Mailgun "Sandbox subdomains are for test purposes only" (403): fix it

What it means

Every new Mailgun account gets a sandbox domain, a name like sandbox1234abcd.mailgun.org, so you can test the API or SMTP immediately. It only delivers to authorized recipients: addresses you added and that confirmed. If you send to anyone else, Mailgun refuses the message, usually with HTTP status 403 and this widely reported text:

Sandbox subdomains are for test purposes only. Please add your own domain or add the address to authorized recipients in Account Settings.

Nothing is wrong with your code or your credentials: the request was authenticated, but the recipient is not allowed for a sandbox domain.

Why it happens

• Your app still uses the sandbox domain in production, because it was the default value in a tutorial, a plugin or an environment variable (MAILGUN_DOMAIN).
• The recipient was added but did not confirm. Mailgun sends an invitation; the address only becomes authorized after the recipient clicks the link.
• The recipient limit is reached. Mailgun's help center says you can add up to 5 authorized recipients (at the time of writing).
• Your plan restricts sending. Mailgun's help center says that free accounts without a credit card on file, and sandbox domains, can only send to authorized recipients.
• Several recipients in one request: one unauthorized address in To, Cc or Bcc is enough to trigger the error.
• Routes and mailing lists on the sandbox domain have the same restriction: a Route that forwards to an outside address, or a list with members who are not authorized, fails the same way.

The sandbox exists so new accounts cannot be used to send spam to strangers before the owner proves control of a real domain. That is why there is no setting to lift the restriction on the sandbox itself: the answer is always to authorize the test address or to move to your own domain.

How to check

1. Look at the domain in your API URL or SMTP login. A URL like https://api.mailgun.net/v3/sandbox1234abcd.mailgun.org/messages, or an SMTP user postmaster@sandbox1234abcd.mailgun.org, means you are on the sandbox.
2. In the Mailgun panel, open Send, Domains, the sandbox domain, and its setup tab: the authorized recipients and their status are listed there.
3. Open the Logs for the failed message: it shows the full reason.

How to fix it

For testing: authorize the recipient

Add the test address as an authorized recipient in the sandbox domain settings (only users with the Administrator or Developer role can do this). Ask the owner of the address to open the invitation and confirm. Then retry. This is only meant for you and your team, not for customers.

For real sending: add your own domain

Add a domain you own in Send, Domains, Add new domain. A subdomain such as mg.yourdomain.com is a common choice. Publish the SPF and DKIM records and verify the domain; the details and the usual DNS mistakes are in Mailgun domain not verified. Then change your app configuration:

# .env (example)
MAILGUN_DOMAIN=mg.yourdomain.com
MAIL_FROM_ADDRESS=hello@mg.yourdomain.com
# EU domain? use the EU endpoint
MAILGUN_ENDPOINT=api.eu.mailgun.net

Use a From address on your verified domain, never on the sandbox. If the account limits you to authorized recipients because of your plan, add billing details or upgrade as Mailgun's panel indicates.

If, after switching domains, you get 401 or "Forbidden", the API key or region does not match the new domain: see Mailgun 401 Forbidden: API key and EU region. SMTP credentials belong to one domain, so create new ones for your own domain too.

Check that it is fixed

Send a message from your app through your own Mailgun domain to the unique address on the Delivmail home page. The test address is not an authorized recipient, so if it arrives, you are no longer on the sandbox. Read the report: SPF, DKIM and DMARC should pass for your domain. Then resend to the real recipients that were refused. Delivery to the inbox still depends on your reputation and content.