What are common phishing issues with Sendgrid and Mailgun and how are they addressed?
Matthew Whittaker
Co-founder & CTO, Suped
Published 11 May 2025
Updated 15 Aug 2025
6 min read
Phishing attacks continue to be a significant threat in the digital landscape, often leveraging legitimate email infrastructure to trick recipients. Even widely used email service providers (ESPs) like SendGrid and Mailgun, which are designed to ensure high deliverability for their users, can inadvertently become conduits for these malicious activities.
Understanding how phishing issues arise with these platforms and, more importantly, how they are addressed, is crucial for maintaining email security and deliverability. My aim is to shed light on these common challenges and outline the steps taken by both ESPs and senders to combat them effectively.
Common phishing attack vectors
One of the primary ways phishers exploit ESPs is through compromised accounts. Attackers might gain access to a legitimate user's SendGrid or Mailgun account credentials, often via phishing themselves or through API key leaks. Once inside, they can send deceptive emails that appear to originate from a trusted source, bypassing initial spam filters that rely heavily on sender reputation.
These emails often mimic transactional communications, such as invoices or account suspension notices, making them highly convincing. For example, there have been instances where attackers replicated compromised SendGrid accounts to target additional users. The sophisticated nature of these attacks means they often include legitimate-looking branding and convincing calls to action, such as logging into a fake portal to 'verify' account details.
Another method is through domain spoofing, where attackers send emails that appear to come from a legitimate domain but do not actually originate from its authorized servers. While ESPs implement robust security measures, persistent phishers continually seek vulnerabilities, finding new ways to bypass existing safeguards and exploit trust in well-known services. This ongoing cat-and-mouse game between security teams and malicious actors means constant vigilance is required.
Shared responsibility model
Both SendGrid and Mailgun operate on a shared responsibility model when it comes to security. While they provide the infrastructure and core security features, users also play a critical role in preventing their accounts from being exploited for phishing. This involves configuring email authentication protocols correctly and maintaining strong account security practices.
For example, Mailgun advises users to learn about common phishing warning signs to protect themselves. This shared approach ensures that both the platform and its users contribute to a more secure email ecosystem. Without proper sender authentication, it becomes significantly easier for attackers to spoof legitimate domains.
ESPs responsibilities
Account monitoring: Regularly scan for suspicious sending patterns indicative of phishing or spam.
Abuse desks: Maintain dedicated teams to investigate and respond to abuse reports promptly.
Security features: Implement and enforce security protocols like 2FA for accounts and IP access restrictions.
Account security: Use strong, unique passwords and enable multi-factor authentication.
API key management: Keep API keys secure and rotate them regularly.
Implementing strong authentication
The most effective technical defense against phishing and domain spoofing is robust email authentication. SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) are critical for verifying email legitimacy. Proper implementation of these protocols can prevent emails from being flagged as phishing or spam, even if sent from compromised accounts.
DMARC, in particular, allows domain owners to tell receiving email servers what to do with messages that fail SPF or DKIM checks, such as sending them to quarantine or outright rejecting them. This helps prevent phishing emails from passing authentication and impacting your brand's reputation.
DMARC policy example
A DMARC record with a policy set to p=reject is the strongest defense against unauthorized use of your domain. Start with p=none to monitor reports, then gradually move to p=quarantine and finally p=reject. This phased approach helps avoid legitimate email delivery issues.
Both SendGrid and Mailgun maintain dedicated abuse desks (e.g., abuse@sendgrid.com and abuse@mailgun.com) specifically for handling reports of malicious activity, including phishing. When a phishing attempt is identified and reported, these teams investigate, identify the compromised account, and take swift action to suspend the sender and mitigate further damage. This proactive approach helps to contain the spread of phishing campaigns and protect the reputation of their shared IP pools.
However, the battle against phishing is continuous. Attackers are constantly evolving their tactics, finding new ways to bypass security measures and exploit vulnerabilities. This means that even after an account is suspended, new phishing campaigns can emerge, sometimes leveraging entirely new accounts or methods. It's an ongoing challenge that requires constant vigilance from the ESPs.
For domain owners and email senders, prompt reporting of suspicious emails purporting to be from or sent via these services is crucial. By collaborating with the ESPs' security teams, the broader email community can contribute to a safer environment. Regularly monitoring your domain for blocklist (or blacklist) entries can also help you detect if your sending infrastructure has been compromised or misused for phishing.
Views from the trenches
Best practices
Always implement strong email authentication, including SPF, DKIM, and DMARC, for all sending domains.
Regularly monitor DMARC reports to identify unauthorized email sending activities using your domain.
Educate your users about phishing warning signs to empower them to identify and report suspicious emails.
Use multi-factor authentication for all ESP accounts and rotate API keys periodically.
Respond quickly to any security alerts or reports of suspicious activity originating from your email sending services.
Common pitfalls
Neglecting DMARC implementation or setting it to p=none indefinitely, which leaves your domain vulnerable.
Failing to monitor DMARC aggregate and forensic reports, missing crucial insights into abuse.
Using weak or reused passwords for ESP accounts, making them easy targets for compromise.
Ignoring suspicious email activity from your sending domains, allowing phishing campaigns to persist.
Relying solely on your ESP's security without also implementing internal best practices.
Expert tips
Implement a strict Content Security Policy (CSP) for your web applications that interact with email sending APIs to prevent XSS attacks.
Utilize subdomains for different types of email (e.g., transactional, marketing) to isolate reputation risks.
Set up alerts for unusual sending volume or sudden dips in deliverability from your ESP accounts.
Conduct regular security audits of your email sending infrastructure and API integrations.
Consider a DMARC policy of p=reject as soon as you are confident in your DMARC alignment.
Marketer view
Marketer from Email Geeks says Mailgun and SendGrid have faced significant phishing problems, and they are actively working to address these issues.
2020-08-06 - Email Geeks
Marketer view
Marketer from Email Geeks says the abuse desks at SendGrid and Mailgun are responsive to reported phishing incidents.
2020-08-06 - Email Geeks
Securing your email ecosystem
Phishing issues with services like SendGrid and Mailgun are a persistent challenge, but they are actively addressed through a combination of robust platform security, vigilant abuse monitoring, and, crucially, strong email authentication practices by senders. While ESPs are continuously improving their defenses, the ultimate responsibility for preventing successful phishing attacks also lies with individual domain owners and email users.
By implementing and maintaining proper SPF, DKIM, and DMARC records, and remaining vigilant against suspicious activity, senders can significantly reduce their risk of becoming a phishing victim or conduit. This layered defense approach is key to securing your email communications and ensuring messages reach their intended recipients without triggering phishing warnings.
