Postmark vs Mailgun

What each plan costs at 10,000, 50,000 and 125,000 emails

At 10,000 emails a month the bill is the same on the entry plans: Postmark's pricing page lists Basic at $15 and Mailgun's pricing page lists Basic from $15. The extra-email rate is $1.80 per 1,000 on both. What differs is what the $15 buys: Postmark Basic carries a 45-day data retention, and Mailgun Basic keeps one day of logs. If anyone on your team ever opens the activity feed to answer a customer, the retention line is the real price difference at this size.

At 50,000 emails Mailgun is cheaper: Foundation is $35 a month, $420 over twelve months. Postmark's slider reads $55 on Basic, $60.50 on Pro and $66 on Platform, which is $660, $726 and $792 over twelve months. The premium is therefore $20 a month ($240 a year) for Basic, $25.50 ($306) for Pro and $31 ($372) for Platform. Foundation also adds five days of log retention against one on Basic, but Postmark Basic still has nine times that, at 45 days.

At 125,000 emails Postmark reads $115 on Basic, $126.50 on Pro and $138 on Platform. Mailgun's published points are 100,000 and 250,000: Foundation $75 and Scale $90 at 100,000, then Scale $215 at 250,000. Because the points differ, the honest statement is a range: you pay $115 to $138 on Postmark for a volume that Mailgun would price somewhere between $90 and $215, and the exact figure needs a Mailgun quote or a slider check on its page.

Moving up to 300,000 emails on Postmark costs $245 (Basic), $269.50 (Pro) or $294 (Platform). Add the cheapest dedicated IP, from $50 a month, and a Pro account lands at $319.50. On Mailgun, Scale at 250,000 is $215 with one dedicated IP included, and Scale at 500,000 is $400 with the same IP. At this size Mailgun is the cheaper line, and the gap widens if you need a dedicated IP.

Webhooks: Basic Auth and an IP allowlist against a signed payload

Postmark's webhooks overview says outright that Postmark does not currently support HMAC webhook signature verification. Instead you embed Basic HTTP auth credentials in the webhook URL, restrict your firewall to Postmark's published webhook IP ranges (the page warns that the origin IP can change for each attempt) and check the structure of the payload. When you create or edit a webhook, Postmark tests each enabled event type and expects a 200; an event type that keeps failing the check is flagged and its delivery is paused.

Mailgun signs every event. Its securing webhooks guide describes a token, a timestamp and a signature: you join timestamp and token, compute an HMAC-SHA256 with the Webhook Signing Key, and compare the hex digest with the signature. The key is account-wide, covers all domains and is separate from your API key. The guide also suggests caching tokens to reject replays and checking that the timestamp is recent.

Retry behaviour differs too. Postmark retries a failing outbound webhook at 1, 5, 10, 10, 10 and 15 minutes, 51 minutes in all, then stops; it retries 5xx responses, 408, 429 and network failures but drops other 4xx responses such as 400 or 410. Mailgun's retry page says a 200 ends delivery, a 406 rejects without retrying and anything else is retried over 8 hours. If your receiver is down for an hour, Postmark has given up on that event and Mailgun is still trying. For Postmark, deduplicate on the MessageID and the X-PM-Webhook-Trace-Id header, which stays stable across retries.

• Choose Mailgun if a security review insists on signed webhooks and you do not want to run a gateway.
• Choose Postmark if an IP allowlist plus Basic Auth over HTTPS satisfies your reviewer and you prefer one JSON body per event type with stable field names.

Inbound email: a JSON webhook or a routing table

Postmark delivers a received message to the webhook URL you set for the server, as one JSON POST with headers, body parts and base64 attachments, per its inbound documentation. The total of all attachments may not exceed 35 MB, Postmark waits two minutes for your response, and a non-200 reply schedules up to 10 retries growing from one minute to six hours; a 403 stops the retries. Fields such as StrippedTextReply (English only, needs In-Reply-To or References) and MailboxHash for plus-addressing suit a support or reply-by-email feature.

Mailgun puts the decision logic on its side. A route has a priority, a filter (match_recipient, match_header or catch_all) and actions (forward, store, stop). Lower priority numbers run first, every matching route runs unless a stop action cuts it short, and filter and action fields are limited to 4 KB. A forward to a URL ending in json posts application/json; otherwise it posts form data, switching to multipart when there are attachments, per the route actions page. Mailgun retries a failing forward over 8 hours.

In practice, if every inbound address goes to the same handler, Postmark's single webhook is less to configure. If you want support@ to go to a helpdesk, billing@ to a parser and everything else to be stored for a week, Mailgun's routes do that without a custom router in your own app.

Address validation, suppressions and what you keep in your own code

Mailgun sells validation next to sending. The single validation documentation describes a request for one address that returns a result of deliverable, undeliverable, do_not_send, catch_all or unknown, a risk of high, medium, low or unknown, and reasons such as no_mx, mailbox_does_not_exist, mailbox_is_disposable_address and mailbox_is_role_address, with a did_you_mean suggestion for likely typos. Scale includes 5,000 validations; beyond that the pricing page lists overage from $0.80 per 100 on Scale. Validating 20,000 signup addresses on Scale therefore leaves 15,000 billable, which is 150 blocks of 100 and at least $120 at that rate.

Postmark has no counterpart; its own migration guide suggests keeping Mailgun's validator or using a service such as Kickbox. What Postmark does offer is per-stream suppression handling: its Suppressions API can list, create and delete suppressions, and a Subscription Change webhook fires when a hard bounce, spam complaint or manual suppression changes. A spam-complaint suppression cannot be reactivated through the UI or API, so a wrongly suppressed customer means a support ticket to Postmark.

Mailgun keeps separate bounce, complaint and unsubscribe lists per domain and accepts CSV imports of up to 25 MB for unsubscribes and complaints through its API. If a message goes to an address on one of those lists, Mailgun drops it and stops trying.

Moving from Mailgun to Postmark

Details follow Postmark's own Mailgun migration guide, which also records the limits you will hit: 50 recipients per message, a 10 MB outbound limit, no scheduled delivery, inbound only as JSON, and no equivalent of mailing lists or IP pool management.

1. Create a Postmark server for each environment, because a server holds the activity, API tokens, templates and the inbound address; domains and sender signatures belong to the account and can be used by any server.
2. Verify the sending domain with DKIM and a custom Return-Path, and keep Mailgun live meanwhile. DKIM selectors are unique to each provider, so both can sign during the cutover. Merge the two SPF includes into one record rather than publishing two SPF records.
3. Decide the stream for each mail type. Receipts, resets and alerts go to the transactional stream (the default, outbound); newsletters or product announcements go to a broadcast stream, which needs unsubscribe management.
4. Remap the payload: Mailgun o:tag and v: variables become Tag and Metadata, html and text become HtmlBody and TextBody, and the domain SMTP credentials become the Postmark server token used as username and password. There is no raw MIME send and no scheduled delivery.
5. Convert Handlebars templates to Mustachio, upload them through the Templates API or dashboard, and send by TemplateAlias and TemplateModel. Remember that templates do not work over SMTP.
6. Replace each Mailgun route with the inbound webhook, and move any routing rules into your handler. Rewire event webhooks: bounces and spam complaints both arrive in the Bounce webhook, and unsubscribes arrive in Subscription Change. Swap signature checking for Basic Auth plus an IP allowlist.
7. Export the Mailgun suppression lists and add them to the right Postmark stream through the Suppressions API, then keep a replacement for validation in your signup flow. Run the low-risk mail first and raise the share over a week.

Moving from Postmark to Mailgun

The send-call differences are small. The behavioural differences are the ones that cause incidents: no message streams to keep marketing away from receipts, shorter history on lower plans and signed rather than Basic-auth webhooks. Test the first two with a week of shadow traffic before the final DNS switch.

1. Add each sending domain in Mailgun and publish its DNS records. Choose the US or EU region first, because templates are created per region and cannot be shared across them.
2. Create SMTP credentials per domain if you send by SMTP, or use the API key and the messages endpoint if you send by API. Postmark's Tag and Metadata map onto Mailgun's o:tag and v: variables.
3. Rewrite Mustachio templates as Mailgun Handlebars using the if, unless, each, with and equal helpers, upload them as account-level or domain-level templates, and send with the template name and t:variables. Mind the cap of 100 templates and 40 versions per template.
4. Replace the Postmark webhooks with Mailgun event webhooks and verify the HMAC signature with the Webhook Signing Key. Drop the Basic Auth credentials from the URL, and keep dedup logic keyed on Mailgun's own message identifier.
5. Rebuild inbound handling as routes. Where Postmark gave you one JSON POST, decide which recipients forward to which URL, set priorities, and add a stop action to keep catch-all routes from also firing.
6. Export suppressions from Postmark (the stream's Suppressions tab exports JSON) and import unsubscribes and complaints into Mailgun with the CSV import endpoints, which accept files up to 25 MB.
7. Check log retention. A Basic plan keeps one day of logs, so if you rely on Postmark's 45-day activity search for support, start on Scale or export events through webhooks into your own store.