Mailgun vs Postmark

Mailgun

A documented REST API plus SMTP relay on ports 25, 465 and 587, official SDKs for Python, Ruby, PHP, Java, C#, Node.js and Go, a template builder with API, batch sending of up to 1,000 personalized messages per call, scheduled delivery, inbound parsing to UTF-8 JSON and a sandbox domain for test emails cover the day-one needs of my Laravel stack. What I could not find: rate limits, idempotency keys, template versioning, an OpenAPI specification or an official framework driver — PHP is covered, Laravel is never named — and no migration guide from a named competitor, which matters when you have replaced a mail driver once already.

Postmark

A REST endpoint and an SMTP relay with the host, port and credentials documented, official libraries for PHP, Node, Python, Ruby,.NET and Java maintained by Postmark's own developers, quick-starts for Laravel, Rails, Express and Django, stored templates with a templates API, attachments, batch sending up to 500 messages and 50 MB, a sandbox test token, inbound mail parsed into JSON and posted to a webhook, an official CLI, and migration guides from SendGrid, Mailgun, SES, SparkPost and others — that covers almost everything my application needs. We found no public information on idempotency keys or scheduled sending, which keeps it below the top level.

Mailgun

SPF, DKIM and DMARC support, dedicated IPs with automated warm-up, pools at Scale, automatic suppression of hard bounces, complaints and unsubscribes, soft-bounce retries and 24/7 deliverability experts form a credible reputation kit. Blocklist monitoring against Spamhaus, SpamCop, Barracuda and CBL, inbox placement testing with seed lists and Google Postmaster/Microsoft SNDS integrations exist but sit in Mailgun Optimize, which is priced separately from sending. I found no public information on feedback loops with mailbox providers, DMARC reports, a Gmail/Yahoo bulk-sender compliance statement or published delivery times.

Postmark

Dedicated IPs with Postmark-managed warm-up (300,000 messages a month to qualify, overflow routed to the shared pool), manual vetting of every new sender with bounce and complaint limits spelled out in the terms, feedback loops and blocklist monitoring handled for you, DMARC digests, custom return-path and DKIM domains at no charge, separate IP ranges so transactional and broadcast traffic never mix, and delivery times published per major inbox provider. We found no public information on a stated compliance position for the Gmail and Yahoo bulk-sender rules or inbox placement testing.

Mailgun

This answers my core question: logs searchable by to/from address, tag, message ID and subject, per-message event history with timestamps, retention stated per plan from one to thirty days, and an Events API — "did this user get the reset mail" is a search, not a ticket. Webhooks for delivered, bounced, opened, clicked, unsubscribed and complained events are signed with HMAC-SHA256, require HTTPS, retry automatically and carry custom variables and tags, with event filtering, and forwarding events to Splunk or Datadog is documented. What holds it back: no documented retry schedule, no stated raw SMTP response per bounce, no alerts on bounce or complaint rates and no stated read-only role for support staff.

Postmark

Message activity logs with 45 days of full content history customisable from 7 to 365 days, open and delivery tracking per email, statistics per tag, an observer role that can read message history without editing, and webhooks for every event type with a documented retry schedule, stable trace IDs, per-event-type health checks and a webhook statistics API. The vendor states plainly that webhooks are not HMAC-signed and recommends HTTP Basic Authentication and IP allow-listing instead — the one thing I specifically wanted for signed bounce handling. We found no public information on alerts for bounce or complaint spikes or on exporting events to an external log tool.

Mailgun

Retention is documented in detail — message bodies up to seven days, metadata including originating IP for thirty days, recipient addresses stored hashed, suppressions until removal — alongside features that prevent programmatic message retrieval or securely delete after delivery, and APIs to search event data and retrieve message content for data-subject requests. AES-256 at rest, TLS in transit, two-factor authentication, SAML SSO from Scale, IP access management, a bug bounty, and SOC 2 Type II plus ISO 27001 are stated, with the note that certifications may apply to specific products. Against that, the terms state content may be transmitted unencrypted when the recipient does not also support TLS, the vendor may view and use message routing data for its own business purposes, and I found no public information on switching open and click tracking off, scoped API keys or a customer audit log.

Postmark

What is stored per message is documented (metadata, email address, message content), content retention runs 45 days by default and adjusts from 7 to 365 days, open and click tracking switch off per message, two-factor authentication with backup codes is on every plan including the free one, recipient data deletion can be triggered by API, and SOC 2 certified data centres plus a current SOC 2 report are cited. Outbound TLS is opportunistic and the vendor states customers cannot require it or control the version, and the terms grant a licence to internally use messaging content to train and improve the service — both of those bite for a compliance-heavy buyer. We found no public information on SSO, an audit log, or a vulnerability disclosure programme.

Mailgun

A published 99.99% monthly uptime guarantee covering the API, SMTP and outbound delivery, with credits of 5% per thirty minutes capped at 50% and claimed by support ticket, plus a status page, unlimited users with five roles on paid plans, 24/7 ticket, chat and phone channels that widen by plan, and WordPress, Shopify and Heroku integrations make this operable for a twelve-person team. But I found no public information on sub-accounts per application, redundancy or failover across data centres, queueing of mail during incidents, response-time commitments per plan, or named migration help — the SLA is the only reliability architecture in view.

Postmark

Servers work as per-application sub-accounts with their own API tokens, domains and limits, all manageable through the API; there are three roles plus an observer, a WordPress plugin that overrides wp mail, Zapier actions, framework guides, migration guides with a $75 bootstrap credit, and support included at no extra cost on every plan. Redundant data centres in multiple locations with N+2 redundancy and geographic load balancing are described. We found no public information on an uptime SLA, service credits, or an incident history — the public status page carries delivery statistics rather than a documented uptime record.

Mailgun

The contracting entity is Mailgun Technologies, Inc. under Texas law — Mailjet SAS in France appears in the terms only as an alternative counterparty — and the chain runs on US providers: hosting on GCP, AWS, Rackspace and Softlayer with no stated locations, and subprocessors such as Stripe, Salesforce and Zendesk covered by SCC, DPF and UK addendum safeguards rather than EU placement. An EU region exists, but the pages present it as a customer selection, never state which region applies when no choice is made, and say nothing about whether the EU region covers logs and account data. A GDPR Article 28 data processing agreement with Swedish governing law for the clauses and a published subprocessor list are there, which lifts it above the bare minimum.

Postmark

The contracting entity is AC PM, LLC, an ActiveCampaign company, under Illinois law, with hosting on AWS and at a Deft data centre in the United States and the terms consenting to processing and storage in the United States and other countries — for a Hamburg buyer that covers the whole sending chain, not just the dashboard. A published data processing agreement with Standard Contractual Clauses governed by Irish law, an Article 27 EU representative in Kiel, and a sub-processor list with change notification all exist. We found no public information on an EU hosting region for messages or logs; transfers out of the EEA are contemplated via the Data Privacy Framework and the clauses.

Mailgun

Four plans with volumes and per-thousand overage rates are public — free with 100 emails/day, paid starting at $15/month for 10,000 emails, Foundation at $35/mo with 50,000 emails/mo included and overage from $1.30 / 1,000 emails, Scale at $90/mo with 100,000 emails/mo included — plus dedicated IPs at $59/IP/month, log retention per tier, a one-month self-service term and VAT-exclusive pricing, so my annual Foundation or Scale cost is computable. What stops full computability: Enterprise is "Request a quote", Optimize and Validate are priced separately without figures on the captured pages, and I found no public information on support plan add-ons or whether unused volume carries over.

Postmark

Every tier is public with its price and per-thousand overage — Free at $0.00/mo with 100 emails every month, Basic $15.00/mo, Pro $16.50/mo, Platform $18.00/mo, extra emails at $1.80 / 1,000, $1.30 / 1,000 and $1.20 / 1,000 respectively — plus dedicated IPs at $50/month per IP with no setup fees, custom activity retention starting at $5/month, DMARC monitoring at $14/month per domain, 45-day retention stated per tier, and support included rather than sold. Unused emails do not roll over, annual plans are not offered yet, and we found no public information on VAT treatment or the included monthly volume of each paid tier, so a complete annual cost calculation is not quite possible.