Mailchimp / Mandrill
Legacy marketing giant, transactional via Mandrill.
Mailchimp pioneered SMB email marketing. Mandrill is the bolt-on transactional product, available only to paid Mailchimp customers. Pricing is opaque. Many developers have migrated away post-Intuit acquisition.
The question here is which one a backend engineer would rather operate. That means SDK depth in the language already in use, whether a retry can safely be replayed, how much the event log tells you when a customer says the email never arrived, and whether the pricing curve stays sane as volume grows.
Against password resets, receipts, and magic links shipped from application code, Mailchimp / Mandrill covers developer experience, SDK breadth, event stream, and webhook coverage, and does not cover idempotency keys. Whether that gap matters depends on how central those are to the build.
- DX score: 5/10
- SDKs: node, python, php, ruby
- Idempotency keys: No
- Operating since: Not published
- Event stream: Yes
- Best published rate per 1,000: Tiers not published in comparable form
- Webhooks: Yes
- Deliverability: Mixed; depends heavily on the shared IP pool you land on.
- Free tier: 500 contacts, 1,000 sends/month
Mixed; depends heavily on the shared IP pool you land on.
Social engineering of employees gave access to an internal support tool
An attacker phished Mailchimp employees and contractors, then used the stolen credentials to reach an internal tool used for customer support and account administration. Identified 11 January 2023.
Limited to 133 accounts. Reported at the time as the third Mailchimp incident in twelve months.
- ›Audience data within the 133 affected accounts
- ›Credit card details, according to Mailchimp
- ›Passwords, according to Mailchimp
Access suspended on the affected accounts and primary contacts notified within 24 hours of discovery. Mailchimp did not publish how long the attacker had access or the full list of data types reached.
disclosure ↗Non-technical marketers who already use Mailchimp.
- › Recognizable brand
- › Mature template editor
- › Large agency ecosystem
- › Three disclosed security incidents in the twelve months to January 2023, the last via social engineering of staff
- › Mandrill only available as a paid add-on
- › API ergonomics feel dated
- › Pricing opacity
Features at a glance
| API | Yes |
| SMTP | Yes |
| SDKs | node, python, php, ruby |
| Webhooks | Yes |
| Templates | rich |
| React Email | No |
| Batch send | Yes |
| Scheduled send | Yes |
| Suppressions | Yes |
| Multi-tenant | No |
| Inbound parsing | No |
| Event stream | Yes |
| Idempotency keys | No |
| Dedicated IP | Yes |