# Postmark (en-US) Postmark is the most reliable way to get your transactional emails to the inbox. On our blog, we talk about new features and email delivery best practices. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing IP Allowlisting DevFeed: [Introducing IP Allowlisting]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2026-09-08T17:37:00Z Content type: release Language: en Sources: [Postmark (en-US)]() Topics: [Security](), [API](), [Network](), [Cloud]() Tags: [api](), [infrastructure](), [ip](), [nat](), [network](), [product-news](), [protection](), [range](), [request](), [security](), [token]() ### AI overview Postmark introduces IP Allowlisting, a security feature that restricts email sending through the Postmark API to up to 10 configured IP ranges in CIDR format. Requests from outside the allowed ranges are rejected with a 403 response. The ranges can be configured at the Server or account level, with Server settings overriding account settings. ### Source excerpt Good security is layered and each layer does a job the others can't. Scoping a token to a Server limits what it reaches. Rotating a token limits how long it lasts. Neither can say anything about where a request came from. We've been hard at work to ship a new layer of protection that can. IP Allowlisting is a new Postmark security feature that lets you name the infrastructure your email should come from. It's available now on all Postmark plans at no extra cost. It's off until you turn it on. How IP Allowlisting works You add up to 10 IP ranges, in CIDR format, that are allowed to send email using the Postmark API. Send requests from outside those ranges are rejected with a 403 status code that includes the IP the request came from. You can set your ranges in two places: On a Server. The ranges apply to that Server, covering every Message Stream on it. This is where we'd suggest starting. On your account. The ranges apply to every Server you have. When a Server has ranges of its own they will override account level settings. That's it! A straightforward security control to protect your API sending. Protect individual Servers or across your account. Set your Allowlist ranges on the account or Server. If you don't write CIDR blocks often, it's a quick 30 seconds to get familiar with them and the correct notation. CIDR blocks allow you to enable a grouped collection of IP addresses (aka ranges.) A CIDR block is an IP address followed by a suffix that says how many addresses it covers. The smaller the suffix, the wider the range: 198.51.100.24/32 one address, and only that address 203.0.113.0/24 256 addresses: 203.0.113.0 through 203.0.113.255 203.0.0.0/16 65,536 addresses: 203.0.0.0 through 203.0.255.255 So a /32 pins the allowlist to a single machine, and a /24 covers a subnet. Most teams end up somewhere in that span. Where you find your own ranges depends on how you send. A single VM has a static public IP you can read off your provider's dashboard. Cloud workloads ## The Postmark MCP server, one year later: from 4 tools to 24 DevFeed: [The Postmark MCP server, one year later: from 4 tools to 24]() Original publisher: [Read original article]() Author: Jabal Torres (jtorres@activecampaign.com) Published: 2026-07-21T16:05:00Z Content type: opinion Language: en Sources: [Postmark (en-US)]() Topics: [MCP](), [MCP Server](), [API](), [AI Agent]() Tags: [ai-agent](), [api](), [diagnostics](), [mcp](), [mcp-server](), [product-news](), [tool]() ### AI overview Postmark reflects on a year of developing and operating its MCP server, which grew from four tools to 24 in the official @activecampaign/postmark-mcp package. The article explains why designing tools around user outcomes, such as the diagnoseDelivery workflow, is different from mechanically wrapping API endpoints. ### Source excerpt About a year ago, we introduced something experimental from Postmark Labs: an MCP server that let an AI assistant send email through Postmark. It shipped with exactly one useful tool, sendEmail, plus three supporting ones (four total). You gave it a recipient, a subject, and a body, and it sent. We said at the time we'd started with a single Postmark server "because we had to start somewhere." A lot has happened since. The project graduated from Labs and became the official @activecampaign/postmark-mcp package, and along the way, we learned a lot about what it actually takes to put an AI assistant in front of a production email API responsibly. The latest release, v2.1.1, ships 24 tools across eight categories: sending, templates, message search, delivery diagnostics, bounces, suppressions, stats, and webhooks. But the tool count isn't really the story. The story is what a year of running this thing taught us: designing tools for an AI agent is a different discipline than wrapping an API, and once your server has an official name, everything downstream of that name needs to earn it. From one endpoint to a whole surface The original four tools mirrored individual Postmark endpoints directly. Getting from there to 24 the naive way -- one tool per endpoint, mechanically -- is where we started. But somewhere around tool ten, we realized that users interacting with an AI assistant don't conceptualize their needs as API calls. They approach it with human inquiries. That reframing shaped everything that mattered about the v2.0 release. Designing for outcomes, not endpoints The best example of that shift doesn't map to a single Postmark endpoint at all. It's called diagnoseDelivery, and it exists to answer one very human question: did my email actually reach this person, and if not, why? Before, answering that meant a five-step investigation across the dashboard: search outbound messages, pull the message details, read the event timeline, check the suppression list, check the ## Sending bulk email in Python? Prioritize practices that get your mail delivered DevFeed: [Sending bulk email in Python? Prioritize practices that get your mail delivered]() Original publisher: [Read original article]() Author: Greg Svoboda (gsvoboda@activecampaign.com) Published: 2026-07-14T18:13:00Z Content type: tutorial Language: en Sources: [Postmark (en-US)]() Topics: [Python](), [Code](), [CSV]() Tags: [code](), [deliverability](), [email](), [email-delivery](), [orchestration](), [python]() ### AI overview This tutorial explains how to send bulk email with Python while protecting sender reputation and deliverability. It argues that a basic smtplib script, CSV mailing list, and sending loop can cause delivery problems without a solid reputation-management foundation. ### Source excerpt Bulk email has a reputation problem, but users often misplace the blame. Recipients associate bulk email with spam, inbox clutter, and irrelevant marketing campaigns. Senders associate it with poor deliverability, complicated orchestration, and the constant fear of landing in spam folders. If you handle bulk email, these problems may sound familiar. The DIY Python approach -- install smtplib, divvy up your mailing list in a CSV file, set up a loop function, hope for the best -- all but guarantees delivery problems. The mail itself isn't the problem, though. Done properly, bulk email remains one of the most effective ways to communicate with customers at scale. The challenge is that mailbox providers aggressively punish bad sending behavior, even when it's unintentional. Successful bulk email happens when you prioritize your reputation and choose professional-quality tools to maintain it. We'll start with a high-level look at why we focus on reputation and then offer guidance on bulk email sending. Reputation: The start and end goal of successful bulk email Bulk email helps build relationships, educate customers, promote products, and keep brand image fresh. It can be tempting to dive in and start chipping away at those goals, but it's strategy that wins the race every time. Before sending anything to your bulk mailing list, let alone automating your bulk mail with Python code, turn your attention to your sender reputation: Mailbox providers use sender reputation scores to keep bad actors out of inboxes. Bad reputations mean undelivered mail. Your score combines signals from your domain, your content, and how recipients engage with your emails. Recipients read emails from senders they trust, improving your reputation. If they ignore, delete, unsubscribe, or report messages as spam, your reputation declines. The most successful bulk senders understand that reputation, deliverability, and engagement are tightly connected. And they only start sending when reputation manag ## Automate Python emails with attachments that get delivered DevFeed: [Automate Python emails with attachments that get delivered]() Original publisher: [Read original article]() Author: Greg Svoboda (gsvoboda@activecampaign.com) Published: 2026-06-30T15:08:00Z Content type: tutorial Language: en Sources: [Postmark (en-US)]() Topics: [Python](), [Security]() Tags: [attacks](), [best-practices](), [code](), [deliverability](), [email-delivery](), [files](), [how-to](), [phishing](), [python](), [security](), [zip]() ### AI overview This tutorial explains how to automate Python emails with attachments while improving deliverability. It covers common causes of attachment-related bounces, including security policies, sender reputation, and inbox-provider restrictions, and recommends examining SMTP bounce messages and error reports. ### Source excerpt Some of the most important emails require attachments, such as receipts, order confirmations, contracts, or digital assets. You need those emails to arrive automatically and reliably when customers and partners expect them. But attachments tend to increase bounce rates due to either security concerns, reduced engagement signals, or inbox provider policies, making deliverability harder to guarantee. A few key practices help you get top-tier deliverability when email attachments really matter: Follow general email guidelines Understand where problems happen and how to spot them Create processes that put best practices in motion Automate to scale your success for a higher volume Below, we'll show you how to implement these practices in a Python application. Why emails with attachments fail delivery Email bounces happen for a host of reasons. If you send attachments and see bounces, those files are likely causing delivery failures. Attachments pose security risks Phishing and malware attacks often use attachments, so inbox providers scrutinize them closely: Providers automatically block anything executable or compressed (e.g., .7z, .rar, .exe). This policy often extends to .zip files. Providers see red flags when you send unsolicited attachments, especially from new domains, even for "safe" file types like PDFs. Attachments affect sender reputation Recipients tend to avoid opening messages with unexpected attachments. Lower open rates, in turn, harm your domain reputation, making it even harder to deliver your emails. Improving your deliverability starts with digging into exactly where you're having problems. The first resource to consult is SMTP bounce messages. Study your bounce messages If your emails regularly bounce back, it's fair to assume the underlying issue is the file attachments. You can find out more by examining the error reports. The Postmark dashboard helps you make sense of errors. If you don't have the tool set up, you can look into the bounce messages ## Sending mission-critical emails in Python: SMTP or API? DevFeed: [Sending mission-critical emails in Python: SMTP or API?]() Original publisher: [Read original article]() Author: Greg Svoboda (gsvoboda@activecampaign.com) Published: 2026-04-29T15:24:00Z Content type: tutorial Language: en Sources: [Postmark (en-US)]() Topics: [Python](), [API](), [Protocol (disambiguation)](), [servers](), [Library]() Tags: [api](), [code](), [email-delivery](), [environment-variables](), [library](), [protocol](), [python](), [server](), [third-party]() ### AI overview This tutorial compares sending email from Python applications through SMTP versus an email provider's API. It explains SMTP's quick setup and portability, while noting scalability, spam-flag, troubleshooting, and functionality tradeoffs associated with each approach. ### Source excerpt If you need to send emails from an application, it's a good idea to think about how your usage changes over time. As with many technology choices, there's a tradeoff between up-front efficiency and long-term flexibility. You have two main choices for sending emails through your Python application. The first is SMTP -- the standard protocol for outgoing email. The second option sidesteps SMTP's complexities by using an email provider's API for richer functionality. This article compares sending email in Python using SMTP and API. SMTP is quick to set up--especially with a library like smtplib--but it won't scale as your app grows, puts you at risk of spam flags, and makes diagnosing problems complex. An API setup takes a little longer, but it yields dividends with features you can leverage in many ways. Go lean with SMTP SMTP is a basic, universal protocol for sending email. Direct SMTP implementation is as close as you can get to DIY email, but even the simplest sending setup still requires a third-party SMTP server. Technically speaking, you could host your own SMTP server, but it's rarely a good tradeoff. Inbox providers pay close attention to sender reputation to determine which emails make it through. An established SMTP service helps ensure your emails are actually delivered. The code below uses the Postmark SMTP servers. Start fast with common tools (like smtplib) Sending email with SMTP is straightforward and very similar in any application. Once set up, the advantage is that you can try a new service without completely overhauling your application -- you can change SMTP service providers using the same code. To implement SMTP in a Python application, use the built-in library called smtplib and follow these steps: 1. Import smtplib You don't need to install any new libraries -- the SMTP module is included when you install Python. Just import it, along with MIMEText, which helps with email formatting: import smtplib from email.mime.text import MIMEText 2. Set up yo ## We migrated our email infrastructure to KumoMTA. Here's why it matters for you. DevFeed: [We migrated our email infrastructure to KumoMTA. Here's why it matters for you.]() Original publisher: [Read original article]() Author: Alex Burch (aburch@activecampaign.com) Published: 2026-03-31T17:56:00Z Content type: article Language: en Sources: [Postmark (en-US)]() Topics: [migration](), [cloud-infrastructure](), [Open Source](), [Rust](), [API]() Tags: [api](), [engineering](), [hardware](), [infrastructure](), [migration](), [open-source](), [real-time](), [rust](), [traffic-management]() ### AI overview Postmark migrated its email infrastructure from PowerMTA to KumoMTA, an open-source, Rust-based mail transfer agent. The company says the change improves its ability to manage traffic in real time, scale on cloud infrastructure, and customize email delivery operations. ### Source excerpt If you've been sending email through Postmark lately, your messages have been moving through an entirely new engine (and you probably didn't notice a thing). That's exactly how we wanted it. We've completed our migration from PowerMTA to KumoMTA, an open-source, high-performance mail transfer agent (MTA). Every email Postmark sends now runs through KumoMTA. It's the biggest infrastructure change we've made in years, and it sets the stage for everything we want to build next. Wait, what's an MTA? An MTA,or mail transfer agent,is the software responsible for delivering your email. When you send a message through Postmark's API, our application processes it, and the MTA takes it from there: queuing, connecting to the recipient's mail server, and handling the SMTP transaction that gets your message where it needs to go. Think of it as the delivery truck for your email. You hand us the package, and the MTA figures out the fastest route to the door. Why we made the switch Postmark has been running PowerMTA for years, and it served us well. But as our needs evolved, the limitations became harder to work around. The biggest issue? Traffic management. Our previous setup made it difficult for our deliverability and operations teams to respond in real time when something went sideways, like when a mailbox provider temporarily blocks an IP address. In those moments, you need to be able to back off traffic, reroute, and adjust shaping on the fly. Our old configuration didn't give us that flexibility at the MTA level, which meant we were sometimes limited in how quickly we could resolve delivery issues. Beyond that, our previous infrastructure was running on aging hardware that was increasingly difficult to maintain. Scaling required a lot of manual effort, and customizing behavior to match Postmark's specific needs was constrained by the proprietary nature of the platform. We needed something that could grow with us, and that we could shape to fit the way Postmark works, not the ## Teach your AI coding agent how to send email with Postmark Skills DevFeed: [Teach your AI coding agent how to send email with Postmark Skills]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2026-02-27T13:41:00Z Content type: release Language: en Sources: [Postmark (en-US)]() Topics: [Agent Skills](), [AI-assisted coding](), [API](), [Command-line interface](), [Claude Code](), [cursor](), [GitHub Copilot](), [codex](), [Claude]() Tags: [agent-skills](), [ai-coding](), [ai-coding-agents](), [api](), [claude-code](), [cli](), [codex](), [coding-agents](), [cursor](), [email](), [gemini](), [github-copilot](), [openai](), [product-news](), [skills]() ### AI overview Postmark announces Postmark Skills, an open-source set of Agent Skills that gives AI coding agents specialized knowledge for working with the Postmark API. The skills provide best practices, code examples, API details, and common mistakes to help agents generate more accurate email integration code. ### Source excerpt If you've ever asked an AI coding agent to help you integrate email into your app, you've probably gotten code that looks right but isn't quite right. Maybe it used an outdated endpoint. Maybe it forgot about Message Streams entirely. Maybe it hallucinated a method that doesn't exist. (We've seen all three.) AI agents are only as good as the context they have, and until now, most of them had to rely on whatever fragments of Postmark documentation made it into their training data. Today, we're releasing Postmark Skills, a set of open source Agent Skills that teach AI coding agents how to work with Postmark correctly. What are Agent Skills? Agent Skills are an open standard for giving AI coding agents specialized knowledge. Think of them as instruction manuals that your agent reads before writing code, except these manuals are structured specifically for how AI models process information. Each skill is a folder with a SKILL.md file that contains best practices, code examples, API details, and common mistakes to avoid. When you install a skill, your AI agent loads it as context and uses it to write better, more accurate code. Skills work with Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Gemini CLI, and a growing list of other tools. If your agent can read a markdown file, it can use a skill. What's included Postmark Skills covers five areas of the Postmark API: Sending email -- Everything your agent needs to send transactional or broadcast emails through Postmark. Single sends, batch sends (up to 500 per request), template-based sends, and the Bulk API for campaigns. The skill includes the decision logic for when to use each approach, proper Message Stream handling, error codes and retry strategies, and attachment support, including batch attachments, which some alternatives don't support. Inbound email processing -- Building workflows that receive and parse incoming email. Reply-by-email threading, email-to-ticket systems, document extraction from attachments, and ## Making AI assistants better at email: Postmark's new documentation tooling DevFeed: [Making AI assistants better at email: Postmark's new documentation tooling]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2025-11-24T18:13:00Z Content type: article Language: en Sources: [Postmark (en-US)]() Topics: [Documentation](), [Artificial Intelligence](), [Model Context Protocol](), [MCP Server](), [API](), [ChatGPT](), [Tooling](), [Claude]() Tags: [ai](), [ai-assistants](), [ai-tools](), [api](), [chatgpt](), [claude](), [code](), [documentation](), [error-handling](), [mcp](), [mcp-server](), [product-news](), [security](), [tooling]() ### AI overview Postmark describes three updates intended to help AI assistants provide more accurate email-integration guidance: an llms.txt file with structured API and documentation context, pre-built prompts for common integration tasks, and an experimental MCP server that connects assistants to Postmark capabilities. ### Source excerpt Getting an AI assistant to help with your email integration shouldn't feel like explaining SMTP to your cat. But until recently, that's kind of what it was like - AI tools could tell you about email APIs, but they often got the details wrong or gave you outdated information. We've been thinking about this problem, and we've shipped three updates to make AI assistants genuinely useful when you're working with Postmark. What we built1. llms.txt: Context for AI assistants We published an llms.txt file that gives AI tools like ChatGPT and Claude accurate, structured information about Postmark's API, features, and best practices. Instead of AI assistants guessing or making assumptions about our documentation, they can now reference this file to give you correct details about authentication, endpoints, message streams, deliverability features, and integration patterns. How to use it: When you need help with Postmark integration, troubleshooting, or understanding specific features, paste https://postmarkapp.com/llms.txt into your AI tool. Your assistant will have the context it needs to provide better, more accurate guidance. 2. Pre-built AI prompts We added an AI prompts section to our documentation with ready-to-use prompts for common integration tasks. Each prompt is designed to generate production-ready code that includes error handling, best practices, and proper Postmark API usage. Copy a prompt, paste it into your AI tool, and get working code. Available prompts: Node.js email integration Rails with ActionMailer setup Laravel Mail configuration Password reset flows Event-driven notification systems Inbound email processing Better Auth integration You'll save time - no more documentation deep-dives just to send a welcome email. You'll also avoid common mistakes since the prompts include our recommendations for deliverability, security, and reliability. 3. Postmark MCP server: AI assistants that actually do things Earlier this year, we launched our Model Context Proto ## How to keep your Postmark account secure: Best practices guide DevFeed: [How to keep your Postmark account secure: Best practices guide]() Original publisher: [Read original article]() Author: Postmark team (fdossetto+postmark@activecampaign.com) Published: 2025-10-21T14:42:00Z Content type: tutorial Language: en Sources: [Postmark (en-US)]() Topics: [Secrets Management](), [Security](), [Application Security](), [API](), [Node.js]() Tags: [api-security](), [application-security](), [authentication](), [deployment](), [engineering](), [error-handling](), [secrets-management](), [security]() ### AI overview This guide explains how to secure Postmark accounts and API tokens using OWASP-aligned practices. It emphasizes validating tokens, securing configuration and deployment processes, validating data, preventing credential leaks in error messages, and storing credentials in dedicated secrets management tools rather than code repositories. ### Source excerpt Your Postmark API tokens are the keys to your email kingdom. One exposed token can mean unauthorized access to your account, potential data breaches, and a whole lot of stress you don't need. The good news? Keeping your account secure doesn't have to be complicated. This guide covers the essential practices that'll help you sleep better at night, knowing your Postmark credentials are locked down tight. Following Industry Standards: OWASP Guidelines When it comes to web application security, you don't have to reinvent the wheel. The Open Web Application Security Project (OWASP) provides comprehensive, industry-standard guidance that's trusted by security professionals worldwide. The OWASP Web Security Testing Guide The OWASP Web Security Testing Guide is an essential resource for developers who want to build secure applications. While it covers much more than just secret management, several sections are particularly relevant to protecting your Postmark credentials: Key areas that apply to API security: Authentication Testing - Ensuring your API tokens are properly validated Configuration and Deployment Management Testing - Securing your deployment pipeline Data Validation Testing - Validating inputs that might expose credentials Error Handling - Ensuring error messages don't leak sensitive information Applying OWASP Principles to Your Email Infrastructure Here's how OWASP best practices translate to protecting your Postmark setup: Secure Configuration Management: Follow OWASP's guidance on configuration security by keeping all sensitive Postmark credentials in dedicated secrets management tools, never in code repositories. Why OWASP Matters for Email Security Email infrastructure is often overlooked in security assessments, but it's a critical attack vector. A compromised email service can lead to: Account takeover attacks through password reset emails Data exfiltration via email forwarding Social engineering attacks using legitimate email channels Compliance violati