Mailchimp / Mandrill
Legacy marketing giant, transactional via Mandrill.
Mailchimp pioneered SMB email marketing. Mandrill is the bolt-on transactional product, available only to paid Mailchimp customers. Pricing is opaque. Many developers have migrated away post-Intuit acquisition.
Judged purely as an API. What the request contract guarantees on retry, how complete the webhook event coverage is, whether suppressions are readable and writable programmatically, and how much the message log retains when something needs debugging in production.
Against high-frequency programmatic sends where a missed delivery is a product failure, Mailchimp / Mandrill covers webhook coverage, event stream, the suppressions API, batch sending, and SDK breadth, and does not cover idempotency keys. Whether that gap matters depends on how central those are to the build.
- Idempotency keys: No
- Webhooks: Yes
- Event stream: Yes
- Operating since: Not published
- Suppressions API: Yes
- Best published rate per 1,000: Tiers not published in comparable form
- Batch sending: Yes
- SDKs: node, python, php, ruby
- Deliverability: Mixed; depends heavily on the shared IP pool you land on.
Mixed; depends heavily on the shared IP pool you land on.
Social engineering of employees gave access to an internal support tool
An attacker phished Mailchimp employees and contractors, then used the stolen credentials to reach an internal tool used for customer support and account administration. Identified 11 January 2023.
Limited to 133 accounts. Reported at the time as the third Mailchimp incident in twelve months.
- ›Audience data within the 133 affected accounts
- ›Credit card details, according to Mailchimp
- ›Passwords, according to Mailchimp
Access suspended on the affected accounts and primary contacts notified within 24 hours of discovery. Mailchimp did not publish how long the attacker had access or the full list of data types reached.
disclosure ↗Non-technical marketers who already use Mailchimp.
- › Recognizable brand
- › Mature template editor
- › Large agency ecosystem
- › Three disclosed security incidents in the twelve months to January 2023, the last via social engineering of staff
- › Mandrill only available as a paid add-on
- › API ergonomics feel dated
- › Pricing opacity
Features at a glance
| API | Yes |
| SMTP | Yes |
| SDKs | node, python, php, ruby |
| Webhooks | Yes |
| Templates | rich |
| React Email | No |
| Batch send | Yes |
| Scheduled send | Yes |
| Suppressions | Yes |
| Multi-tenant | No |
| Inbound parsing | No |
| Event stream | Yes |
| Idempotency keys | No |
| Dedicated IP | Yes |