Fifteen other people were injured in the melee after an armed person opened fire on security guards preventing the assailant from entering the Blue Parrot nightclub during the BPM festival in Playa del Carmen, the Quintana Roo state prosecutor's office said in a statement.
Two of the victims were security guards from Canada and Colombia, the statement said.
An Italian man was also shot dead while another man died from bullet wounds at a hospital, the statement said. A woman was trampled to death.
State attorney general Miguel Angel Pech said earlier at a news conference that two of the victims were Canadian.
Pech said two people, apparently security guards, had fired back at the assailant.
Four people were detained near the scene of the crime and authorities are investigating if they were connected to the shooting, Pech said.
"Witnesses said that a person tried to enter the establishment with a weapon but was blocked by security guards, triggering the attack," the statement from the prosecutor's office said.
The shooting sowed terror in a part of Mexico that has been largely spared from the drug violence afflicting other parts of the country.
"We suddenly had to jump over the metal security barriers because they were shooting. It was horrible. We were very scared," Eric Alvarez, a 40-year-old Mexican DJ, told AFP outside the club, which has a blue parrot painted on the facade.
"A lot of people were panicking," said Alvarez, who lost his prosthetic teeth while fleeing.
Playa del Carmen and nearby Cancun are in a Caribbean region known as the Mayan Riviera, which is popular among American and European tourists.
No Australians injured
There are no reports of Australians being injured during a gunfight at a nightclub in Mexico.
A spokesperson for the Department of Foreign Affairs told AAP the Australian embassy in Mexico is in close contact with security agencies and there are no reports of Australians harmed in the incident at this stage.
However, several Australians were at the club at the time of the incident, with several posting on social media about how they ran for their lives.
Perth finance broker Trent Cray took to Facebook to say they were all ok.
"OMG the whole club just got shot up!!" he wrote.
'Bodies on the ground'
Rashed Qassem, a Lebanese events promoter who lives in the United States, told AFP he was sitting at a table near the club's exit when the shooting started.
"We thought it was fireworks placed in the club, then we realized that someone had entered through the exit door and had begun shooting," Qassem said.
Qassem, 36, saw a man fall to the ground after he was wounded in the head. Then one of his friends was shot in the back.
"When it became clear that someone was shooting, everyone went into a state of panic. We immediately threw ourselves to the ground as the gunman continued shooting, after he killed a guard at the entrance," he said.
"He fired more than 10 times before he left via the exit door. We kept lying on the ground until the police arrived and asked us to leave."
Amateur video footage showed people cowering and running down the street.
An editor for London-based music magazine Mixmag who was in the backstage area of the Blue Parrot said at least four or five shots were fired at around 2:45 (0745 GMT) or 3am.
"People started running because there's an exit in the back. We stopped and hid behind a cement wall, then crawled under a metal table," Valerie Lee, Mixmag's US digital editor, was quoted as saying by the magazine.
"Security guards at first didn't think it was shots and kept claiming it was fireworks, saying everything was OK. Then people kept running and said they saw a gun. We kept hiding until they opened the back gate and we ran outside," Lee said.
WATCH: Witness account
Lee wrote on Twitter that the music was so loud that people likely didn't hear the gun shots inside.
She said friends outside the entrance were just six meters (20 feet) from the shooter and that there were "bodies on the ground."
'Senseless' violence
The BPM Festival said in a statement that three of its security guards were killed "trying to protect patrons inside the venue."
The festival said organizers worked with local authorities throughout the event to ensure public safety and were cooperating with the investigation.
"We are overcome with grief over this senseless act of violence," the statement said.