# Mailgun — Transactional Email

Mailgun by Mailgun Technologies, Inc. holds a panel rating of 2/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Mailgun Technologies, Inc. (https://www.mailgun.com)
- Category: [Transactional Email](https://whats-best.ai/software/transactional-email.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/transactional-email/mailgun
- Alternatives: https://whats-best.ai/software/transactional-email/mailgun/alternatives ([markdown](https://whats-best.ai/software/transactional-email/mailgun/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Mailgun Technologies, Inc.
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Default not stated; pages mention the US, the EU, United States and Europe [S7]
- Free plan: Yes, per the vendor’s own page [S1]
- Starting price: “Send 100 emails/day free, with packages starting at just $15/month.” (vendor’s words) [S2]

## The panel's verdict

Mailgun is a transactional email API and SMTP relay from Mailgun Technologies, Inc., part of Sinch AB. Four of the six judges returned weighted totals between 6.2 and 6.6; the data protection officer and the skeptic returned 0.0. Within the scoring judges, pricing transparency runs 7-8; deliverability, observability and data and security run 6-7; sending API and reliability and accounts sit at 6; and sovereignty is the weakest at 4-5. The public pages carry four tiers with volumes and overage rates — free at 100 emails/day, Foundation at $35/mo with 50,000 emails/mo, Scale at $90/mo with 100,000 emails/mo — plus a 99.99% monthly uptime guarantee and retention stated as bodies up to seven days and metadata thirty days. The split among scoring judges is narrow: sovereignty 4 versus 5 turns on whether the published data processing agreement with standard contractual clauses under Swedish law offsets Texas-law contracting and an EU region the customer must select. Pricing transparency split 7 versus 8 over separately priced add-ons and different starting figures across the captured pages — $15/month for 10,000 emails versus Foundation at $35/mo.

**Speaks for it:**
- Four plans are public with volumes, per-thousand overage rates, dedicated IPs at $59/IP/month and a one-month self-service term, making an annual cost largely computable.
- Logs are searchable by recipient, tag, message ID and subject, with an Events API and automatically retried, HMAC-SHA256-signed webhooks.
- Retention is documented precisely — bodies up to seven days, metadata thirty days, recipient addresses hashed — alongside SOC 2 Type II and ISO 27001 statements.
- SPF, DKIM and DMARC support, dedicated IPs with automated warm-up and 24/7 deliverability experts are documented.
- A published 99.99% monthly uptime guarantee covers the API, SMTP and outbound delivery, with credits of 5% of the monthly fee per thirty minutes capped at 50%.

**Held against it:**
- The contracting entity shown is Mailgun Technologies, Inc. under Texas law, and the EU region is a customer selection whose coverage of logs and account data the captured pages do not state.
- Blocklist monitoring, inbox placement testing and bounce classification sit in Mailgun Optimize, priced separately with no figure captured, and Enterprise is request-a-quote.
- Judges found no public information on rate limits, idempotency keys, scoped API keys, sub-accounts per application, or queueing of mail during incidents.
- Sensitive personal data and protected health information require the vendor's prior written consent and a separate agreement.

**Best for:**
- Your developers integrate transactional email using official SDKs for Python, Ruby, PHP, Java, C#, Node.js and Go or the SMTP relay on ports 25, 465 and 587.
- Your support team answers delivery questions from searchable logs, per-message event history and signed webhooks rather than support tickets.
- You can compute an annual cost yourself from public tiers, overage rates and a one-month self-service term.
- Your team wants unlimited users with five user roles from the Foundation plan upward.

**Avoid if:**
- Your contract must run under EU law or the EU region must apply without you selecting it — the entity shown contracts under Texas law and presents the EU region as an option.
- You send sensitive personal data or protected health information without a separate agreement with the vendor.
- You need the full deliverability suite priced up front — ask the vendor: the public pages we read do not show it

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The SaaS Developer | The Platform Engineer | The Shop Operator | The Data Protection Officer | The Agency Lead | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sending API, SMTP & developer experience | 3/5 | 3/5 | 3/5 | 0/5 | 3/5 | 0/5 |
| Deliverability & sender reputation | 3.5/5 | 3.5/5 | 3.5/5 | 0/5 | 3/5 | 0/5 |
| Message logs, events & webhooks | 3.5/5 | 3.5/5 | 3.5/5 | 0/5 | 3/5 | 0/5 |
| Message data, retention & security | 3.5/5 | 3.5/5 | 3.5/5 | 0/5 | 3/5 | 0/5 |
| Reliability, accounts & support | 3/5 | 3/5 | 3/5 | 0/5 | 3/5 | 0/5 |
| European sovereignty | 2/5 | 2.5/5 | 2.5/5 | 0/5 | 2.5/5 | 0/5 |
| Pricing transparency | 3.5/5 | 4/5 | 4/5 | 0/5 | 4/5 | 0/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3.5/5** | **0/5** | **3/5** | **0/5** |

### The judges

- **The SaaS Developer** (v1.0): Backend developer at a twelve-person B2B SaaS in Hamburg, built on Laravel, that sends sign-up confirmations, password resets, invoices and weekly digests to 40,000 users. Has replaced the mail driver once already and does not want to again. Wants an official driver for the framework, templates with variables, a test mode that never reaches a real inbox, signed webhooks for bounces, and a log that answers "did this user get the reset mail?" without opening a ticket.
- **The Platform Engineer** (v1.0): Platform engineer at a fintech in Frankfurt whose customers sign in with a one-time code sent by email, so a delay of three minutes is an outage. Is on call for it. Reads the status page history before the feature list, wants the SLA in writing with credits, mail queued and retried during an incident, delivery latency per mailbox provider, alerts on bounce spikes, and scoped API keys that can be rotated without a deploy.
- **The Shop Operator** (v1.0): Runs a Shopware shop for kitchen equipment in Germany and Austria with 900 orders a week. Order confirmations, invoices and shipping notices went out through the hosting provider's mail server until a customer found theirs in spam and the support inbox filled up. Wants guided SPF and DKIM set-up a non-specialist can follow, a plugin for the shop, order mail kept apart from the newsletter, and someone to ask when Gmail starts refusing.
- **The Data Protection Officer** (v1.0): In-house data protection officer at a health software company whose appointment reminders and lab-result notices carry patients' names. Treats the sending service as a processor like any other. Reads the DPA, the subprocessor list and the retention section first: whether message bodies are stored and for how long, whether open tracking can be turned off, which entity signs, and whether the EU region covers the logs as well as the mail.
- **The Agency Lead** (v1.0): Technical lead at a web agency in Cologne that builds and runs thirty client applications, from a booking portal to a membership site, each sending its own mail from the client's domain. Wants one account with a sub-account, keys and limits per client, domains verified by API, roles so a client can see their own logs and nothing else, and a price per client that can be written into a maintenance contract.
- **The Skeptic** (v1.0): Has seen "99% deliverability" with no method behind it, "dedicated IPs" that shared a pool with bulk senders, "EU hosting" that covered the API endpoint but not the logs, and seven days of log retention discovered during an incident on day eight. Reads that a vendor is "trusted by thousands of developers" and asks how bounces are suppressed, what is stored per message, which entity signs the DPA — and what moving away would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Authentication protocols: SPF, DMARC, DKIM support [S3]
- Background screening: employees with access to customers’ accounts · yes [S19]
- Breach notification: notify without undue delay [S10]
- Breach notification procedures: yes [S11]
- Certifications: yes · yes · yes · yes · yes · yes [S13]
- Certifications: Page displays a 'Trusted & certified' section (details not shown in captured text) [S21]
- Data deletion period: 90 [S10]
- Data retention policy: yes · yes [S10]
- Data subject request notifications: written, as soon as reasonably practicable · yes [S19]
- Datacenter certifications: yes · yes [S20]
- DPA: https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-protection-agreement/ [S8]
- DPA available: Article 28 GDPR · yes [S11]
- DPA dispute resolution: yes · yes [S9]
- DPA portal: yes [S13]
- DPA scc: yes [S8]
- DPA version: 8 · 2025-10-29 [S10]
- Dpf arbitration: EU · UK · yes [S9]
- Dpf certification: Mailgun Technologies, Inc. · yes · yes [S9]
- Employee training: yes [S11]
- Employee training: regular security training for employees [S20]
- EU model contractual clauses: yes · yes [S11]
- GDPR: yes [S20]
- GDPR HIPAA ISO: yes · yes · yes [S2]
- GDPR page: yes · yes [S1]
- GDPR roles: processor · subprocessor · controller · processor · EU Directive 95/46/EC [S19]
- ISO 27001: ISO/IEC 27001:2022 [S10]
- ISO 27001: yes [S20]
- Page last updated: 2020-08-28 [S11]
- Penetration testing: yes · yes [S9]
- Phiprohibited: no · no [S8]
- Processing instructions: providing the Services or customer instructions [S19]
- Record of processing activities: yes [S11]

**Data**
- Backup responsibility: yes · yes [S8]
- Data subject rights: access · data_portability · rectification · erasure · restriction_of_processing · objection · withdraw_consent · choice [S9]
- Message body retention days: incoming and outgoing messages · 7 [S11]
- Message metadata retention days: sender · recipients · subject line · originating IP address · routing data · 30 [S11]
- No sale: no [S9]
- Ownership: yes [S8]
- Privacy no selling: no [S20]
- Recipient data pseudonymization: yes [S11]
- Return deletion: customer responsible for retrieving copy prior to termination · yes · yes · yes [S19]
- Routing data use: vendor may view and use message routing data for general business purposes [S8]
- Sensitive data prohibited: no [S9]
- Suppressions backup retention days: disaster recovery · 30 [S11]
- Suppressions retention: removal or account deletion [S11]

**Hosting**
- Provider: GCP [S20]
- Providers: Google Cloud Platform · AWS · MacStadium · Rackspace [S9]
- Providers: Amazon Web Services · Rackspace · Softlayer · Google Cloud Platform [S11]
- Regions: US · EU [S7]
- Regions: United States · Europe · yes · no [S9]
- Regions: US · EU [S14]

**Integrations**
- Activecampaign: yes [S21]
- Asana: yes [S21]
- Auth: HTTP Basic Auth with API key, base URL, domain [S14]
- Cursor: yes [S21]
- Datadog: yes [S21]
- Docs: yes · yes · yes · yes [S1]
- Docs available: Help Center and API Documentation available [S3]
- Endpoints: Messages, Events, Lists endpoints [S14]
- Github actions: yes [S21]
- Google analytics: Zapier · yes [S21]
- Heroku: yes [S21]
- Hubspot: Zapier · yes [S21]
- Listed: ActiveCampaign · HubSpot · Braintree · Zapier · BigCommerce · Amazon Seller Central · Asana · Airtable [S2]
- Lovable: yes [S21]
- Make: yes [S21]
- Mcp server: Mailgun MCP Server for natural language sending and tracking [S21]
- N8n: yes [S21]
- Pipedream: yes [S21]
- Related integrations: ActiveCampaign · Salesforce Agentforce Marketing (Marketing Cloud Next) · Lovable [S18]
- Replit: yes [S21]
- Salesforce: Zapier · yes [S21]
- Salesforce marketing cloud: yes [S21]
- Sap s4hana: Private Cloud Edition, release 2025 · yes [S21]
- Sdks: SDKs: Python, Ruby, PHP, Java, C#, Node.js, Go; direct HTTP [S14]
- Sdks languages: Go · Node.js · PHP · Java · Ruby · Python [S6]
- Shopify: yes [S21]
- Slack: yes [S21]
- Splunk: yes [S21]
- Use case analytics: Real-time engagement analytics [S18]
- Use case helpdesk: Customer service automation [S18]
- Use case list hygiene: Automated list hygiene [S18]
- Webhook custom variables: yes [S18]

**Legal**
- Age restriction: 18 · yes [S8]
- Amendment date: 2025-02-15 [S8]
- Aup URL: https://www.mailgun.com/legal/aup/ [S8]
- Copyright: 2026 · Mailgun [S15]
- Doc type: GDPR Compliance · Acceptable Use Policy · Terms of Service · Privacy Policy · DPA [S9]
- Document revision: 2017-02-22 [S19]
- DPA available: yes [S20]
- DPA precedence: yes [S10]
- Entities: Mailgun · Mailjet · Email on Acid · Sinch Email [S8]
- Entity: Mailgun · Mailgun Optimize · Mailjet · Email on Acid · Sinch AB (publ) or its subsidiaries [S9]
- Governing law mailgun: Texas, USA · Mailgun Technologies, Inc. · San Antonio, Texas [S8]
- Governing law mailjet france: France · Mailjet SAS · Mailjet GmbH · Paris, France [S8]
- Liability cap: fees paid for affected services in preceding 12 months [S8]
- Revision date: 09/29/2026 [S9]
- Suspension termination right: more than twice per calendar month or three times per term [S8]

**Pricing**
- Addon pricing: Optimize and Validate priced separately [S14]
- Basic overage: Basic · 1.8 · 1.2 [S7]
- Credit cap: 50 [S22]
- Credit claim window: support ticket in Control Panel · 30 [S22]
- Credit exclusions: No credit for DoS attacks, virus activity, hacking attempts, other circumstances beyond Mailgun's control, or customer breach of Terms of Service [S22]
- Credit rate: monthly fee · 5 · 0.01 [S22]
- Fee increase contract: next renewal term [S8]
- Foundation: 50,000 emails/mo · 1 month · 35 [S7]
- Foundation features: Foundation [S7]
- Foundation overage: Foundation · 1.3 · 1.2 [S7]
- Free: 100 emails/day · 0 [S7]
- Free features: Free [S7]
- Free tier: 100 emails/day · yes [S1]
- Free tier: yes [S4]
- Free tier: emails · 100 · yes [S3]
- Free tier: yes · 100 [S14]
- Free tier: yes [S15]
- Free tier: yes · 100 [S2]
- Invoice dispute window: 120 [S8]
- Overage: Pay for volume sent beyond plan limits [S14]
- Overdue interest: yes · 1.5 [S8]
- Paid plans: 15 · 10000 [S14]
- Payment terms: 30 [S8]
- Plan count: 4 · yes [S2]
- Reinstatement fee: 500 [S8]
- Scale: 100,000 emails/mo · 1 month · 90 [S7]
- Scale features: Scale [S7]
- Scale overage: Scale · 1.1 · 0.8 [S7]
- Self service term: yes · one month · 30 [S8]
- Starting price: 15 · USD [S2]
- Tax exclusive: no [S8]
- Volume threshold: plans for sending over 100,000 messages per month · 100000 [S4]

**Product**
- 2FA: yes [S20]
- Ab testing: yes [S13]
- Ab testing: yes [S2]
- Access management: yes · yes · yes [S2]
- Account lockdown: yes [S20]
- Additional dedicated ip price: 59 [S7]
- Advanced analytics: yes · yes [S4]
- Analytics: yes [S13]
- Analytics: Real-time opens, clicks, bounces analytics [S14]
- Analytics providers: mailbox provider performance analytics [S4]
- API capability: RESTful APIs for send, receive, track; high deliverability and real-time validation [S21]
- Aup enforcement: yes [S2]
- Authentication checking: DKIM · SPF · DMARC · aggregate · mailbox_provider [S5]
- Backups: yes · daily · yes [S20]
- Batch sending: 1000 [S2]
- Bimi: yes [S5]
- Blocklist monitoring: yes [S13]
- Blocklist monitoring: Real-time inbox placement and blocklist tracking [S14]
- Blocklist monitoring: Mailgun Optimize offers comprehensive blocklist monitoring for domains, IP addresses, and sender reputation [S15]
- Bounce classification: Bounce classification filters bounces by mailbox provider, spam filter, and bounce category [S15]
- Bounce filtering: mailbox provider · spam filter · bounce category [S15]
- Bounce management: Bounce management software reduces bounce rate and improves reputation [S16]
- Breach documentation: yes [S19]
- Breach notification: written, as soon as reasonably practicable, in accordance with applicable law · yes [S19]
- Bug bounty: yes [S20]
- Capabilities: send, track, test, and optimize emails [S1]
- Capabilities: Send, optimize, validate, inspect email APIs [S14]
- Client libraries: Python · Ruby · Java · C [S2]
- Cloud based: Cloud-based SMTP server for transactional and marketing email [S3]
- Company scale: 150000 [S1]
- Consulting: yes [S1]

**Subprocessors**
- Customer engagement: Gainsight · Customer.io · Looker · Snowflake · Salesforce · Uservoice · Zapier · Zendesk [S9]
- List available to customers: yes [S11]
- Payments: Stripe · Chargify · Aria · Authorize.net [S9]
- Website tools: Drift · Optimizely · VWO · Segment · Split.io · Google Analytics · GitHub · Unbounce · Twitter [S9]

**Support**
- Abuse report: report spam and Acceptable Use Policy violations [S20]
- Channels: ticket · chat · phone [S4]
- Channels: 24/7 · ticket · chat · phone [S13]
- Channels footer: 24/7 · chat · phone · email [S4]
- Deliverability service: Email Deliverability Service · account monitoring · deliverability consulting · expert guidance [S4]
- Designated users only: no · yes [S8]
- Documentation resources: Help Center · API Documentation · Service Status · Customer Stories · Release Notes [S21]
- Experts: yes [S13]
- Free ticket: Free · ticket [S7]
- Hours 247: 24/7 [S4]
- Request integration: Users can request new integrations [S21]
- Scale channels: Scale · phone · chat [S7]
- Ticket system: support ticket via customer control panel [S22]
- Uptime guarantee: maintenance · API · SMTP · Outbound Delivery · 99.99 [S22]

158 more facts on the canonical page: https://whats-best.ai/software/transactional-email/mailgun

## Questions

### Is Mailgun European?

No. whats-best.ai classifies Mailgun as Rest of world.

### Where does Mailgun store data?

The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention the US, the EU, United States and Europe as hosting locations, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/14225).

### Does Mailgun have a free plan?

Yes. Mailgun has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/14197).

### What are the best alternatives to Mailgun?

As of 2 Nov 2026, the panel rates [Lettermint (3.5/5)](https://whats-best.ai/software/transactional-email/lettermint), [Bird Email API (formerly SparkPost) (3/5)](https://whats-best.ai/software/transactional-email/bird-email-api) and [Postmark (3/5)](https://whats-best.ai/software/transactional-email/postmark) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Lettermint](https://whats-best.ai/software/transactional-email/lettermint) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Mailgun alternatives](https://whats-best.ai/software/transactional-email/mailgun/alternatives).

## Head-to-head

- [Mailgun vs Postmark](https://whats-best.ai/compare/mailgun-vs-postmark.md)

## What this page leaves out

- 11 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.mailgun.com/ (checked 2026-11-01)
- [S2] Features page (email API): https://www.mailgun.com/features/email-api/ (checked 2026-11-01)
- [S3] Features page (SMTP relay): https://www.mailgun.com/features/smtp-server/ (checked 2026-11-01)
- [S4] Features page (transactional email): https://www.mailgun.com/solutions/transactional-email-platform/ (checked 2026-11-01)
- [S5] Features page (inbox placement): https://www.mailgun.com/features/email-inbox-placement/ (checked 2026-11-01)
- [S6] API documentation: https://documentation.mailgun.com/docs/mailgun/sdk/introduction (checked 2026-11-01)
- [S7] Pricing page: https://www.mailgun.com/pricing/ (checked 2026-11-01)
- [S8] Terms of service: https://www.mailgun.com/legal/terms/ (checked 2026-11-01)
- [S9] Privacy policy: https://www.mailgun.com/legal/privacy-policy/ (checked 2026-11-01)
- [S10] Data processing agreement (dpa): https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-processing-agreement/ (checked 2026-11-01)
- [S11] Security / trust page (GDPR): https://www.mailgun.com/gdpr/ (checked 2026-11-01)
- [S12] Security / trust page: https://trust.sinch.com/?product=mailgun (checked 2026-11-01)
- [S13] Sending API, SMTP & developer experience — found from sitemap: https://www.mailgun.com/lander/api/ (checked 2026-11-01)
- [S14] Sending API, SMTP & developer experience — found from sitemap: https://www.mailgun.com/integrations/mailgun-api/ (checked 2026-11-01)
- [S15] Deliverability & sender reputation — found from sitemap: https://www.mailgun.com/solutions/email-blocklist-monitoring-service/ (checked 2026-11-01)
- [S16] Deliverability & sender reputation — found from sitemap: https://www.mailgun.com/solutions/email-bounce-management-software/ (checked 2026-11-01)
- [S17] Message logs, events & webhooks — found from sitemap: https://www.mailgun.com/features/email-logs/ (checked 2026-11-01)
- [S18] Message logs, events & webhooks — found from sitemap: https://www.mailgun.com/integrations/webhooks/ (checked 2026-11-01)
- [S19] Message data, retention & security — found from sitemap: https://www.mailgun.com/security-privacy/ (checked 2026-11-01)
- [S20] Message data, retention & security — found from sitemap: https://www.mailgun.com/security/ (checked 2026-11-01)
- [S21] Reliability, accounts & support — found from sitemap: https://www.mailgun.com/integrations/ (checked 2026-11-01)
- [S22] Reliability, accounts & support — found from sitemap: https://www.mailgun.com/legal/sla/ (checked 2026-11-01)

---

Cite as: whats-best.ai, "Mailgun — Transactional Email", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/transactional-email/mailgun

Corrections: https://whats-best.ai/correct/1278?target=page