Postmark: highest deliverability for transactional emails from the USA

What is Postmark?

Postmark is a US sending service for transactional emails, run by the Wildbit team (part of the ActiveCampaign group since 2022). Unlike Brevo or Mailjet, Postmark serves only one segment: individual user-triggered mails such as password resets, order confirmations, dunning notices, login codes or audit-trail messages. Marketing newsletters are NOT supported -- there are even separate sending servers for transactional and broadcast, so an accidental newsletter wave does not damage the reputation of the transactional stream.

This tight focus explains the highest documented deliverability on the market. In quarterly benchmarks from EmailToolTester (Q1 2026) and Mailgun own comparison study, Postmark sits above 99 percent inbox rate across Gmail, Outlook and Yahoo combined. Competitors like SendGrid and Mailgun range between 92 and 95 percent -- the gap sounds small but becomes 30-40 extra lost dunning mails at 500 per month.

As of May 2026, Postmark hosts in AWS regions us-east-1 (Virginia) and us-west-2 (Oregon). An EU region has been announced repeatedly but is not yet productive by May 2026. This is the Achilles heel for Swiss fiduciary and law-firm applications: Postmark requires a third-country transfer impact assessment (TIA) per revFADP Art. 16, because client data flows into the US stack.

Postmark charges EUR 15/month for 10,000 outgoing mails, bulk tiers from 50,000 mails scale to USD 1.25 per 1000. Inbound mail via webhook (inbound streams) is included in the price -- a plus that most competitors lack or charge extra for.

Why it matters for Swiss SMEs

Three hard arguments speak for Postmark in dunning and audit mail traffic: documented deliverability, inbound routing, and clarity of bounce codes.

Deliverability: Whoever sends a third dunning notice whose content is legally relevant (delay, collection threat, audit trail) cannot afford the spam folder. Postmark runs strictly separated IP pools for transactional mail and excludes senders who attempt marketing-like content immediately -- this protects the reputation of remaining users. Inbox rate 99.2 percent (EmailToolTester Q1 2026, n=500 per provider) is not exaggeration but measurable.

Inbound streams: Postmark accepts unlimited incoming mail per account at addresses like support+ticket@<inbound-id>.inbound.postmarkapp.com, parses header, body and attachments, and delivers it as JSON to any chosen webhook. This routes fiduciary client requests (see ai-mandantenanfragen) automatically into a ticket system, without IMAP polling or own mail parsers.

Bounce clarity for CH-DSG: Postmark delivers RFC-compliant SMTP codes plus its own structured bounce classification (HardBounce, SoftBounce, SpamComplaint, ManuallyDeactivated). The webhook delivers event JSON that maps directly into revFADP audit logs -- provably documenting what was delivered to whom and when.

The big snag remains US hosting. A fiduciary firm with professional secrecy (Art. 321 SCC) must safeguard Postmark with TIA, pseudonymisation in the mail body, and explicit client consent. Whoever does not want to do that, stays with Brevo (FR), Mailjet (FR) or Infomaniak (CH).

How it works

Postmark exposes two send paths: SMTP relay and REST API. Both use the same server token generated per "Server" (Postmark term for a logical tenant).

SMTP relay: Host `smtp.postmarkapp.com`, port 587 STARTTLS or 2525, user `postmark-server-token`, pass the API token string. Any classical mail framework (Nodemailer, PHPMailer, Symfony Mailer, Django EmailBackend) works without code change.

REST API: Endpoint `https://api.postmarkapp.com/email`, header `X-Postmark-Server-Token`. Minimal cURL example:

``` curl -X POST "https://api.postmarkapp.com/email" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "X-Postmark-Server-Token: <SERVER_TOKEN>" \ -d '{ "From": "invoice@firm-müller.ch", "To": "[email protected]", "Subject": "Dunning No. 3 - Invoice 2026-104", "TextBody": "Dear Mrs Berger, ...", "MessageStream": "outbound" }' ```

The response delivers a `MessageID` stored in the audit log and later correlated with bounce/open/click events.

DNS setup: Postmark generates a DKIM record per sender domain (TXT, selector `<id>._domainkey.<domain>`), an optional Return-Path subdomain (CNAME for SPF alignment on the custom domain rather than pm-bounces.net), and an SPF include `include:spf.mtasv.net`. DMARC stays the domain owner responsibility, recommendation `v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@<domain>`. Since 2025, Postmark enforces DKIM on every sender -- no DKIM, no send.

Inbound streams: In the dashboard under "Servers > Inbound Stream", set a webhook. Postmark then generates an inbound address routable by MX record to the own domain (`MX 10 inbound.postmarkapp.com`). Incoming mails arrive as POST requests with JSON payload to the webhook -- subject, body (text and HTML), attachments as Base64.

Test and monitoring: Postmark provides a sandbox-mode test account where mails are processed but not delivered. Before production: create a real server, send three test mails to Gmail/Outlook/Bluewin, check inbox position. The dashboard "Activity" gives a real-time list with filters (bounces, opens, spam complaints) -- the most direct view of all tested providers.

Postmark setup in 5 steps

1. 01Create a Postmark account, create a server (logical tenant), copy the server token.
2. 02Add a sender signature in the dashboard, set DKIM and return-path DNS records in Cloudflare as DNS-only.
3. 03Set the DMARC record manually, initially p=none for 14 days of observation, then raise to quarantine.
4. 04Wire the application: server token in .env (POSTMARK_TOKEN), send via REST `https://api.postmarkapp.com/email` or SMTP `smtp.postmarkapp.com:587`.
5. 05Set bounce and spam webhooks in the server settings, monitor events in Loki/Grafana, verify Mail-Tester.com at 10/10.

When Postmark fits

Postmark is the right choice when (a) every single mail is legally or financially relevant (dunning, audit logs, invoice PDFs, login codes with 2-factor auth), (b) volume sits below 100,000 mails per month, and (c) the third-country transfer assessment with TIA and pseudonymisation is acceptable.

Concrete cases: A Swiss fiduciary with 80 clients and monthly 1,500 invoice mails plus dunning benefits from deliverability. A platform with 2-factor login (TOTP codes by mail) needs Postmark, because a lost login code locks the user for 5 minutes -- Brevo or SES are 1-2 percentage points worse here. A law-firm mailbox with inbound routing for client requests works directly with Postmark, without IMAP polling.

At Fairlane, Postmark runs authentication mail (login OTP) and revFADP audit reports to clients because deliverability here clearly beats the TIA cost.

When not to use

Postmark is the wrong choice when (a) marketing and newsletter business must be served at the same time -- Postmark is deliberately not a vendor for that, here Brevo or Mailjet suffice, (b) volume exceeds 200,000 mails per month -- from there Amazon SES (USD 0.10 per 1000) becomes more economical, or (c) professional secrecy (Art. 321 SCC) tolerates no third-country transfer -- then Infomaniak Mail Sender or self-run Postfix.

More pitfalls: forgetting sandbox mode in production and wondering why nothing arrives. Not setting DKIM -- Postmark blocks DKIM-less senders since 2025. Pushing marketing-like mail (promo newsletters, sales pitches) over the transactional server -- Postmark deactivates such accounts fast. Exceeding the 100/month free tier without upgrade -- mails get 429 rejected rather than delayed.

Trade-offs

FAQ

Related topics

Sources

1. Postmark Pricing 2026 · 2026-05
2. EmailToolTester -- Best Transactional Email Services Q1 2026 · 2026-04
3. Postmark Documentation -- Inbound Streams · 2026-03
4. Postmark DKIM Enforcement Notice · 2026-05