Mailgun doesn't validate the email headers of email sent through their system
twitter.com
twitter.com
Several years ago, the customer service got worse, and the fixes / solutions stopped coming. I don't hold my breath that this (or any other issue) will be solved any time soon sadly.
What service do HN recommend these days?
Sometimes for SAAS products with a huge userbase or freemium pricing model is super difficult to keep the bounce rate so low for transactional emails.
[1] https://docs.aws.amazon.com/pinpoint/latest/userguide/channe... [2] https://postmarkapp.com/support/article/1137-servers-faq
Natural email decay rate is 2-3% per month so the goal is to stay close to this range, but the lower the better.
Postmark does have a lower $10/mo starting price for 10k emails per month. But the next jump is $50/mo for 50k emails.
I'm currently working on a project and intended to use SendGrid, so I'm wondering if there's any benefits of Postmark.
Sendgrid is not friendly.
We reported it to SendGrid and their only option was to upgrade to their $89.95 plan to get a dedicated IP. That plan comes with 100K monthly sends and we are nowhere near that.
So, the choice was to have a significant portion of important transactional emails, like registration, not go through or overpay for a plan that is wildly overmatched for us.
Email is hard, but this borders on unethical. Customers pay for and integrate a service that simply doesn't work as advertised. They make no offer to mitigate (e.g. change to a new shared IP). It's just "oh yeah, if you want the service to actually work reliably, you need to pay us 6X more".
Migrated to Postmark right away and we've been a happy customer for 2+ years now.
They need to do a better job of managing their shared IP pool. As it is, they are offering paid plans that are unsuitable for many common use cases. Really, unless you have control of all possible receiving domains (e.g you're using it for an internal app), you're rolling the dice.
Else, at a minimum, they should disclose deliverability metrics on their various plans so customers can make informed choices. As it is, their marketing is deliberately misleading.
Thanks for the feedback on Postmark. I'll have another look at them.
EDIT: Just glanced at Postmark and they're already looking much stronger than SendGrid, and with much better pricing. The "deliverability without a dedicated IP" language seems to be directly aimed at providers like SendGrid. Are they able to live up to that promise?
Also like their policy around content retention.
Will be exploring switching costs.
Postmark product manager here, so I'm a little biased but... yes we are! You can see our Time To Inbox stats on our status page: https://status.postmarkapp.com/
We also have a handy migration guide here: https://postmarkapp.com/migration-guides/sendgrid
Amazon SES shared IP pool isn't better than Sendgrid or Mailgun but their dedicated IPs are only $25/month. If your volume is low that might be the only cost since they offer 62k/month completely free and after that it's $0.1 per 1000 emails.
Unfortunately not a lot of providers offer dedicated IP option on lower level plans.
I think the main problem I have with SendGrid here is that they knowingly offer a paid product with such abysmal shared IP deliverability out of the gate, then offer no meaningful mitigation except to upgrade to a plan that includes the dedicated IP at a 6X premium, along with features many customers don't need (primarily send volume). Many customers will say "that's overkill, I don't need that send volume".
Very much a bait-and-switch feel to it. If they're going to offer the lower cost plans, then they need to be forthcoming about the disparity in deliverability. Instead, they say vague things like "own your reputation with a dedicated IP", when the truth is actually "12%-15% of your emails may suddenly stop being delivered unless you choose a dedicated IP plan".
Publish metrics and let people choose.
I am not familiar with products mentioned above but SendGrid is often discussed as a source of spoofed messages. They allow sending as 3rd party domains, or at least allowed it until recently. I suspect that this may be affecting their deliverability.
I use Postmark for everything that is very important that it gets through. I actually use mailgun for mass emails, marketing, announcements, etc.
On the other hand, postmark is a bit more flaky - I track delivery RTT and had had a few cases in my first year with them where Postmark had > 30m delays (and no outage reported). Sendgrid has always been bombproof on delivery times over many years of usage.
I still prefer Postmark on balance.
Postmark product manager here... I'd love to know more about this. We publish our Time To Inbox on our status page: https://status.postmarkapp.com/
The only time emails might sit for longer than a few seconds is if there is some issue with the account (such a accidental spam being sent due to form abuse). If you have specific examples, can you please email support@postmarkapp.com and we'll look into it for you?
Before being acquired, SG's support was fantastic. There are also various oddities that have cropped up, such as how they're currently hitting our webhook endpoint with the same event every 20 seconds for the past 8 days (a similar problem occurred last year too). They also seem to have suffered some dings to their IP reputation in numerous places due to, I assume, this: https://krebsonsecurity.com/2020/08/sendgrid-under-siege-fro... .. I continue to encounter numerous systems that flat out refuse any email from any IP I can muster at Sendgrid and we have a bunch on different subnets. So anyone who works at Red Hat, Packt, Akqa, Zendesk, etc.. they're not getting our mail.
We use Postmark as a fallback for users when we get the inevitable error messages back, and they have been pretty good, although I find their API a little too slow to move everything over to them and SG has a fantastic "delayed send" feature which is a must for deliverability to iCloud addresses.
Pragmatically I prefer Sendgrid, but Postmark is very good and feels somewhat more wholesome to use, particularly if your levels are low. I'd use Postmark for the same reason I'd rather use a local bakery than buy presliced at a supermarket.
Postmark product manager here... I'd love to know more about this. We publish our API response times on our status page (https://status.postmarkapp.com/), so this is a surprising comment. Can you email support@postmarkapp.com with your account details and we'll look into this for you?
Our email system is custom and does all of its own merging on a per subscriber basis, so we send a distinct request for every email, so even an otherwise minor difference between a 30ms and 85ms round trip "feels" slow at scale. I believe PM has a "batch" call available, but this requires some extra dev time at our end if it would resolve our issues (and it may!)
I will get in touch, though, in case there are ways to help mitigate this problem or if the batch mechanism will solve it all. We have previously encountered similar performance issues with SG from time to time due to DNS sending us to unsuitable endpoints, etc. so it can be a universal problem to some extent based on how we've approached the problem.
(Edit: Actually, that status page maybe demonstrates what I'm talking about, since the average API response time shown is 437ms. Even with 5 concurrent threads that would take 2.42 hrs to send 100,000 emails - so I am guessing the batch API is the way to go with PM :-))
What really sold me personally as a bootstrapper was how they offer initial credit for their services to help get going.
https://techcrunch.com/2019/04/01/mailgun-changes-hands-agai...
I wish Cloudflare would launch an email API service, seems a good fit for them.
Looks like they were recently aquired by another company trying to compete with Twilio. So maybe things will improve?
https://techcrunch.com/2021/09/30/sinch-acquires-pathwire-th...
The company I work for was bought by PE. Within weeks, most our hireable people left. Perhaps they were scared, perhaps they've seen it before, who knows. Some good people stay, but usually the comfortable ones, not the ones changing the world. How do I know, because I consider myself one of the competent comfortable ones, just being honest. But I'm leaving this year, it weighs on your soul. I barely do anything. At first it sounds like a dream, then you realize you're bored, not learning, and not working your brain.
Then, those useless asskissers you assumed wouldn't last long rise like cream to the top. They have no idea what they are doing, but are good at placating, and take positions of power.
From my perspective, it's easy to think PE people are dumb to let that happen. Maybe they are. Or maybe they don't care. Or maybe they are smart because they know these placaters will help 'sell' the company when it comes time to dump it. Make no mistake. PE exists to dump your company on some sucker.
I didn’t know I needed proof because people often resorted to victim blaming even though I never fell for any of the emails
Mailgun should have a way to monitor and block this. We used SMTP to interface with Mailgun and frankly, I didn't even think of this as being a vulnerability until I left the service. The DMARC reports just prove it was happening.
I was considering using Mailjet, but from the docs it looks like the inbound processing is not as sophisticated as Mailgun: we can't set inbound routes dynamically according to the destination email address.
The free tier or shared IP side is where these kinds of shenanigans can be played out.
Reported it a bunch of times, but gave up. No response, no fix... unfrotunate, because mailgun was a reaaally cool product
We use this staging environment to do as-much-as-possible end-to-end dry-runs of real work, and thought that mailgun's sandbox functionality would be an ideal fit for this - we get to test everything up to and including the mailgun api to find regressions or other issues.
...until it started sending real mails; and when we talked to their support staff the response was the frankly astonishing "yeah, that's by design, sandboxes will send real mail out of the sandbox when under unusually high load" (paraphrased).
Seriously, W.T.F.
Now, of course we can and do do normal testing with entirely fake data, but data-distribution dependent failures happen; that's kind of the whole point of a staging environment. I'm not sure what the point of mailgun's sandbox even is if it's useless for staging.
Gonna be fun on Monday looking into this, talking with leads, and looking for Mailgun alternates.
It's bad that their service allows this at all, but it isn't the end of the world for all of their customers.
If the bug is before any routing to which server to send from takes place... then it'll just end going out on the static IP all the same..
But if moving isn't a huge deal, there are plenty of recommendations in these comments of alternatives.
Seems easy enough to stop from what I know of email. Otherwise DKIM and SPF are worth nothing in systems like this.
Exchange even has a feature built in for exactly this, their send connectors can’t store more than one account.
Each message is uniquely signed by the sending domain belonging to the account owner, meaning that the domain reputation cannot be borrowed/shared between customers.
If you actually use mailgun yourself then you add mailgun to the list of permitted senders and probably add a DKIM key as well. When someone else then fakes your email address without any validation, mailgun might sign the message and bypass every anti spam measure there is.
This could be solved without validation (for example by using dedicated IP addresses and DKIM keys per domain and attaching those to your specific account and API keys) but that'd take some significant engineering effort (and address space, loads of servers are still configured IPv4 only for some reason).
From the screenshot, I gather that the DKIM checks failed already. That still makes mailgun an open relay, though, so they should be added to the necessary IP blacklists if they can't fix this problem.