Amazon SES vs MailPace

Amazon SES 89

IAM with policies per action and identity, condition keys such as ses:FromAddress, temporary credentials and rotation (30). Policies can allow only SendEmail from one identity, and AWS has a read-only managed policy. No confirmation step, which IAM leaves to the caller (16). The API doesn't return third-party content. Inbound mail goes to S3, SNS or Lambda rather than through SES calls (10). CloudTrail records SES API calls and configuration sets publish per-message events (15). SES is in scope for SOC 1, 2 and 3 (page updated 11 August 2026, re-read on 1 November), AWS runs a vulnerability disclosure programme on HackerOne with a safe-harbour policy and publishes security bulletins, none of the 39 in the feed on 1 November naming SES. The aws.amazon.com security.txt is valid to 16 October 2027. The disclosure policy names no bug bounty, so 2 points stay held back, as on the other AWS listings (18). 30 + 16 + 10 + 15 + 18 = 89.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

Amazon SES 85

No OpenAPI, but the SES v2 Smithy model is published in aws/api-models-aws with types, required members and enums (25). llms.txt for the developer guide with Markdown pages, 228 links on 1 November (10). The API reference explains each action, rarely when not to use one (12). Typed inputs from the model, with enums and length limits (14). Each action lists its errors, and the guide has examples (12). Versioned API (2019-09-27). The document history looped on 1 October, redirected to the guide's front page on 6 and 17 October and answered 404 as Markdown on 1 November, so we lean on the model's dated changes, the newest on 8 October 2026 (12). 25 + 10 + 12 + 14 + 12 + 12 = 85.

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

Amazon SES 85

The SES v2 model last changed on 8 October 2026 (CreateExportJob documentation, commit 11f19c6), still the newest SES or SES v2 change in aws/api-models-aws on 1 November (repository head 30 October), 24 days earlier (30). SES v2 model changes on 20 August, 1, 17 and 29 September and 8 October, five in the 90 days from 3 August (20). Closed service with dated SDK changelogs and AWS re:Post. Direct support is a paid plan (10). Official SDKs released daily, aws-sdk-js-v3 v3.1161.0 tagged on 30 October (15). The JavaScript SDK repository releases from CI every working day (10). 30 + 20 + 10 + 15 + 10 = 85. The recency line drops to 20 after 7 November unless the SES models change again.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

Amazon SES 87

Closed service under the AWS Customer Agreement, with Apache-2.0 SDKs (20). The AWS privacy notice (Last Updated 18 May 2026) and customer agreement cover SES, and AWS's sub-processor page, re-read on 1 November and now last updated 30 October 2026, ties sub-processors to the AWS Data Processing Addendum and names the entities that sell and provide SES. SES encrypts stored data at rest and uses opportunistic TLS by default. The data protection page, re-read on 1 November, links a page on deleting personal data but states no SES-specific retention period (18). The move of new accounts to the Essentials plan carries a dated notice (21 July 2026) on the pricing page, and AWS dates API changes in the SDK changelogs (15). Data stays in the Region the customer picks, quotas, plans and sandbox status are per Region, and the sub-processor list is public with 30 days' notice of new ones (20). 20 + 18 + 15 + 20 = 73.

MailPace 75

Closed hosted service under terms that name OhMySMTP Ltd with its company number. The MCP server, SDKs, landing site and status page are MIT (18 of 30). The privacy policy (30 August 2026), the pricing page and the DPA agree on retention, 30 days in the dashboard and 7 more in backups, 37 days at most (25 of 30). The API reference promises an old version runs until a published end-of-life date, and the terms list dated changes. The terms also say changes apply immediately (8 of 20). Sub-processors listed with purpose and location, Freethought hosting in the EU, Hetzner backups in Germany, AppSignal in Amsterdam, Paddle in the UK and Tutanota in Germany (18 of 20). Total 69.

Amazon SES 64

No SES-specific MCP. The AWS MCP Server with an amazon-ses skill covers sending setup only. API responses are compact and list actions take PageSize and NextToken (15). Paginated lists and filters on suppression and contact lists (15). SendEmail declares eight typed errors, among them MessageRejected, MailFromDomainNotVerifiedException, SendingPausedException and TooManyRequestsException (16). No idempotency token on SendEmail, so a retried send can go out twice. SDK retries cover throttling (8). SDKs in every major language, but every call needs SigV4 and a send needs a nested Content structure (10).

MailPace 71

Responses are small, the send returns an id and status and Email Status returns one email (18 of 25). Only the domains list takes limit, offset, sort and direction; there is no endpoint to list or search sent mail (8 of 20). Errors are JSON with a human message and an HTTP status for each case in the documented table, with no stable error codes (14 of 20). Idempotency-Key on sends, kept 24 hours per token, and failed validations are not stored so they can be retried. The MCP server marks send as not idempotent and revoke as destructive (18 of 20). A send needs from, to, a subject and a body; official libraries for Node, Rails, Go and PHP transports and an SMTP route (13 of 15). Total 71.

Amazon SES 75

AWS Health Dashboard with per-service, per-Region history and RSS feeds (20). AWS's dashboard history file, re-read on 1 November, lists Amazon Simple Email Service in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status. On 15 September 2026, inside the 90-day window, AWS said it can't restore resources and data hosted only in me-south-1 or in the mec1-az2 zone. No update or new SES event since then, and the SES us-east-1 feed is empty on 1 November. One major event, read as the S3, Secrets Manager and Polly re-checks read it (10). The 15 September update leaves the window after 14 December. Sandbox quotas (200 messages in 24 hours, 1 a second), per-account send rate and daily quota after production access, and 1 request a second for API actions other than SendEmail and SendBulkEmail, re-read on 1 November (15). ThrottlingException with 'Maximum sending rate exceeded' or 'Daily message quota exceeded' and advice to wait up to 10 minutes and retry, re-read on 1 November. SES drops over-quota messages rather than queueing them, and SendEmail has no idempotency token (10). SES is covered by the Amazon User Engagement SLA with Pinpoint and End User Messaging, re-read on 1 November (10). GA (10). 20 + 10 + 15 + 10 + 10 + 10 = 75.

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.