Mailgun vs Postmark

Mailgun

A RESTful email API and SMTP relay are documented with official SDKs for seven named languages, batch sending of up to 1,000 recipients per call, scheduled sending, a sandbox domain for test mail, inbound parsing into UTF-8 JSON routes, and a stated 25MB message limit including attachments. We found no public information on idempotency keys, template versioning, an OpenAPI specification, or framework-specific drivers such as Laravel or Rails, which is where a team building a product on it would want more.

Postmark

A fully documented REST API with endpoints and error codes, an SMTP relay on token authentication, vendor-maintained official libraries for eight named languages plus community libraries, batch sending capped at 500 messages and 50 MB, a test token and sandbox mode, inbound email parsed to a webhook, an official CLI, and migration guides from six named competitors. We found no public information on idempotency keys, scheduled sending, template versioning or an OpenAPI specification, which is what keeps it short of the top level.

Mailgun

SPF, DKIM and DMARC are supported, dedicated IPs come with automated warm-up, hard bounces and complaints are suppressed automatically, and the acceptable-use policy polices bounce rates, complaints and list sourcing. Much of the deeper tooling — blocklist monitoring against Spamhaus and peers, inbox placement testing on seed lists, Google Postmaster and Microsoft SNDS — sits in the separately priced Optimize suite, and we found no public information on feedback loops, separation of transactional and bulk streams, or compliance with the Gmail and Yahoo sender rules.

Postmark

SPF, DKIM and DMARC set-up with a free custom return path, every new sender manually vetted before sending, transactional and broadcast traffic kept on completely separate infrastructures including IP ranges, dedicated IPs from 300,000 messages a month with managed warm-up and overflow to the shared pool, feedback loops and blacklist monitoring handled by the vendor, automatic suppression, and delivery times published per mailbox provider on a public Time to Inbox page. We found no public information on a stated compliance position for the Gmail and Yahoo bulk-sender rules, or on BIMI or custom tracking domains.

Mailgun

Logs are searchable by recipient, subject, tag and message ID with retention stated per plan (one to thirty days), message bodies are kept up to seven days and metadata thirty, the Events API exposes the data, and webhooks cover delivered, bounced, opened, clicked, unsubscribed and complained events signed with HMAC-SHA256 and retried automatically, with streaming into Datadog and Splunk. We found no public information on the retry schedule, a per-message view of the raw SMTP response, or read-only access for a support team without developer rights.

Postmark

Message activity and logs viewable by role, 45 days of full content history stated with a customisable seven-to-365-day range, seven webhook event types with a documented six-attempt retry schedule, health tracked per event type with pausing on persistent failure, and a webhook statistics endpoint plus statistics by tag. From my chair the notable gap is integrity, not visibility: the captured pages state webhooks are not signed with HMAC, and we found no public information on alerts for bounce or complaint spikes or on exporting events to a log tool.

Mailgun

For a processor the retention picture is unusually explicit: message bodies stored at most seven days, metadata thirty, recipient addresses hashed, shorter body retention on lower plans, AES-256 at rest, a published DPA with SCCs, 2FA, SAML SSO, IP access management, SOC 2 and ISO 27001, and audited staff access to message bodies. Two points decide the score for me: the terms state TLS is not enforced and content may travel unencrypted, and we found no public information on switching open and click tracking off per stream or message — the vendor also reserves use of message routing data for its own business purposes. Sensitive data and protected health information require the vendor's prior written consent and a separate agreement, which a sender of lab-result notices must clear before signing.

Postmark

The DPA names what is processed (metadata, email address, message content), content retention is 45 days by default and adjustable from 7 to 365 days, open and click tracking are switchable per message, there are server- and account-level tokens, IP allow-listing, two-factor authentication on every plan that the owner can require, encryption at rest stated, deletion of recipient data through a data removal API, and SOC 2 certified data centres with a SOC 2 report offered as the audit alternative. I must flag two findings before any health data goes near this: the terms state the vendor may view, copy and internally use messaging content to train and improve the service, and outbound TLS is opportunistic, falls back to unencrypted and the customer cannot control the TLS version; we also found no public information on SSO or an audit log.

Mailgun

A 99.99% uptime SLA with service credits of 5% per thirty minutes, capped at half the monthly fee, is published, a status page is referenced, support runs 24/7 by ticket, chat and phone with five user roles and unlimited users from Foundation upward, and integrations cover WordPress and Shopify. We found no public information on published incident history, sub-accounts per application, queueing and retry of mail during outages, response-time commitments per plan, or migration assistance.

Postmark

Separate servers per application with plan limits and up to ten message streams each, three roles with a documented permission matrix plus an observer role, redundant data centres in multiple locations with N+2 redundancy and geographic load balancing, free premium support, migration guides, and WordPress, Zapier and framework integrations. We found no public information on an uptime SLA or service credits, on queueing and retry of mail during incidents, or on support response times per plan, so I cannot take reliability as contractually backed.

Mailgun

The default contracting entity is Mailgun Technologies, Inc. under Texas law — with Mailjet SAS under French law named in the shared terms — hosting runs on AWS, Rackspace, Softlayer and Google Cloud, and the US-or-EU region choice is a customer selection whose coverage of logs and message storage the captured pages do not state. The Sinch DPA is published with SCCs under Swedish law and the IMY as supervisory authority, subprocessors are named in the privacy policy plus a list link, and ISO 27001 and SOC 2 are stated, but we found no public information on subprocessor locations or on what the EU region actually covers.

Postmark

The contracting entity is AC PM, LLC, an ActiveCampaign company under Illinois law, personal information is stored in AWS data centres, and the terms have the customer consent to processing and storage in the United States and other countries; we found no public information on an EU region covering messages, logs or account data, and the DPA's reliance on the Data Privacy Framework and the Standard Contractual Clauses confirms transfers out of the EEA are contemplated. There are real mitigations — an executable DPA with SCC modules two and three governed by Irish law, DPF certification, an Article 27 EU representative in Germany, and a published sub-processor page with change notifications — but the named sub-processor list with locations was not captured, so I place this between the levels: above a bare DPA, well short of EU processing.

Mailgun

Four plans are priced with their volumes and per-plan overage rates ("from $1.80 / 1,000 emails" on Basic down to "from $1.10 / 1,000 emails" on Scale), additional dedicated IPs at $59/IP/month, log and message retention stated per tier, a one-month self-service term with thirty days' notice, and VAT-exclusive amounts — enough for a buyer to compute an annual cost. Two caveats: Optimize and Validate are priced separately with no prices shown, and the captured pages give different starting figures ("$15/month for 10,000 emails" on one page, Foundation at "$35/mo" on the pricing page).

Postmark

Four tiers priced publicly with their overage rate per thousand messages (Free at $0.00/mo with 100 emails/month, Basic at $15.00/mo with extras at $1.80/1,000, Pro at $16.50/mo at $1.30/1,000, Platform at $18.00/mo at $1.20/1,000), dedicated IPs at $50/month per IP with no setup fees, DMARC monitoring at $14/month per domain, custom retention starting at $5/month, no rollover of unused email, and monthly auto-renewal cancelled through the service. What stops me going higher: the retention add-on is a starting price rather than a computable figure, high-volume pricing is on request, and we found no public information on VAT treatment.