# VaEmail as a Postmark alternative for AI agents

Postmark is a transactional email service with native inbound, eight SDKs, a 24 tool MCP server and a long transactional track record. VaEmail is European email infrastructure whose guardrails live inside the API key: scopes, daily caps, allowed sender domains, a dry run that sends nothing, a per call audit log. If your agent needs to receive mail through an API, stay on Postmark. If a program holds the key, and duplicate sends, spending limits and data residency in Europe matter, VaEmail is the better fit.

Facts checked against the VaEmail documentation on 6 September 2026. Competitor facts come from their official documentation read the same day; URLs are cited.

## Where Postmark is stronger

Inbound is the clearest gap. Postmark gives every server an address of the form `hash@inbound.postmarkapp.com`, lets you point a custom inbound domain at it, posts a JSON webhook per message, and exposes the body and attachments through its API (postmarkapp.com/developer/user-guide/inbound, read 06/09/2026). Creating a server with `POST /servers` returns its inbound address, so an agent can obtain a receiving address programmatically (postmarkapp.com/developer/api/server-api, 06/09/2026). VaEmail does not do this. Inbound exists only for prospecting sequences attached to a declared IMAP mailbox.

Postmark also ships official libraries in TypeScript, Python, Rails, Ruby, .NET, Java, PHP and Node (postmarkapp.com/developer/integration/official-libraries, 06/09/2026). Its MCP server, `@activecampaign/postmark-mcp`, exposes 24 tools annotated with `readOnlyHint`, `destructiveHint` and `idempotentHint`, with a year of production use behind it (github.com/ActiveCampaign/postmark-mcp, 06/09/2026). Message streams separate transactional traffic from broadcast traffic. There are agent skills too, five domains including inbound (postmarkapp.com/blog/teach-your-ai-coding-agent-how-to-send-email-with-postmark-skills, 06/09/2026).

One caution unrelated to the product itself: in September 2025 a malicious npm package named `postmark-mcp` blind copied outgoing mail to a third party server, at a time when Postmark had published nothing to npm (postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package, 06/09/2026). Check the exact package name before installing anything.

## Where VaEmail is stronger for an agent

**Idempotency on the server.** Postmark has no idempotency header and recommends handling duplicates client side using the `MessageID` (postmarkapp.com/blog/why-idempotency-is-important, 06/09/2026). An agent that retries after a network timeout can send twice. VaEmail memorises the response for the `Idempotency-Key` header for 24 hours and replays it identically with `Idempotent-Replay: true`. The same key with a different body is refused by a `409 IDEMPOTENCY_KEY_REUSED`, which is a bug in your key derivation, not a replay. Server errors (5xx) are not memorised, so retrying after one is safe.

**A key that cannot overspend.** Postmark authenticates with a server token or an account token, has no send only or read only level, and its IP allowlist is configured in the interface only (postmarkapp.com/developer/api/overview and postmarkapp.com/developer/user-guide/ip-allowlisting, 06/09/2026). Per key volume caps are not documented. A VaEmail key carries 8 scopes (`email.send`, `email.read_status`, `domain.read`, `domain.write`, `contacts.read`, `contacts.write`, `analytics.read`, `billing.read`), a `max_emails_per_day`, a `max_recipients_per_email` and an `allowed_domains` list. Out of scope calls return 403 `INSUFFICIENT_SCOPE` naming the missing scope and the ones the key holds. `GET /api/v1/usage` returns what remains, so a program can decide to stop from the service's number rather than from a counter of its own.

**An audit log.** The Postmark API reference has no audit section. `GET /api/v1/audit-logs` returns one line per call: which key, which agent, which operation, which parameters, which result, how many emails engaged. Message bodies, attachments and merge variables never appear in it.

**A dry run that costs nothing.** Postmark offers the `POSTMARK_API_TEST` token, which validates a request without delivering, and a Sandbox server that processes everything without delivering but counts toward billed volume (postmarkapp.com/developer/user-guide/sandbox-mode/server-sandbox-mode, 06/09/2026). `POST /api/v1/messages/validate` returns `sendable`, the `blocking` items with the same codes as real send errors, plus `quota_remaining` and `daily_key_remaining`.

**Deliverability diagnosis, DMARC included.** Postmark verifies DKIM, Return-Path and SPF by API; DMARC is a separate paid product at 14 EUR per month per domain (postmarkapp.com/developer/api/domains-api, 06/09/2026). `GET /api/v1/deliverability/diagnose?domain=example.com` returns SPF, DKIM and DMARC verdicts, the issues found and the recommended actions. See [ai-agent-email-deliverability](https://vaemail.fr/ai-agent-email-deliverability).

**Data in Europe.** VaEmail runs its servers in Germany and sends in Europe. Postmark runs from Chicago and AWS, and states "We currently don't have plans to add servers in the EU" (postmarkapp.com/eu-privacy, 06/09/2026).

**A specification an agent reads in one pass.** OpenAPI 3.1 at `https://app.vaemail.fr/openapi.json`, with the required scope carried per endpoint as `x-vaemail-scope`. Postmark does not document an OpenAPI file; it publishes a Postman collection and an API explorer (postmarkapp.com/blog/announcing-the-postman-collection-for-postmark, 06/09/2026).

## The send loop, end to end

Dry run, send with an idempotency key, then read the status ([curl example](https://github.com/vaemail/examples)).

```bash
curl -X POST https://app.vaemail.fr/api/v1/messages/validate \
  -H "api-key: $VAEMAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to":"client@example.com","subject":"Your invoice","html":"<p>Hello</p>"}'

curl -X POST https://app.vaemail.fr/api/v1/transactional/send \
  -H "api-key: $VAEMAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: invoice-2412" \
  -d '{"to":"client@example.com","subject":"Your invoice","html":"<p>Hello</p>"}'
```

The send answers `202`:

```json
{ "success": true, "data": { "id": 2841, "status": "queued" } }
```

Accepted, not delivered. Only `GET /api/v1/messages/{id}` settles that, with `status` among `queued`, `sent`, `delivered`, `failed`, `suppressed`, `held`, `cancelled`. Postmark's equivalent split is a `Status` of Sent, Processed or Queued plus `MessageEvents` of Delivered, Transient, Opened, LinkClicked, Bounced and SubscriptionChanged (postmarkapp.com/developer/api/messages-api, 06/09/2026). The transactional send rate limit on VaEmail is 60 requests per minute; Postmark publishes no figure and returns 429 on excessive use (postmarkapp.com/support/article/do-we-have-rate-limits-for-smtp, 06/09/2026).

## Honest gaps

- No inbox created on the fly. An agent that must receive a verification code needs Postmark or a dedicated inbox product.
- A Python SDK (`pip install vaemail`). Brevo clients also work against the `/v3` compatible API; everything else is HTTP.
- MCP: two servers: a remote connector at `mcp.vaemail.fr` with OAuth (16 tools) and the local npm package over stdio (18 tools, zero dependencies). Postmark's is 24 tools.
- Six webhook events: sent, delivered, bounce, complaint, opened, clicked. Postmark documents seven types, unsigned, protected by Basic Auth or an IP allowlist.
- Documentation is partly in French. The agent facing material (`/agents`, the skill, `llms-full.txt`) is English.
- Young product, run by an agency, not a funded company. Postmark has years of transactional reputation.
- Prices are public on https://vaemail.fr/tarifs/. Postmark publishes free 100 emails per month, then Basic at 15 USD per month for 10,000 (postmarkapp.com/pricing.txt, 06/09/2026).

## When not to switch

Stay on Postmark if your agent reads mail through an API, if you rely on a per language SDK, if message streams structure your traffic, or if US hosting is not an issue. Switch when the key is held by a program rather than a person: bounded scopes and caps, replayed retries, a readable audit trail, and data that stays in Germany. Related reading: [email-api-for-ai-agents](https://vaemail.fr/email-api-for-ai-agents), [autonomous-agent-email](https://vaemail.fr/autonomous-agent-email), [mcp-email-server](https://vaemail.fr/mcp-email-server).

## Copy this to your agent

```
Replace Postmark with VaEmail as the outbound email provider in this project.

Documentation for agents: https://vaemail.fr/llms.txt
OpenAPI specification: https://app.vaemail.fr/openapi.json
Capabilities, no key needed: https://app.vaemail.fr/api/v1/capabilities

Rules:
- The API key is in VAEMAIL_API_KEY. Do not ask for it, never write it to a versioned file.
- Base URL https://app.vaemail.fr/api/v1, header "api-key". The Brevo-compatible /v3
  endpoints exist if the code already speaks that dialect.
- Before any real send, call POST /api/v1/messages/validate and stop if "sendable" is false.
- Put an Idempotency-Key header on every send, derived from the business action.
- A 202 means accepted, not delivered: read GET /api/v1/messages/{id} before reporting
  a delivery.
- Publishing DNS records, creating an account or paying are human steps: name them,
  never declare them done.

Start with `npx vaemail init` and tell me what it reports.
```

MCP install:

```bash
claude mcp add vaemail --env VAEMAIL_API_KEY=swm_your_key -- npx -y vaemail mcp
```

## Links

- Agent page: https://vaemail.fr/agents
- Full documentation in one file: https://vaemail.fr/llms-full.txt
- Index for language models: https://vaemail.fr/llms.txt
- Quickstart: https://vaemail.fr/docs/quickstart.md
- Security and guardrails: https://vaemail.fr/docs/security.md
- Error codes: https://vaemail.fr/docs/errors.md
- MCP server and CLI: https://vaemail.fr/docs/mcp.md
- Deliverability: https://vaemail.fr/docs/deliverability.md
- API reference: https://vaemail.fr/docs/api.md
- OpenAPI 3.1: https://app.vaemail.fr/openapi.json
- Capabilities, no key: https://app.vaemail.fr/api/v1/capabilities
- Full comparison table: https://vaemail.fr/compare/index.md and https://vaemail.fr/compare/vaemail-vs-postmark.md
- Agent skill: https://github.com/vaemail/skills
- Examples: https://github.com/vaemail/examples
- MCP server source: https://github.com/vaemail/vaemail-mcp