test your setup. It’s the only way to know if your message will land in the inbox—or get lost before it reaches the first subscriber.

Step-by-Step: Diagnose and Fix Mailgun DNS Issues

When HubSpot campaigns fail with a 550 5.1.3 error, it’s usually due to misconfigured DNS records. Fix it by verifying your SPF, DKIM, and DMARC records in your domain registrar’s DNS panel, ensuring they include Mailgun’s mechanisms, and waiting for propagation. Use tools like MXToolbox to validate your setup in real time.

Check and Correct Your DNS Records

Log into your domain registrar’s DNS panel. This is where your domain’s DNS records are managed — typically found in the control panel of providers like GoDaddy, Cloudflare, or Namecheap.
Locate your TXT records for SPF, DKIM, and DMARC. These records govern how receiving servers verify your email authenticity. A missing or incorrect entry here can trigger delivery failures.
Ensure your SPF record includes include:mailgun.org. SPF defines which services can send email for your domain. Without this include, Mailgun can’t authenticate, leading to a 550 5.1.3 bounce.
Confirm your DKIM selector and public key match Mailgun’s configuration. The DKIM selector (like mailgun) must match what Mailgun generated, and the public key must be published as a TXT record with the correct value.
Verify DMARC policy allows Mailgun and includes a reporting destination. DMARC tells receivers what to do with failed mail. A strict policy without proper reporting or Mailgun inclusion harms deliverability. Use rua=mailto:[email protected] to receive aggregate reports.
Save changes and wait 10–30 minutes for DNS propagation. Changes take time to update across the global DNS network. Never assume they go live instantly.

Test the Fix

After propagation, test delivery using Mailgun’s SMTP or the Email List Validation API. Validating deliverability with a real email address confirms whether the fix resolved the 550 5.1.3 error.

The 6 steps described in “Check and Correct Your DNS Records”, in order.

For ongoing list health, use bulk verification to identify invalid or risky addresses before sending. Proper DNS setup alone isn’t enough — consistent validation supports long-term inbox placement. RFC 7208 outlines SPF semantics and policy enforcement behavior; understanding this helps prevent misconfigurations.

Why You Should Validate Your List Before Every HubSpot Campaign

You should validate your list before every HubSpot campaign because even with correct Mailgun DNS configuration, sending to invalid addresses, role accounts, or disposable domains raises bounce rates, degrades sender reputation, and reduces inbox placement—often silently. Without verification, you risk being flagged by filters even if your technical setup is flawless.

Invalid Addresses and Role Accounts Hurt Deliverability

Even if Mailgun’s DNS is set up correctly, sending to non-existent addresses or role-based emails (like info@ or sales@) still triggers 550 5.1.3 errors or, worse, silent bounces. These don’t immediately fail but hurt your sender reputation over time—especially if the domain uses a catch-all policy that accepts the message but never delivers it.

According to RFC 5321, SMTP servers should reject invalid recipients early. But when mail is accepted and later dropped by the recipient server without a bounce, it appears as a soft failure. These “silent” bounces are hard to track and can lead to throttling or blocklisting by providers like Gmail or SendGrid.

Disposable Domains and Invalid Formats Reduce Placement

Disposable email domains, which are often used for temporary sign-ups, are common in low-quality lists. They’re frequently blocked or ignored by email providers, even if the address appears valid. Similarly, malformed addresses or outdated formats (like user@domain) can result in undeliverable messages and increase your overall bounce rate.

These issues aren't caught by basic syntax checks. A full validation service checks against real-time data from major providers and includes domain reputation analysis. It’s not enough to rely on DNS settings—or even SPF/DKIM alignment—if your list contains dead or risky emails.

With 98.9% accuracy, Email List Validation identifies invalid addresses, catch-alls, disposable domains, and role accounts before you send. It processes your list in bulk, flags risky entries, and helps prevent delivery failures that stem from sender reputation damage. Use it before every HubSpot campaign to ensure only valid, high-quality emails are sent.

Try it for free with 100 verifications at bulk list cleaning—no credit card required. You can also integrate it with HubSpot via our native hub for automated validation.

How Email List Validation Helps Prevent 550 5.1.3 Errors

550 5.1.3 errors in HubSpot campaigns often stem from sending to invalid, catch-all, or role-based email addresses — a common cause of Mailgun DNS misconfiguration fallout. Email List Validation stops these issues before they happen by removing bad addresses upfront, checking real-time validity, and testing inbox placement, so your Mailgun delivery stays reliable and your sender reputation stays clean.

Bulk List Verification Removes High-Risk Addresses Before Send

When you send via HubSpot using Mailgun, every invalid address in your list risks triggering a 550 5.1.3 error. These errors frequently flag addresses that don’t exist, are role-based (like admin@ or sales@), or belong to disposable domains — all of which Mailgun’s systems reject. You don’t need to rely on trial-and-error sends to find these; Email List Validation’s bulk verification process identifies them in advance. With a 98.9% accuracy rate, it flags invalid, catch-all, and disposable addresses so they never hit your Mailgun server.

Real-Time API and Inbox Placement Testing Build Predictable Deliverability

Let’s be honest: even with proper DNS setup, deliverability isn’t guaranteed. That’s why integrating Email List Validation’s real-time API before sending ensures each address is valid at the moment of delivery. The API checks DNS records, SMTP responses, and syntax — catching issues Mailgun might not surface until after the send. For deeper assurance, inbox placement testing simulates how your campaign lands in real inboxes across providers, giving you confidence your message won’t be caught in spam, even if a 550 error wasn’t the root cause.

For users who run campaigns through HubSpot or other ESPs, the in-app AI assistant can help interpret tricky results like “risky” or “catch-all,” offering context and action steps. It doesn’t replace your team, but it reduces guesswork when troubleshooting edge cases that could lead to misconfigured Mailgun delivery paths.

For real-time validation, explore the API at real-time email verification. To test deliverability before launch, try inbox placement testing. For teams managing large HubSpot campaigns with Mailgun, bulk cleaning your list first is one of the most effective ways to avoid unnecessary 550 errors and maintain sender reputation.

Final Checks Before Launching the Campaign

Mailgun DNS configuration issues often manifest as 550 5.1.3 errors when sending through HubSpot. These errors stem from misconfigured SPF, DKIM, or MX records, or from using invalid envelope-from addresses.

Verify Your Setup

Confirm your Mailgun sending domain appears as verified in the Mailgun dashboard.
Ensure the envelope-from address uses a valid, deliverable email on your domain—never use placeholder or non-existent addresses.
Test the send path with at least three real, valid email addresses from major providers (Gmail, Outlook, Yahoo).

Test Deliverability and Reputation

Use Email List Validation’s inbox-placement feature to run a full deliverability test before sending to your full list.
Review your sender reputation using tools like MxToolbox or Spamhaus. A poor reputation can cause deliverability drops even with correct DNS setup.

Sources

HubSpot's list-health benchmarks show an average bounce rate of 2.48% and an average unsubscribe rate of 0.22% across industries. — HubSpot (2025)

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is 550 5.1.3 in Mailgun and HubSpot?

It’s an SMTP error indicating that the recipient’s mail server rejected the message due to an unverified or unauthorized sender address, usually caused by missing or incorrect DNS configurations.

Does SPF include:mailgun.org need to be in my domain’s SPF record?

Yes. If Mailgun sends emails from your domain, the SPF record must include 'include:mailgun.org' to authorize it as a sending service.

Can a catch-all email cause a 550 5.1.3 error?

Not directly. But sending to catch-alls may lead to high bounce rates or spam complaints, which can hurt sender reputation and trigger delivery blocks.

Why does Mailgun need a DKIM key in DNS?

DKIM signs outgoing emails to prove authenticity. Without a published DKIM record, Mailgun’s messages appear unverified, increasing rejection likelihood.

Can I send from a role address like info@ via Mailgun?

Technically yes, but role addresses often trigger spam filters, catch-all responses, or manual review. They are not recommended for bulk campaigns.

How does Email List Validation catch invalid addresses?

It uses real-time SMTP checks, syntax validation, domain reachability testing, and pattern recognition to identify invalid, disposable, and role accounts with 98.9% accuracy.

Do DNS changes take effect immediately?

No. DNS changes typically take 10 to 30 minutes to propagate globally, depending on your registrar and TTL settings.

Can I verify emails in bulk without buying credits?

Yes. You get 100 free verifications to start with Email List Validation. Purchased credits never expire.

Why do some emails pass verification but still bounce in HubSpot?

Verification only confirms format and domain existence. Bounces can still result from temporary outages, server blocks, or authentication issues in your DNS setup.

How can I improve inbox placement with Mailgun?

Ensure proper DNS authentication (SPF, DKIM, DMARC), maintain good sender reputation, clean your list with a tool like Email List Validation, and conduct inbox-placement tests before campaigns.