MailerSend vs MailPace

MailerSend 80

OpenAPI 3.1 on SwaggerHub with 59 paths and 97 operations, but no WhatsApp, DMARC or blocklist monitoring paths and no error responses, per the 8 October check (20 of 25). llms.txt on the docs site, now indexing the WhatsApp messages, items, activities, inbound, recipients, templates and webhooks pages, and every page served as Markdown at <path>.md (10). The OpenAPI file has one-line summaries only, while the reference pages state limits and plan conditions per endpoint. The MCP tool definitions can't be read without an account (10 of 20). Parameter tables give type, required and limits, such as 50 To recipients and the nine template languages. The spec has 6 enums (11 of 15). Request examples in up to seven languages and 52 MS error codes with explanations (14). /v1 in the path and a dated public changelog at /whats-new, read on 1 November after a bot check on 8 October, with eight entries between 4 August and 27 October 2026 (15).

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

MailerSend 95

Graded on the hosted REST API. Status page at status.mailersend.com (incident.io) with ten components and per-component uptime (20). The status feed, re-read on 1 November, lists two completed maintenance windows inside 90 days (a five-minute sending maintenance on 21 September and database maintenance on 11 October) and no incident (30). Rate limits published per endpoint, 120 requests a minute on POST /v1/email, with daily quotas by plan (15). A 429 carries retry-after, x-ratelimit and x-apiquota headers, and the docs say to wait the stated seconds. No idempotency key for sends (10 of 15). A 99.5 per cent monthly uptime SLA with service credits from Starter (10). GA (10).

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.

MailerSend 85

Node.js SDK v3.7.0 on 28 October 2026 and the changelog's isolated domain reputation entry on 27 October (30). In the last 90 days the Node.js SDK tagged seven releases (10 August to 28 October), the Python SDK four (1 September to 26 October) and the CLI one, and the changelog has eight dated entries (20). The SDK repositories merge pull requests weekly and the CLI took two in October. We couldn't read issue replies (GitHub refuses our reader), and the product changelog is public and dated, with a help centre and support team we didn't test (12 of 15). Current official SDKs in seven languages, Node.js, Python, PHP, Go, Java, Ruby and the Laravel driver, all but the Laravel driver tagged in October (15). Renovate and a test matrix on Node 20, 22 and 24 in the Node.js SDK. The Python SDK has tests but only a publish workflow, and on 8 October npm's latest was 3.4.1 while the repository had tagged 3.5.0 on 23 September, not re-read on 1 November (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

MailerSend 63

API tokens with any of 30 scopes, read or full by area, optionally tied to one sending domain, and pausable or deletable through the API. OAuth with PKCE and dynamic client registration on the MCP server and the CLI (30). Read scopes, token pause and IP allowlisting from Starter. No confirmation step documented for deletes or sends (13 of 20). Inbound mail and activity data carry untrusted content. The terms place responsibility for a connected agent on the customer, and no injection guidance was found in the docs (3 of 15). Email activity logs on every plan for 1 to 30 days, API request logs only on Professional (7 days) and Enterprise (14 days) (9 of 15). The Responsible Disclosure Program (last updated 20 May 2024), read on 1 November after a bot check on 8 October, takes reports at security@mailersend.com and pays a bounty, at MailerSend's discretion, for severe bugs. No security.txt and no public advisories. The security statement cites ISO 27001 for Google's data centre and names no SOC 2 or ISO 27001 of MailerSend's own. A guide covers leaked credentials. That's a disclosure route with rewards paid at MailerSend's discretion and no certification of its own, the same as contactsplus (8, a disclosure policy and discretionary bounties, no SOC 2 or ISO 27001), below ahasend and brevo (12 each, ISO 27001 and a disclosure route) and above postmark (5, neither) (8 of 20). 30 + 13 + 3 + 9 + 8 = 63.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

MailerSend 68

Closed service with published terms (last updated 5 October 2026) and MIT SDKs. The terms allow changes to the service and the terms without notice and account closure without cause (17 of 30). The privacy policy (last updated 15 October 2026) gives deletion within 30 days of a request, removal of accounts inactive for two years, and EU data centres, and the Data Processing Addendum (last updated 31 August 2026), read on 1 November, adds deletion on request after termination and standard contractual clauses. Activity retention by plan is on the pricing page. The terms grant a licence to use the inputs and outputs of AI functions to improve AI models, and the two documents don't name the same processors (below), so the line holds (18 of 30). No deprecation policy found in the docs, and the terms reserve change without notice (0). The DPA's Annex 4 lists five sub-processors with addresses (Google Cloud EMEA with a data centre in Belgium, MailerLite Limited, MailerLite, Inc., Vercom S.A. and Bandwidth) and promises 10 days' notice of changes, but the privacy policy also names OpenAI and Meta, which the list leaves out (14 of 20). 17 + 18 + 0 + 14 = 49.

MailPace 75

Closed hosted service under terms that name OhMySMTP Ltd with its company number. The MCP server, SDKs, landing site and status page are MIT (18 of 30). The privacy policy (30 August 2026), the pricing page and the DPA agree on retention, 30 days in the dashboard and 7 more in backups, 37 days at most (25 of 30). The API reference promises an old version runs until a published end-of-life date, and the terms list dated changes. The terms also say changes apply immediately (8 of 20). Sub-processors listed with purpose and location, Freethought hosting in the EU, Hetzner backups in Germany, AppSignal in Amsterdam, Paddle in the UK and Tutanota in Germany (18 of 20). Total 69.

MailerSend 30

No x402, MPP or L402 (0). Plan prices and overage per 1,000 emails are public for every plan, $1.50 on Hobby and $1.30 on Starter at 50,000, per the 8 October check; on 1 November the page's figures render by script and the FAQ still gives $1.30 per 1,000 on Starter (20). The 14-day trial starts at signup with 500 emails and 100 API requests a day, but the pricing FAQ says the Free plan asks for card details "to prevent abuse". Whether the trial needs a card wasn't established, so half (10 of 20). Browser signup and an account approval step before full sending (0).

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.