Mailgun vs Postmark

Mailgun

The captured pages show a RESTful email API and an SMTP relay on ports 25, 465 and 587, official SDKs for Python, Ruby, PHP, Java, C#, Node.js and Go, dynamic templates, batch sending of up to 1,000 personalized messages per call, scheduled delivery, inbound parsing into UTF-8 JSON routes, a sandbox domain for test sends, and a 25MB message ceiling stated in the terms. We found no public information on idempotency keys, an OpenAPI specification or vendor CLI, migration guides, or stated sending rate limits. That covers what my PHP and Node teams need to wire up a client application.

Postmark

The REST API and SMTP relay are documented down to error codes, rate limits, batch limits of 500 messages per call and a test-mode token, with inbound email parsed to a webhook and an official CLI for email, servers and templates. Official libraries for TypeScript, Node, Python, Ruby, Rails, PHP,.NET and Java are maintained in-house, with framework guides for Laravel, Rails, Express, Django and Craft CMS and migration guides from SendGrid, Mailgun, Amazon SES, SparkPost, Mailchimp Transactional and Resend. We found no public information on idempotency keys, scheduled sending or template versioning, which is what keeps this a notch below the top band.

Mailgun

SPF, DKIM and DMARC, dedicated IPs from $59/IP/month with automated warm-up, IP pools from the Scale plan, automatic suppression of hard bounces, complaints and unsubscribes, an enforced policy on bounce and complaint rates, and deliverability experts for escalations are all documented. Blocklist monitoring against Spamhaus, SpamCop, Barracuda and CBL, inbox placement testing and the Google Postmaster and Microsoft SNDS integrations sit in the separately priced Optimize suite, so they are a second line item for my clients. We found no public information on statements for the Gmail and Yahoo bulk-sender rules, custom tracking domains, or published delivery times.

Postmark

Custom Return-Path and DKIM domains are free, transactional and broadcast traffic sit on separate sending infrastructure including IP ranges, and dedicated IPs come with Postmark-managed warm-up, blocklist monitoring, feedback loop registrations and reverse DNS handled by the vendor. Every new sender is manually vetted, purchased lists are prohibited, and bounce and complaint ceilings of 10% and 0.1% police the shared pools, while delivery times for Gmail, Apple, Hotmail, AOL and Yahoo are published on the Time to Inbox page and the status page. We found no public information on BIMI, custom tracking domains, inbox placement testing or a stated position on the Gmail and Yahoo bulk-sender requirements.

Mailgun

Logs are searchable by TO/FROM address, event type, tag, list name, message ID and subject line, retention runs one to thirty days depending on plan, there is an Events API to fetch the data, and webhooks for delivered, bounced, opened, clicked, unsubscribed, complained and stored events are signed with HMAC-SHA256 and retried automatically. Event data can be forwarded into Datadog and Splunk, with ten filter fields and cross-domain views in the reporting dashboard. We found no public information on viewing the raw SMTP response per message, retention extensions beyond the plan tiers, or read-only access for a client's support staff — which limits how I would let a client inspect only their own traffic.

Postmark

Message content is retained 45 days by default and configurable from 7 to 365 days, statistics break down per tag, and event webhooks cover delivery, bounce, open, click, complaint, subscription change and inbound on a documented six-attempt retry schedule with trace and retries-remaining headers plus per-webhook statistics endpoints. A per-server observer role can review message history without editing anything, which is exactly the client self-service view I need. The vendor states plainly that webhooks carry no HMAC signature — HTTP Basic Auth and IP allowlisting are recommended instead — and we found no public information on alerts for bounce or complaint spikes or on exporting or streaming events to an external log tool.

Mailgun

What is stored is documented precisely: message bodies up to seven days, metadata such as sender, recipients, subject and originating IP for thirty days, suppressions until removal, recipient addresses hashed, AES-256 at rest, TLS 1.2 or higher in transit, 2FA, SAML SSO, IP access management, and APIs to search event data and retrieve or delete content for data subject requests, with SOC 2 Type II and ISO 27001 — though with a note that certifications may apply to specific products. We found no public information on switching open and click tracking off per stream or message, or on scoped API key permissions.

Postmark

Content retention is configurable, open and click tracking switch per message, 2FA with backup codes runs on every plan, API access uses server and account tokens with IP allowlisting, encryption at rest is stated, and a data removal API plus an executable DPA are published. Two things temper this for client work: the terms grant the vendor the right to view, copy and internally use message content to train and improve the service, and outbound TLS is opportunistic, falling back to unencrypted delivery with no customer control over the TLS version. We found no public information on SSO, a dashboard audit log, or a company-level certification beyond SOC 2 certified data centres.

Mailgun

There is a status page for unexpected interruptions, a published 99.99% uptime commitment covering the API, SMTP and outbound delivery with credits of 5% of the monthly fee per thirty minutes of downtime capped at 50%, five user roles with unlimited users from Foundation upward, ticket support on the free tier and 24/7 chat and phone from Scale, plus plugins for WordPress, Shopify and Heroku. We found no public information on sub-accounts per client with their own keys, domains and limits, on separate environments, on queueing and retry of mail during incidents, or on multi-data-centre failover. For an agency putting thirty clients on one account, the absence of documented per-client isolation is what would change how I structure the maintenance contracts.

Postmark

Servers are per-application sub-accounts — up to ten on the free and Pro plans, unlimited on Platform — each with its own token and manageable through the account API and CLI, which maps cleanly onto one agency account with a server per client. Owner, Admin and Teammate roles plus a per-server observer let a client see their own message activity and nothing more, N+2 redundancy across multiple data centres is described, and WordPress, Nodemailer and Zapier integrations plus migration guides and a $75 switching credit are documented. We found no public information on an uptime SLA, service credits, incident history, queueing of mail during outages, or support response times; the publicised status page carries delivery statistics to the major inbox providers.

Mailgun

The sending side can be placed in an EU region — the documentation speaks of noting your domain and region, US or EU, and pricing presents the EU as an option rather than a default — and there is a published data processing agreement with standard contractual clauses under Swedish law, IMY named as supervisory authority, a public sub-processor list, SOC 2 and ISO 27001. The contracting entity for Mailgun is Mailgun Technologies, Inc. under Texas law, hosting is named as Amazon Web Services, Rackspace, Softlayer and Google Cloud, and we found no public information on where logs and account data are processed or where each sub-processor sits. Workable for a Cologne agency, but the EU placement is a choice the customer must actively make.

Postmark

The contracting entity is AC PM, LLC, an ActiveCampaign company, governed by Illinois law, with all personal information stored in AWS and Deft data centres in the United States and transfers contemplated to the United States, Australia, Ireland, Brazil and Costa Rica; we found no public information on an EU hosting region. There are genuine safeguards — an executable DPA with Standard Contractual Clauses modules under Irish law, an Article 27 representative in Kiel, EU-U.S. Data Privacy Framework certification and a published sub-processor list with change notification — but every message a client of mine sends through the platform is processed outside the EEA. For thirty German client domains under GDPR that means DPA on file and informed clients, not an EU data path.

Mailgun

All four plans are public with volumes and overage rates: $0 with 100 emails a day, paid plans from $15 a month for 10,000 emails, Foundation at $35 a month with 50,000 emails and overage from $1.30 per 1,000, Scale at $90 a month with 100,000 emails and overage from $1.10 per 1,000, dedicated IPs at $59 per IP per month, log retention stated per tier, a one-month self-service term with thirty days' notice, and prices exclusive of VAT. Optimize and Validate are priced separately and Enterprise is by quote, so the full annual cost of the deliverability add-ons is not computable from these pages alone. It is nonetheless enough to put a per-client line into a maintenance contract.

Postmark

Four public tiers carry their overage rate — free at $0.00/mo with 100 emails and no overages, Basic at $15.00/mo with extra emails at $1.80/1,000, Pro at $16.50/mo at $1.30/1,000, Platform at $18.00/mo at $1.20/1,000 — with server, domain and user counts per tier, dedicated IPs at $50/month per IP with no setup fees, DMARC monitoring at $14/month per domain, custom retention from $5/month, premium support at no extra charge, no rollover of unused emails, monthly auto-renewal and cancellation through the service. That is enough to write a per-client price into a maintenance contract on the Platform plan with unlimited servers. The included monthly volume for each paid tier appears only as the 10,000 emails implied for the entry tier, we found no public information on VAT treatment, annual plans are not offered yet, and high-volume pricing is on request.