Transactional Email
Mailgun
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Mailgun Technologies, Inc. · www.mailgun.com
Compare with Postmark → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Mailgun at a glance
- Vendor
- Mailgun Technologies, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention the US, the EU, United States and Europe source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Starting price
- “Send 100 emails/day free, with packages starting at just $15/month.” (vendor’s words) source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Mailgun 2/5, the mean of 6 judges. Mailgun is a transactional email API and SMTP relay from Mailgun Technologies, Inc., part of Sinch AB. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Mailgun is a transactional email API and SMTP relay from Mailgun Technologies, Inc., part of Sinch AB. Four of the six judges returned weighted totals between 6.2 and 6.6; the data protection officer and the skeptic returned 0.0. Within the scoring judges, pricing transparency runs 7-8; deliverability, observability and data and security run 6-7; sending API and reliability and accounts sit at 6; and sovereignty is the weakest at 4-5. The public pages carry four tiers with volumes and overage rates — free at 100 emails/day, Foundation at $35/mo with 50,000 emails/mo, Scale at $90/mo with 100,000 emails/mo — plus a 99.99% monthly uptime guarantee and retention stated as bodies up to seven days and metadata thirty days. The split among scoring judges is narrow: sovereignty 4 versus 5 turns on whether the published data processing agreement with standard contractual clauses under Swedish law offsets Texas-law contracting and an EU region the customer must select. Pricing transparency split 7 versus 8 over separately priced add-ons and different starting figures across the captured pages — $15/month for 10,000 emails versus Foundation at $35/mo.
Speaks for it
- Four plans are public with volumes, per-thousand overage rates, dedicated IPs at $59/IP/month and a one-month self-service term, making an annual cost largely computable.
- Logs are searchable by recipient, tag, message ID and subject, with an Events API and automatically retried, HMAC-SHA256-signed webhooks.
- Retention is documented precisely — bodies up to seven days, metadata thirty days, recipient addresses hashed — alongside SOC 2 Type II and ISO 27001 statements.
- SPF, DKIM and DMARC support, dedicated IPs with automated warm-up and 24/7 deliverability experts are documented.
- A published 99.99% monthly uptime guarantee covers the API, SMTP and outbound delivery, with credits of 5% of the monthly fee per thirty minutes capped at 50%.
Held against it
- The contracting entity shown is Mailgun Technologies, Inc. under Texas law, and the EU region is a customer selection whose coverage of logs and account data the captured pages do not state.
- Blocklist monitoring, inbox placement testing and bounce classification sit in Mailgun Optimize, priced separately with no figure captured, and Enterprise is request-a-quote.
- Judges found no public information on rate limits, idempotency keys, scoped API keys, sub-accounts per application, or queueing of mail during incidents.
- Sensitive personal data and protected health information require the vendor's prior written consent and a separate agreement.
Best for
- Your developers integrate transactional email using official SDKs for Python, Ruby, PHP, Java, C#, Node.js and Go or the SMTP relay on ports 25, 465 and 587.
- Your support team answers delivery questions from searchable logs, per-message event history and signed webhooks rather than support tickets.
- You can compute an annual cost yourself from public tiers, overage rates and a one-month self-service term.
- Your team wants unlimited users with five user roles from the Foundation plan upward.
Avoid if
- Your contract must run under EU law or the EU region must apply without you selecting it — the entity shown contracts under Texas law and presents the EU region as an option.
- You send sensitive personal data or protected health information without a separate agreement with the vendor.
- You need the full deliverability suite priced up front — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Sending API, SMTP & developer experience | 3 of 5 |
| Deliverability & sender reputation | 3.5 of 5 |
| Message logs, events & webhooks | 3.5 of 5 |
| Message data, retention & security | 3.5 of 5 |
| Reliability, accounts & support | 3 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 4 of 5 |
Sending API, SMTP & developer experience
panel disagrees
Show reasoningHide reasoning
How this is scored
How an application sends mail: a REST API and an SMTP relay with their limits stated, official SDKs and drivers for named languages and frameworks (PHP and Laravel, Node, Python, Ruby and Rails, Java, Go, .NET), stored templates with variables and versions, batch sending, attachments, idempotency keys, scheduled sending, a test or sandbox mode that does not deliver, inbound email parsed into a webhook, and the quality of the API reference and guides.
0 — Not a sending service; an application cannot send email through it by API or SMTP.
3 — An API or SMTP credentials to send a message; SDKs, templates, limits and a test mode are basic or not described.
5 — A documented REST API and SMTP relay, official SDKs for several named languages, stored templates with variables, attachments and batch sending, rate limits stated, a sandbox or test mode, and quick-start guides for named frameworks.
8 — An API reference with every endpoint and error code, idempotency keys, scheduled sending, template versions and a template language documented, inbound email parsed to a webhook, an OpenAPI specification or official CLI, framework drivers maintained by the vendor, and a migration guide from named competitors.
10 — An API a team builds its product on: versioning and deprecation policy published, backward compatibility stated, full parity between API and SMTP features, local or staging test tooling that mirrors production, and every limit, timeout and retry behaviour documented.
The SaaS Developer
A documented REST API plus SMTP relay on ports 25, 465 and 587, official SDKs for Python, Ruby, PHP, Java, C#, Node.js and Go, a template builder with API, batch sending of up to 1,000 personalized messages per call, scheduled delivery, inbound parsing to UTF-8 JSON and a sandbox domain for test emails cover the day-one needs of my Laravel stack. What I could not find: rate limits, idempotency keys, template versioning, an OpenAPI specification or an official framework driver — PHP is covered, Laravel is never named — and no migration guide from a named competitor, which matters when you have replaced a mail driver once already. 2 3 6 7 8 14 21
The Platform Engineer
A documented REST API and SMTP relay on ports 25, 465 and 587, official SDKs for Go, Node, PHP, Java, Ruby, Python and C#, batch sending to 1,000 recipients, scheduling, a sandbox domain, inbound mail parsed to UTF-8 JSON, and quick-start guides per language. We found no public information on rate limits, idempotency keys, template versions, an OpenAPI specification or migration guides, so the reference stops short of what I want before wiring authentication mail into it. 2 3 6 14 21
The Shop Operator
Official SDKs for PHP, Node, Python, Ruby, Java, C# and Go, an SMTP relay on ports 25, 465 and 587, batch sending up to 1,000 personalised messages, dynamic templates, scheduled sending, inbound parsing and a sandbox test domain give my developer everything to hook the shop up. We found no public information on idempotency keys, template versioning, an OpenAPI specification or CLI, vendor-maintained framework drivers, rate limits, or a migration guide from our previous provider. 14 6 3 2 7 21 1
The Data Protection Officer
A RESTful email API and SMTP relay are documented with official SDKs for seven named languages, batch sending of up to 1,000 recipients per call, scheduled sending, a sandbox domain for test mail, inbound parsing into UTF-8 JSON routes, and a stated 25MB message limit including attachments. We found no public information on idempotency keys, template versioning, an OpenAPI specification, or framework-specific drivers such as Laravel or Rails, which is where a team building a product on it would want more. 2 3 6 7 8 14 21
The Agency Lead
The captured pages show a RESTful email API and an SMTP relay on ports 25, 465 and 587, official SDKs for Python, Ruby, PHP, Java, C#, Node.js and Go, dynamic templates, batch sending of up to 1,000 personalized messages per call, scheduled delivery, inbound parsing into UTF-8 JSON routes, a sandbox domain for test sends, and a 25MB message ceiling stated in the terms. We found no public information on idempotency keys, an OpenAPI specification or vendor CLI, migration guides, or stated sending rate limits. That covers what my PHP and Node teams need to wire up a client application. 2 3 6 14 21
The Skeptic
The captured pages document a REST API and an SMTP relay on ports 25, 465 and 587, official SDKs for Python, Ruby, PHP, Java, C#, Node.js and Go, batch sending of up to 1,000 personalized emails in one call, scheduled sending, a sandbox domain for test sends, and inbound routing parsed to UTF-8 JSON. We found no public information on idempotency keys, rate limits, an error-code reference, template versioning or a migration guide from named competitors, which keeps this short of the higher anchors. 2 3 6 8 14 21
Deliverability & sender reputation
panel disagrees
Show reasoningHide reasoning
How this is scored
What the vendor does so the mail reaches the inbox: guided SPF, DKIM and DMARC set-up with a custom return path and tracking domain, shared IP pools and how senders on them are vetted and policed, dedicated IPs with automatic warm-up, transactional and bulk mail kept on separate streams or IP pools, bounces, complaints and unsubscribes turned into suppressions automatically, feedback loops with mailbox providers, blocklist and DMARC monitoring, compliance with the Gmail and Yahoo bulk-sender rules, and published delivery times or inbox placement with their method.
0 — No sender authentication and no bounce handling; mail goes out from shared addresses with no reputation management at all.
3 — SPF and DKIM can be set up and bounces are recorded; IP policy, stream separation and suppressions are basic or not described.
5 — Guided SPF, DKIM and DMARC set-up with a custom return path, shared IPs with a stated sender vetting policy, dedicated IPs available, automatic suppression of hard bounces and complaints, transactional and marketing mail separated by stream or IP pool, and deliverability guidance in the documentation.
8 — Dedicated IPs with automatic warm-up and pool management, a stated acceptable-use and vetting process for shared pools, feedback loops and blocklist monitoring, DMARC reports, BIMI or custom tracking domains, compliance with the Gmail and Yahoo sender requirements stated, delivery times published, and access to deliverability experts.
10 — Deliverability that can be verified: delivery time and bounce rates per mailbox provider published continuously with their method, inbox placement testing included, pool reputation shown to the customer, and a documented escalation path with mailbox providers.
The SaaS Developer
SPF, DKIM and DMARC support, dedicated IPs with automated warm-up, pools at Scale, automatic suppression of hard bounces, complaints and unsubscribes, soft-bounce retries and 24/7 deliverability experts form a credible reputation kit. Blocklist monitoring against Spamhaus, SpamCop, Barracuda and CBL, inbox placement testing with seed lists and Google Postmaster/Microsoft SNDS integrations exist but sit in Mailgun Optimize, which is priced separately from sending. I found no public information on feedback loops with mailbox providers, DMARC reports, a Gmail/Yahoo bulk-sender compliance statement or published delivery times. 2 4 5 14 15 16
The Platform Engineer
SPF, DKIM and DMARC, dedicated IPs with automated warm-up and pools, an acceptable-use policy enforced on bounce and complaint rates, automatic suppressions for bounces, complaints and unsubscribes, and deliverability experts around the clock. What holds it back for me: inbox placement testing, blocklist and spam-trap monitoring sit in Mailgun Optimize, priced separately, and we found no public information on published delivery times or inbox rates per mailbox provider, so I cannot verify my login codes arrive quickly. 2 3 5 13 15 16
The Shop Operator
SPF, DKIM and DMARC are supported with domain verification and a sandbox test address, dedicated IPs start on Foundation with automated warm-up, hard bounces and complaints are suppressed automatically, and deliverability experts are reachable around the clock — the someone to ask when Gmail refuses. Blocklist monitoring, inbox placement testing and bounce classification sit in the separately priced Optimize suite, and we found no public information on a custom return path, feedback loops, Gmail/Yahoo bulk-sender compliance statements, or order mail and newsletters separated by stream or IP pool. 3 2 4 5 15 13 7
The Data Protection Officer
SPF, DKIM and DMARC are supported, dedicated IPs come with automated warm-up, hard bounces and complaints are suppressed automatically, and the acceptable-use policy polices bounce rates, complaints and list sourcing. Much of the deeper tooling — blocklist monitoring against Spamhaus and peers, inbox placement testing on seed lists, Google Postmaster and Microsoft SNDS — sits in the separately priced Optimize suite, and we found no public information on feedback loops, separation of transactional and bulk streams, or compliance with the Gmail and Yahoo sender rules. 2 5 13 14 15 16
The Agency Lead
SPF, DKIM and DMARC, dedicated IPs from $59/IP/month with automated warm-up, IP pools from the Scale plan, automatic suppression of hard bounces, complaints and unsubscribes, an enforced policy on bounce and complaint rates, and deliverability experts for escalations are all documented. Blocklist monitoring against Spamhaus, SpamCop, Barracuda and CBL, inbox placement testing and the Google Postmaster and Microsoft SNDS integrations sit in the separately priced Optimize suite, so they are a second line item for my clients. We found no public information on statements for the Gmail and Yahoo bulk-sender rules, custom tracking domains, or published delivery times. 2 5 7 15 16
The Skeptic
SPF, DKIM and DMARC support, automated recording of hard bounces, complaints and unsubscribes into a suppressions list, dedicated IPs with automated warm-up starting on the foundation plan, and a stated policy of enforcing bounce, complaint and list-sourcing rules are all documented, alongside seed-list inbox placement testing and access to deliverability experts. We found no public information on feedback loops, DMARC reports, a statement of compliance with the Gmail and Yahoo bulk-sender rules, or published delivery times — and blocklist monitoring and bounce classification sit in Mailgun Optimize, which the pricing pages say is priced separately. 2 3 5 7 13 14 15 16
Message logs, events & webhooks
panel disagrees
Show reasoningHide reasoning
How this is scored
What the team can see about each message once the application has handed it over: a message log searchable by recipient, subject, tag or message ID, the full event history (processed, delivered, deferred, bounced with the remote server's answer, opened, clicked, complained), how long logs and message content are kept, event webhooks with retries and a signature, an events API, dashboards and statistics per stream, tag or domain, alerts on bounce or complaint spikes, and access for a support team without developer rights.
0 — Nothing can be seen after sending; no logs, no events and no webhooks.
3 — Totals of sent and bounced messages; per-message logs, webhooks and retention are basic or not described.
5 — A searchable message log with per-message event history and the bounce reason, log retention stated, event webhooks for delivery, bounce, open, click and complaint, statistics per tag or domain, and an API to fetch events.
8 — Webhooks signed and retried with their schedule documented, the raw SMTP response and the rendered message viewable per send, log retention configurable or extended by plan, alerts on bounce, complaint or delivery-time thresholds, export or streaming of events to a named log or data tool, and read-only roles for support staff.
10 — Full traceability: every message traceable from API call to the receiving server's final answer, events streamed in real time with ordering and delivery guarantees stated, long retention with search across the whole history, and observability features documented with their limits.
The SaaS Developer
This answers my core question: logs searchable by to/from address, tag, message ID and subject, per-message event history with timestamps, retention stated per plan from one to thirty days, and an Events API — "did this user get the reset mail" is a search, not a ticket. Webhooks for delivered, bounced, opened, clicked, unsubscribed and complained events are signed with HMAC-SHA256, require HTTPS, retry automatically and carry custom variables and tags, with event filtering, and forwarding events to Splunk or Datadog is documented. What holds it back: no documented retry schedule, no stated raw SMTP response per bounce, no alerts on bounce or complaint rates and no stated read-only role for support staff. 7 11 17 18 21
The Platform Engineer
Logs searchable by recipient, subject, tag and message ID with retention tiered by plan at one, five or thirty days, an Events API returning the data in full, and webhooks for delivered, bounced, opened, clicked, complained and stored events — signed with HMAC-SHA256, retried automatically, filterable, and streamable to Splunk or Datadog. We found no public information on the retry schedule, the receiving server's raw answer per message, a read-only role for support staff, or alerts when bounce rates spike; the documented alerts cover blocklists and reputation. 7 11 17 18 21
The Shop Operator
Logs are searchable by recipient address, event type, tag, message ID and subject, retention is stated per plan up to thirty days on Scale with bodies kept up to seven days, and webhooks for delivered, bounced, opened, clicked, complained and unsubscribed are HMAC-SHA256 signed and retried automatically, backed by an Events API. We found no public information on alerts when bounces or complaints spike, a read-only view for support staff, or viewing the receiving server's raw answer per message; forwarding runs through the Datadog, Splunk and Slack integrations. 17 18 7 11 21
The Data Protection Officer
Logs are searchable by recipient, subject, tag and message ID with retention stated per plan (one to thirty days), message bodies are kept up to seven days and metadata thirty, the Events API exposes the data, and webhooks cover delivered, bounced, opened, clicked, unsubscribed and complained events signed with HMAC-SHA256 and retried automatically, with streaming into Datadog and Splunk. We found no public information on the retry schedule, a per-message view of the raw SMTP response, or read-only access for a support team without developer rights. 7 11 17 18 21
The Agency Lead
Logs are searchable by TO/FROM address, event type, tag, list name, message ID and subject line, retention runs one to thirty days depending on plan, there is an Events API to fetch the data, and webhooks for delivered, bounced, opened, clicked, unsubscribed, complained and stored events are signed with HMAC-SHA256 and retried automatically. Event data can be forwarded into Datadog and Splunk, with ten filter fields and cross-domain views in the reporting dashboard. We found no public information on viewing the raw SMTP response per message, retention extensions beyond the plan tiers, or read-only access for a client's support staff — which limits how I would let a client inspect only their own traffic. 2 7 17 18 21
The Skeptic
Logs are searchable by sender, recipient, subject, tag, list name and message ID, with retention stated per plan — from one day of log retention on the free and basic tiers to 30 days on Scale — message bodies kept up to seven days, and webhooks for delivered, bounced, opened, clicked, unsubscribed, complained and stored events signed with HMAC-SHA256 and retried automatically; events are also fetchable by API and can be forwarded to Splunk or Datadog. We found no public information on the raw SMTP response or rendered message per send, a documented retry schedule, alerts on bounce or complaint thresholds, or read-only roles for support staff. 3 7 11 17 18 21
Message data, retention & security
panel disagrees
Show reasoningHide reasoning
How this is scored
What is stored about each message and what the customer controls: whether message bodies are stored or only metadata, retention periods and the setting to shorten them, deletion of a recipient's data on request, open and click tracking that can be switched off per stream or message, TLS for delivery with an option to require it, encryption at rest, API keys with scopes and per-domain restrictions, IP allow-listing, two-factor authentication and SSO for the dashboard, an audit log, a vulnerability disclosure programme, and security certifications or audits with their scope. Where the data is processed and by whom is scored under sovereignty.
0 — Stores every message indefinitely with no controls, and the vendor states it uses message content for its own purposes.
3 — A privacy policy and a statement that data is encrypted; what is stored, retention and access controls are basic or not described.
5 — What is stored per message documented, retention periods stated, open and click tracking switchable, TLS used for delivery, API keys with restricted permissions, two-factor authentication for the dashboard, and a data processing agreement offered.
8 — Message content retention configurable down to none or metadata only, enforced TLS per domain or message, encryption at rest stated, scoped API keys and IP allow-listing, SSO (SAML) and roles, an audit log, deletion of recipient data by API, and ISO 27001 or SOC 2 stated with its scope.
10 — Data minimisation that can be verified: every stored field and its retention listed, content never stored unless the customer opts in, customer-managed encryption keys or equivalent, independent audits published with their scope, and every security control the customer has listed with its effect.
The SaaS Developer
Retention is documented in detail — message bodies up to seven days, metadata including originating IP for thirty days, recipient addresses stored hashed, suppressions until removal — alongside features that prevent programmatic message retrieval or securely delete after delivery, and APIs to search event data and retrieve message content for data-subject requests. AES-256 at rest, TLS in transit, two-factor authentication, SAML SSO from Scale, IP access management, a bug bounty, and SOC 2 Type II plus ISO 27001 are stated, with the note that certifications may apply to specific products. Against that, the terms state content may be transmitted unencrypted when the recipient does not also support TLS, the vendor may view and use message routing data for its own business purposes, and I found no public information on switching open and click tracking off, scoped API keys or a customer audit log. 8 10 11 12 19 20
The Platform Engineer
Message bodies kept up to seven days and metadata thirty days with the retention documented, recipient addresses hashed, AES-256 at rest, TLS 1.2 or higher in transit, two-factor, IP access management, SAML on the Scale plan, a third-party bug bounty, SOC 2 Type II and ISO 27001, plus features to block retrieval of content or delete it after delivery. The terms note mail can be delivered unencrypted when the receiving server has no TLS, and we found no public information on API key scopes, a customer-visible audit log, or turning open and click tracking off per stream or message. 2 7 8 10 11 20
The Shop Operator
What is stored per message is documented — bodies up to seven days, metadata thirty, recipients hashed — with AES-256 at rest, two-factor login, SAML SSO from Scale, IP access management, a published data processing agreement, and SOC 2 Type II and ISO 27001 statements noting certifications may apply to specific products. 11 20 7 2 8 10 12
The Data Protection Officer
For a processor the retention picture is unusually explicit: message bodies stored at most seven days, metadata thirty, recipient addresses hashed, shorter body retention on lower plans, AES-256 at rest, a published DPA with SCCs, 2FA, SAML SSO, IP access management, SOC 2 and ISO 27001, and audited staff access to message bodies. Two points decide the score for me: the terms state TLS is not enforced and content may travel unencrypted, and we found no public information on switching open and click tracking off per stream or message — the vendor also reserves use of message routing data for its own business purposes. Sensitive data and protected health information require the vendor's prior written consent and a separate agreement, which a sender of lab-result notices must clear before signing. 2 7 8 10 11 20
The Agency Lead
What is stored is documented precisely: message bodies up to seven days, metadata such as sender, recipients, subject and originating IP for thirty days, suppressions until removal, recipient addresses hashed, AES-256 at rest, TLS 1.2 or higher in transit, 2FA, SAML SSO, IP access management, and APIs to search event data and retrieve or delete content for data subject requests, with SOC 2 Type II and ISO 27001 — though with a note that certifications may apply to specific products. We found no public information on switching open and click tracking off per stream or message, or on scoped API key permissions. 8 10 11 12 20
The Skeptic
The pages document what is stored per message — bodies up to seven days, metadata thirty days, suppressions until removal — plus hashed recipient addresses, AES-256 encryption at rest, two-factor authentication, IP access management, SAML SSO, SOC 2 Type II and ISO 27001, a bug bounty, and APIs to search event data, suppressions and message content; staff may access message bodies for troubleshooting and that access is audited. Two things temper this: the terms say content may be transmitted even if the recipient does not also support TLS, resulting in an unencrypted transmission, and they reserve the vendor's right to view and use message routing data for general business purposes; we found no public information on switching off open and click tracking per stream or on API key scopes. 2 8 10 11 12 19 20
Reliability, accounts & support
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether the platform can be relied on and run by a team: a public status page with incident history, uptime SLA and service credits published, redundancy or failover across data centres described, queueing and retry of mail during outages, sub-accounts or servers per application, client or tenant, team members with roles, separate environments, support channels and response times per plan, named migration help, and integrations with platforms that send mail on the customer's behalf (WordPress, Shopify, Shopware, Supabase, Vercel and similar).
0 — No status page, no support channel and no way to separate users or applications.
3 — A support contact and a single account; status page, SLA, sub-accounts and roles are basic or not described.
5 — A public status page with incident history, an uptime SLA on at least one plan, sub-accounts or separate servers per application, team members with roles, support by email or chat with stated hours, and plugins or guides for several named platforms.
8 — An SLA with service credits published, redundancy across data centres or regions described, mail queued and retried during incidents, sub-accounts with their own keys, domains and limits manageable by API, granular roles, support response times per plan, and migration assistance offered.
10 — Reliability that can be verified: uptime history published for years, post-mortems for incidents, multi-region failover documented, an SLA covering delivery latency as well as API availability, and white-label or reseller tooling for agencies and platforms.
The SaaS Developer
A published 99.99% monthly uptime guarantee covering the API, SMTP and outbound delivery, with credits of 5% per thirty minutes capped at 50% and claimed by support ticket, plus a status page, unlimited users with five roles on paid plans, 24/7 ticket, chat and phone channels that widen by plan, and WordPress, Shopify and Heroku integrations make this operable for a twelve-person team. But I found no public information on sub-accounts per application, redundancy or failover across data centres, queueing of mail during incidents, response-time commitments per plan, or named migration help — the SLA is the only reliability architecture in view. 1 7 13 21 22
The Platform Engineer
The SLA is in writing — 99.99% monthly for the API, SMTP and outbound delivery, 5% of the monthly fee back per thirty minutes of downtime, capped at 50%, claimed by ticket — plus a status page for unplanned interruptions, unlimited users with five roles on paid plans, and plugins for WordPress, Shopify and Heroku. We found no public information on status-page history, mail queued and retried during an outage, data-centre failover, sub-accounts with their own keys, response times per plan, or any delivery-latency commitment, which is what a login flow on call actually needs. 7 8 13 21 22
The Shop Operator
A 99.99% SLA covering API, SMTP and outbound delivery with credits of 5% of the monthly fee per thirty minutes of downtime, capped at half the fee, is published alongside a status page; unlimited users with five permission roles come from Foundation up and support is around-the-clock ticket with phone and chat from Scale. We found no public information on sub-accounts to keep applications apart, mail queueing during incidents, response times per plan, or a Shopware plugin — the integration directory lists WordPress and Shopify and we found no public information on one for Shopware. 22 8 7 13 21
The Data Protection Officer
A 99.99% uptime SLA with service credits of 5% per thirty minutes, capped at half the monthly fee, is published, a status page is referenced, support runs 24/7 by ticket, chat and phone with five user roles and unlimited users from Foundation upward, and integrations cover WordPress and Shopify. We found no public information on published incident history, sub-accounts per application, queueing and retry of mail during outages, response-time commitments per plan, or migration assistance. 1 7 8 13 21 22
The Agency Lead
There is a status page for unexpected interruptions, a published 99.99% uptime commitment covering the API, SMTP and outbound delivery with credits of 5% of the monthly fee per thirty minutes of downtime capped at 50%, five user roles with unlimited users from Foundation upward, ticket support on the free tier and 24/7 chat and phone from Scale, plus plugins for WordPress, Shopify and Heroku. We found no public information on sub-accounts per client with their own keys, domains and limits, on separate environments, on queueing and retry of mail during incidents, or on multi-data-centre failover. For an agency putting thirty clients on one account, the absence of documented per-client isolation is what would change how I structure the maintenance contracts. 4 7 8 21 22
The Skeptic
There is a status page, a 99.99% monthly uptime guarantee covering API, SMTP and outbound delivery with credits of 5% of the monthly fee per thirty minutes of downtime capped at 50% and claimable by support ticket within thirty days, five user roles with unlimited users from Foundation upward, 24/7 support that varies by plan, and plugins for WordPress, Shopify, Heroku and many other named platforms. We found no public information on incident history, redundancy across data centres, queueing of mail during outages, sub-accounts, or support response times per plan. 1 7 8 13 21 22
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where messages, logs and recipient data are processed and stored, whether an EU region can be chosen and what it covers, and who the subprocessors are (cloud hosting, sending infrastructure, logging, support and payment tools). Independently sourced by the sovereignty pipeline; every message carries personal data, so the whole sending chain counts, not only the dashboard.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — An EU region available and an EU contracting entity or EU representative, but parts of the chain (sending infrastructure, logs, support, payment) run through non-EU providers without a stated safeguard, or the EU region does not cover logs and account data.
8 — EU processing of messages, logs and account data on named infrastructure, an EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, sending infrastructure and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The SaaS Developer
The contracting entity is Mailgun Technologies, Inc. under Texas law — Mailjet SAS in France appears in the terms only as an alternative counterparty — and the chain runs on US providers: hosting on GCP, AWS, Rackspace and Softlayer with no stated locations, and subprocessors such as Stripe, Salesforce and Zendesk covered by SCC, DPF and UK addendum safeguards rather than EU placement. An EU region exists, but the pages present it as a customer selection, never state which region applies when no choice is made, and say nothing about whether the EU region covers logs and account data. A GDPR Article 28 data processing agreement with Swedish governing law for the clauses and a published subprocessor list are there, which lifts it above the bare minimum. 8 9 10 11 14 20
The Platform Engineer
The contracting entity shown for Mailgun is Mailgun Technologies, Inc. under Texas law, an EU region can be selected for sending, and the named hosting is US cloud providers — AWS, Rackspace, Softlayer and Google Cloud — while support, engagement and payment run through listed US services like Zendesk, Snowflake and Stripe. A published DPA with standard contractual clauses governed by Swedish law, the Swedish authority IMY named, and SOC 2 and ISO 27001 certifications count in its favour, but we found no public information on where messages, logs and account data are processed or whether the EU region covers them. 8 9 10 11 14 20
The Shop Operator
An EU region can be selected for sending, a data processing agreement with standard contractual clauses under Swedish law and the Swedish supervisory authority is published, and subprocessors are listed, including US payment and support tools such as Stripe and Zendesk. The Mailgun contract itself runs under Texas law with the San Antonio entity, hosting is on named cloud providers with no location stated for the EU region, and the captured pages don't show whether the EU region covers logs and account data or applies when no choice is made. 8 9 10 11 14 20
The Data Protection Officer
The default contracting entity is Mailgun Technologies, Inc. under Texas law — with Mailjet SAS under French law named in the shared terms — hosting runs on AWS, Rackspace, Softlayer and Google Cloud, and the US-or-EU region choice is a customer selection whose coverage of logs and message storage the captured pages do not state. The Sinch DPA is published with SCCs under Swedish law and the IMY as supervisory authority, subprocessors are named in the privacy policy plus a list link, and ISO 27001 and SOC 2 are stated, but we found no public information on subprocessor locations or on what the EU region actually covers. 8 9 10 11 14 20
The Agency Lead
The sending side can be placed in an EU region — the documentation speaks of noting your domain and region, US or EU, and pricing presents the EU as an option rather than a default — and there is a published data processing agreement with standard contractual clauses under Swedish law, IMY named as supervisory authority, a public sub-processor list, SOC 2 and ISO 27001. The contracting entity for Mailgun is Mailgun Technologies, Inc. under Texas law, hosting is named as Amazon Web Services, Rackspace, Softlayer and Google Cloud, and we found no public information on where logs and account data are processed or where each sub-processor sits. Workable for a Cologne agency, but the EU placement is a choice the customer must actively make. 8 9 10 11 14
The Skeptic
An EU region can be selected for sending, a data processing agreement is published carrying the 2021 standard contractual clauses with Swedish governing law and the Swedish authority as supervisor, and the terms name Mailgun Technologies, Inc. under Texas law as the contracting entity for Mailgun, with Mailjet SAS under French law as an alternative — the parent being Sinch AB of Stockholm. We found no public information on where messages, logs and account data are stored, on the locations of the named subprocessors, or on what the EU region covers beyond sending, and transfers rely on the EU-US Data Privacy Framework certified for the US entity. 8 9 10 11 14 20
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly message volume, the price per additional thousand messages, the free tier and its limits, what dedicated IPs, extra log retention, sub-accounts, SSO and support plans cost, minimum term, and whether unused volume carries over.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with volume or which features cost extra is unclear.
5 — Tiers are public with their monthly volume and price, but at least one commonly needed piece (overage rate, dedicated IP, longer log retention, SSO, support plan) is unpriced or "on request".
8 — Every tier priced publicly with its volume and overage rate per thousand messages, dedicated IPs and add-ons priced, log retention per tier stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given monthly volume, number of domains and sub-accounts and feature set, with every add-on, support and overage fee and the cancellation terms published.
The SaaS Developer
Four plans with volumes and per-thousand overage rates are public — free with 100 emails/day, paid starting at $15/month for 10,000 emails, Foundation at $35/mo with 50,000 emails/mo included and overage from $1.30 / 1,000 emails, Scale at $90/mo with 100,000 emails/mo included — plus dedicated IPs at $59/IP/month, log retention per tier, a one-month self-service term and VAT-exclusive pricing, so my annual Foundation or Scale cost is computable. What stops full computability: Enterprise is "Request a quote", Optimize and Validate are priced separately without figures on the captured pages, and I found no public information on support plan add-ons or whether unused volume carries over. 2 7 8 14
The Platform Engineer
Four public tiers with volume, price and overage per thousand — free at 100 emails a day, $35/mo for 50,000, $90/mo for 100,000, overage from $1.30 and $1.10 — dedicated IPs at $59/IP/month, log retention stated per tier, a one-month self-service term and prices exclusive of VAT. The Optimize add-on is 'priced separately', Enterprise is a quote, and overage rates are quoted 'from' a floor, so a year's cost is close to computable but not exact. 2 7 8 14
The Shop Operator
I can nearly compute my year from public pages: free at 100 emails a day, Foundation at $35/mo with 50,000 emails and Scale at $90/mo with 100,000, overage per thousand from $1.80, $1.30 and $1.10 by plan, an additional dedicated IP at $59/IP/month, log retention per tier, a one-month term with 30-day notice, and prices stated exclusive of VAT. The Optimize suite is priced separately with no figure captured, and whether unused volume carries over is not stated. 7 14 8 2
The Data Protection Officer
Four plans are priced with their volumes and per-plan overage rates ("from $1.80 / 1,000 emails" on Basic down to "from $1.10 / 1,000 emails" on Scale), additional dedicated IPs at $59/IP/month, log and message retention stated per tier, a one-month self-service term with thirty days' notice, and VAT-exclusive amounts — enough for a buyer to compute an annual cost. Two caveats: Optimize and Validate are priced separately with no prices shown, and the captured pages give different starting figures ("$15/month for 10,000 emails" on one page, Foundation at "$35/mo" on the pricing page). 7 8 14
The Agency Lead
All four plans are public with volumes and overage rates: $0 with 100 emails a day, paid plans from $15 a month for 10,000 emails, Foundation at $35 a month with 50,000 emails and overage from $1.30 per 1,000, Scale at $90 a month with 100,000 emails and overage from $1.10 per 1,000, dedicated IPs at $59 per IP per month, log retention stated per tier, a one-month self-service term with thirty days' notice, and prices exclusive of VAT. Optimize and Validate are priced separately and Enterprise is by quote, so the full annual cost of the deliverability add-ons is not computable from these pages alone. It is nonetheless enough to put a per-client line into a maintenance contract. 2 7 8 14
The Skeptic
Every self-service tier is public with volume and overage — free at 100 emails/day, paid beginning at $15/month for 10,000 emails, Foundation at $35/mo with 50,000 emails/mo and 'from $1.30 / 1,000 emails', Scale at $90/mo with 100,000 emails/mo and 'from $1.10 / 1,000 emails' — plus dedicated IPs at $59/IP/month, log retention of 1, 1, 5 and 30 days by tier, a one-month term with 30-day non-renewal notice, and amounts exclusive of VAT. Enterprise is request-a-quote only, the Optimize add-on's own price is not shown, the overage figures all carry the word 'from', and we found no public information on whether unused volume carries over. 2 7 8 14
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Mailgun
Is Mailgun European?
No. whats-best.ai classifies Mailgun as Rest of world.
Where does Mailgun store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention the US, the EU, United States and Europe as hosting locations, per the vendor’s page captured 1 Nov 2026.
Does Mailgun have a free plan?
Yes. Mailgun has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Mailgun?
As of 2 Nov 2026, the panel rates Lettermint (3.5/5), Bird Email API (formerly SparkPost) (3/5) and Postmark (3/5) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Lettermint (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Mailgun alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Hosting location. EU placement is a customer selection, not a default: the page never states which region applies when no choice is made, and the pricing page presents the EU region only as an option ("Send email through the US or the EU").
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 11 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.mailgun.com Checked 1 Nov 2026 Details →
- 2 Features page (email API) www.mailgun.com Checked 1 Nov 2026 Details →
- 3 Features page (SMTP relay) www.mailgun.com Checked 1 Nov 2026 Details →
- 4 Features page (transactional email) www.mailgun.com Checked 1 Nov 2026 Details →
- 5 Features page (inbox placement) www.mailgun.com Checked 1 Nov 2026 Details →
- 6 API documentation documentation.mailgun.com Checked 1 Nov 2026 Details →
- 7 Pricing page www.mailgun.com Checked 1 Nov 2026 Details →
- 8 Terms of service www.mailgun.com Checked 1 Nov 2026 Details →
- 9 Privacy policy www.mailgun.com Checked 1 Nov 2026 Details →
- 10 Data processing agreement (dpa) sinch.com Checked 1 Nov 2026 Details →
- 11 Security / trust page (GDPR) www.mailgun.com Checked 1 Nov 2026 Details →
- 12 Security / trust page trust.sinch.com Checked 1 Nov 2026 Details →
- 13 Sending API, SMTP & developer experience — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 14 Sending API, SMTP & developer experience — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 15 Deliverability & sender reputation — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 16 Deliverability & sender reputation — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 17 Message logs, events & webhooks — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 18 Message logs, events & webhooks — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 19 Message data, retention & security — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 20 Message data, retention & security — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 21 Reliability, accounts & support — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →
- 22 Reliability, accounts & support — found from sitemap www.mailgun.com Checked 1 Nov 2026 Details →