
| Feature | Included | From plan | Verdict |
|---|---|---|---|
| REST email API | Yes | Free | Full send API, no tier gate |
| SMTP relay | Yes | Free | Same surface as the API |
| Multi-region SMTP routing | Yes | Free | Failover routing on every plan |
| Bulk Email API | Yes | Free | Checked on all four tiers |
| Batch sending, 500 per request | Partial | Basic | Grid withholds it from Free |
| Transactional message streams | Yes | Free | Separate IP pool, always on |
| Broadcast message streams | Yes | Basic | 15, then 30, then unlimited |
| Stored templates | Yes | Free | 100 per server, hard ceiling |
| Loops and conditionals in templates | Yes | Free | Rare at this price point |
| Layout templates | Yes | Free | One shell wraps many templates |
| Template push between servers | Yes | Free | Dry run before applying |
| Template editor and import tool | Yes | Free | Included on every tier |
| Event webhooks | Yes | Free | Seven event types, no gate |
| Webhook retries | Partial | Free | Six attempts inside one hour |
| HMAC webhook signatures | No | — | Explicitly unsupported today |
| Webhook IP allowlist | Yes | Free | Documented ranges to pin |
| Basic auth on webhook URL | Yes | Free | Credentials live in the URL |
| Inbound processing | Yes | Pro | The only real feature wall |
| Inbound domain forwarding | Yes | Pro | Your domain, not a hash address |
| Inbound spam scoring | Yes | Pro | Spam headers passed straight through |
| Inbound blocking rules | Yes | Pro | Filter before it reaches you |
| Open tracking | Yes | Free | Pixel plus dedicated webhook |
| Link tracking | Yes | Free | Click webhook included |
| Suppression management | Yes | Free | API driven, on every plan |
| Automatic suppression | Yes | Free | Hard bounces removed for you |
| Granular bounce data | Yes | Free | Typed bounce records, not codes |
| Stats API | Yes | Free | Rates queryable, not just shown |
| Custom tagging | Yes | Free | Slice stats your own way |
| Sandbox mode | Yes | Free | Test token, no delivery |
| Activity retention | Partial | Basic | 45 days, longer costs extra |
| Custom retention add-on | Yes | Pro | From $5/month, Pro or higher |
| Dedicated IPs | Yes | Pro | From $50/month per IP, volume floor |
| DKIM, SPF and DMARC setup | Yes | Free | Authentication is not upsold |
| DMARC monitoring add-on | Yes | Free | $14/month per domain, any plan |
| Two-factor authentication | Yes | Basic | Absent from the free tier |
| API permission controls | Yes | Basic | Scoped tokens need a paid plan |
| User roles | Yes | Free | Server admin split from owner |
| Team seats | Partial | Basic | 4, then 6, then unlimited |
| Servers | Partial | Basic | 5, then 10, then unlimited |
| Custom sending domains | Partial | Basic | 5, then 10, then unlimited |
| Official MCP server and CLI | Yes | Free | Agent tooling published, not promised |
| Contact lists and segmentation | No | — | No audience layer at all |
| Signup forms | No | — | Nothing hosted, bring your own |
| Landing pages | No | — | Not part of the product |
| A/B testing | No | — | No split testing anywhere |
| SMS | No | — | Email only, no other channel |
Webhooks are on the free tier, with seven event types: delivery, bounce, spam complaint, open tracking, click, subscription change and inbound. Only the last carries a plan condition, because inbound itself needs Pro. The rest fire from the first free send.
The retry policy is where the detail matters. Postmark retries on 5xx, 408, 429 and network failures, never on a 4xx. The schedule is six attempts spaced 1, 5, 10, 10, 10 and 15 minutes apart, so the whole retry window closes in about fifty minutes. An endpoint down for a two hour maintenance slot does not get its events replayed afterwards — it loses them. If your consumer cannot promise better than an hour of uptime, put a queue in front of it.
Security is the other place to read carefully. You can pin Postmark’s published IP ranges, put basic auth credentials in the webhook URL and insist on HTTPS. What you cannot do is verify a signature: the documentation states plainly that Postmark does not currently support HMAC webhook signature verification. Your endpoint therefore authenticates the sender by source address or by a secret sitting in a URL, both of which are weaker than a signed body, and both of which leak into logs more easily than a header does. Treat the payload as unauthenticated input and re-fetch anything consequential through the API.
Templates are free, stored server side, and capped at 100 templates per server. Two kinds exist: standard templates carrying a subject, an HTML body and a text body, and layout templates that wrap a standard template through a content placeholder, so a shared header and footer live in one place.
The templating language is the reason to care. Alongside plain substitution such as {{name}} and dotted paths such as {{company.name}}, it supports conditional blocks and iteration — {{#each person}} walks a list. That sounds unremarkable until you compare it with the stored templates of other transactional providers, several of which offer substitution and nothing else. An order confirmation with a variable number of line items, an invoice with a variable number of rows, a digest with a variable number of items: all of these stay inside a stored Postmark template instead of being rendered in your application and pushed as raw HTML.
The workflow around them is unusually grown up too. Templates can be pushed from one server to another, and the push accepts a dry run flag so you can see what would change before it changes — a staging server and a production server holding the same set, with a reviewable promotion between them.
Two limits to plan around. The hundred is per server, not per account, so a multi tenant setup that gives each customer a server multiplies templates fast but also multiplies the ceiling. And there is no A/B testing anywhere in the product, so comparing two versions means splitting traffic yourself and reading the difference from the Stats API.
The free tier is a real tier. It carries ten servers, ten sending domains and six users — more of each than Basic, which drops to five, five and four. Basic buys two factor authentication, API permission controls, batch sending and broadcast streams; it does not buy headroom. Read the free column as a feature tier, not a trial.
The pricing grid contradicts itself on batch sending. Bulk Email API is checked on all four plans while batch sending is dashed on Free. The API reference gates neither, and states a ceiling of 500 messages per batched request with a 50 MB payload. We kept the grid’s stricter reading in the matrix and flag it here rather than pick a side.
Retention is bounded and the extension is gated. Paid plans keep detailed activity for 45 days. Longer windows exist only as an add-on from $5/month, and only on Pro or higher, so an investigation reaching back a quarter is a decision made in advance, not a support request made after the fact. Dedicated IPs are gated the same way: Pro or higher, from $50/month per IP, with a sending floor of 300,000 messages a month before Postmark will warm one.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.