Mailgun: API-strong sending with EU region Frankfurt for developer teams

What is Mailgun?

Mailgun is a US sending platform for transactional and bulk mail, part of the Swedish Sinch group since 2021 (formerly Rackspace subsidiary). Unlike Postmark, which focuses on individual transactional mail, Mailgun covers both worlds: individual sending (login codes, dunning) and bulk sending (newsletters, onboarding sequences) in the same account, with separated IP pools and tracking.

The brand core has sat with developer teams since 2010: REST API, well-documented SDKs in PHP, Python, Ruby, Node.js, Go, Java, .NET and Elixir, plus a flexible "Routes" system for inbound mail with pattern matching (regex on recipient address). Mailgun was one of the first providers to treat webhooks for events (delivered, bounced, complained, opened, clicked) as first-class citizens -- it shaped the DX standard in the industry.

As of May 2026, Mailgun hosts in two main regions: US (api.mailgun.net, AWS us-east-1) and EU (api.eu.mailgun.net, AWS eu-central-1, Frankfurt). The EU region must be chosen explicitly at domain creation -- later switching is not possible. Data and logs remain in the chosen region. The DPA is downloadable directly in the dashboard, GDPR-compliant.

Pricing (May 2026): "Foundation" USD 35/month for 50,000 mails incl. 5-day log retention, "Growth" USD 90/month for 100k mails plus 30-day logs, "Scale" USD 600/month for 1M mails plus dedicated IP. The free tier was abolished in 2024, a trial month (5,000 mails) remains.

Why it matters for Swiss SMEs

Mailgun has three specific advantages for Swiss setups: the EU region Frankfurt, the mature API, and the Routes feature for inbound mail.

EU region Frankfurt partially solves the third-country problem: domain registered at `api.eu.mailgun.net`, data and logs remain in DE. In a revFADP third-country test, a TIA is easier to argue because the main data flow stays inside the EU. Sinch as a group sits in Sweden, the contract partner can be an EU subsidiary on request. This places Mailgun in a compliance corridor similar to Brevo or Mailjet -- with the caveat that the group ties remain closer to the US (Sinch has US listing).

API maturity is the main advantage. The Mailgun API has 15 years of seasoning, visible in details: idempotency keys, batched sending ("Batch Sending" with recipient variables for personalised mail to 1000 recipients in one API call), templating with variables, inline attachments, test mode per domain. SDKs are currently maintained -- PHP, Python and Node.js receive monthly updates even in 2026.

Routes for inbound: Mailgun allows multiple routes per domain with pattern matching. Example: `match_recipient("support-.*@firm.ch")` triggers webhook A, `match_recipient("audit-.*@firm.ch")` triggers webhook B. This routes client requests per category to different handlers without building own mail parsers.

The trade-off: Mailgun is 2-3 percentage points behind Postmark on deliverability (93-95 percent). At low volume (below 10k/month), Postmark is cheaper and delivers better. Mailgun pays off from 30k+ mails/month and when API breadth matters.

How it works

Mailgun offers three send paths: SMTP relay, REST API and SDKs.

SMTP relay: Host `smtp.mailgun.org` (US) or `smtp.eu.mailgun.org` (EU), port 587 STARTTLS or 465 SMTPS. User: `postmaster@<mail-domain>`, pass: SMTP credentials from the dashboard. Works with any classical mail framework.

REST API: Endpoint `https://api.eu.mailgun.net/v3/<mail-domain>/messages`, HTTP Basic Auth with `api:<API-Key>`. cURL example:

``` curl --user "api:${MAILGUN_API_KEY}" \ -X POST "https://api.eu.mailgun.net/v3/mg.firm-mueller.ch/messages" \ -F from="Firm Müller <[email protected]üller.ch>" \ -F to="[email protected]" \ -F subject="Dunning No. 2 - Invoice 2026-104" \ -F text="Dear Mrs Berger, ..." \ -F "o:tag=dunning-stage-2" \ -F "o:tracking=yes" ```

The `o:tag` is Mailgun-specific and enables aggregated per-tag statistics in the dashboard.

DNS setup: Mailgun requires four records per sender domain: SPF (TXT `v=spf1 include:mailgun.org ~all`), DKIM (TXT, selector `pic._domainkey` or custom), MX (two records `mxa.mailgun.org` and `mxb.mailgun.org` -- only when inbound routes are used), and a tracking CNAME `email.<domain>` pointing to `mailgun.org`. DMARC recommendation as always: `p=quarantine; pct=100`.

Routes: Definable in the dashboard under "Receiving > Routes". Filter expression: `match_recipient("support@<domain>")`, action: `forward("https://firm.ch/api/inbound")` or `store()`. Multiple routes per account, priorities settable.

Webhooks: One endpoint per event type (delivered, opened, clicked, unsubscribed, complained, failed). HMAC-SHA256 signature in header `X-Mailgun-Signature` allows authenticity check. Retries: 3 attempts over 8 hours, then dropped -- the receiver must return 200 OK.

Test and monitoring: Mailgun offers a test mode per domain (all mails marked "delivered" but not actually sent). In live mode: dashboard yields per-day time series (sent, delivered, bounced, opened, clicked). Stats API allows programmatic export -- ideal for custom Grafana dashboards.

Mailgun setup in 5 steps

1. 01Create a Mailgun account, when adding the domain explicitly choose EU region (api.eu.mailgun.net) -- switching is not possible later.
2. 02Set four DNS records in Cloudflare as DNS-only: SPF, DKIM, optionally MX (for inbound), tracking CNAME. Wait 24h for propagation.
3. 03Set the DMARC record manually to p=none for 14 days, then raise to quarantine.
4. 04Wire the application: API key in .env (MAILGUN_API_KEY), domain in MAILGUN_DOMAIN, send via REST `https://api.eu.mailgun.net/v3/<domain>/messages`.
5. 05Set webhooks for delivered, bounced, complained, verify HMAC signatures, visualise stats API in Grafana.

When Mailgun fits

Mailgun is the right choice when (a) volume sits between 30,000 and 500,000 mails per month, (b) the application sends both transactional and bulk mail, and (c) developer experience with a mature API matters. Plus: when inbound routing with complex pattern matching is needed, Mailgun clearly beats Postmark.

Concrete cases: A Swiss SaaS platform with 80,000 login and notification mails per month gains from the Mailgun Foundation tariff (USD 35 for 50k) versus Postmark (USD 75 at same volume). A fiduciary client platform with incoming mail to `audit-<client-id>@firm.ch` needs route patterns -- more comfortable in Mailgun than in Postmark Streams. An e-commerce shop with order confirmations plus weekly newsletter in the same account saves administration.

For DACH/Swiss setups always pick the EU region -- choose at creation time, because switching later is not possible.

When not to use

Mailgun is the wrong choice when (a) maximum deliverability for legally relevant single mail is needed -- then Postmark at 99 percent instead of Mailgun at 94 percent, (b) volume is below 10,000 mails per month -- there Brevo Free or Postmark Starter are more economical, or (c) the fiduciary practice demands exclusively Swiss hosting -- then Infomaniak.

More pitfalls: US region accidentally chosen, sending client data into us-east-1 without EU containment. Free-tier expectation -- gone since 2024, only a 5k-mail trial month remains. DKIM selector entered with wrong value (Mailgun generates pic._domainkey, many others use mail._domainkey -- do not mix). Activating inbound routes without MX setup -- without MX, no mail arrives, the failure is silent.

Trade-offs

FAQ

Related topics

Sources

1. Mailgun Pricing 2026 · 2026-05
2. Mailgun Documentation -- EU region · 2026-04
3. Mailgun Routes Documentation · 2026-03
4. Sinch Group -- DPA and GDPR commitments · 2026-05