Mailgun Integration for Rain Automation: Transactional and Marketing Email in Any Workflow
Rain Automation's Mailgun integration covers both directions. Rain sends transactional and marketing mail through Mailgun's HTTP API with message tags and custom variables attached, and it receives Mailgun's signed event webhooks so delivery, open, click, bounce, complaint, and unsubscribe events can each start a workflow. Inbound routes let a reply come back into a running workflow, which is what makes two way email relays possible. Authentication is an API key over HTTP Basic, not OAuth, so there is no consent screen and no token refresh to babysit.
How to connect Mailgun
Mailgun authenticates with an API key over HTTP Basic auth, not OAuth. There is no consent screen to click through, so connecting Mailgun to Rain is a matter of pasting three values and adding DNS records.
Step 1. Verify a sending domain in Mailgun
In the Mailgun dashboard open Sending > Domains > Add New Domain and use a subdomain you reserve for automated mail (for example mg.yourcompany.com). Sending automated mail from a subdomain keeps a deliverability problem in your workflows from damaging the reputation of the domain your team sends personal mail from.
Mailgun then gives you the DNS records to add at your registrar:
- Two TXT records (SPF and DKIM) that authorize Mailgun to send as you.
- A CNAME record that powers open and click tracking.
- Two MX records, required only if you want Mailgun to receive inbound mail for this domain.
Add the MX records if you plan to build a two way email relay. Skip them if the integration is outbound only.
Step 2. Create a domain scoped sending key
Go to Mailgun > API Security and create a sending key scoped to the domain you just verified, rather than reusing your account wide private API key. A domain scoped key that leaks can only send from that one subdomain, and you can rotate it without breaking every other system that talks to Mailgun.
Step 3. Add the credentials in Rain
Open Settings > Integrations > Mailgun > Connect and paste:
- API key. The domain scoped sending key from Step 2. Rain stores it encrypted at rest.
- Sending domain. The subdomain you verified, for example
mg.yourcompany.com. - Region. US or EU. Mailgun runs separate regional stacks and a US key will not authenticate against the EU endpoint, so a mismatch here is the most common cause of a 401 on the first send.
- Default From address. The display name and address your recipients will see.
Rain sends a test message on save. If the test fails, the error Mailgun returned is shown verbatim rather than being collapsed into a generic failure.
Step 4. Point Mailgun webhooks at Rain
Rain generates a webhook URL and a signing secret on the integration page. In Mailgun > Webhooks, paste that URL for the events you care about: delivered, opened, clicked, permanent failure, temporary failure, spam complaint, and unsubscribe.
Copy Mailgun's HTTP webhook signing key back into Rain. Every inbound webhook is verified with an HMAC SHA256 over the timestamp and token before Rain acts on it, so a forged POST cannot suppress a contact or mark a campaign delivered.
Step 5. Add an inbound route if you want two way email
For a relay where a reply comes back into a workflow, create a Mailgun route under Receiving > Routes with a match_recipient() expression and a forward() action pointing at your Rain inbound endpoint. One detail worth knowing before you build: Mailgun posts a forwarded message as multipart form data when attachments are present and as url encoded form data when they are not. An inbound handler that only parses multipart will silently reject every plain text reply. Rain's inbound endpoint accepts both.
Mailgun retries an inbound POST that times out, so any workflow that takes an irreversible action on a reply (sending an SMS, charging a card, notifying a customer) needs an idempotency key. Rain enqueues inbound mail and dedupes on the message ID rather than acting inline.
Step 6. Build the first workflow
Pick a Mailgun event as a trigger, or add a Mailgun send as an action inside a workflow you already run. If you are deciding between Mailgun and an SMTP node inside an automation, our writeup on which n8n email node to use covers the tradeoff, and the Mailgun node walkthrough has a working lead notification example. If the workflow you have in mind drafts replies rather than sending notifications, start with our guide on automating email responses with AI, which covers where the human review gate belongs.
Example workflows
Inbound reply relays into an open conversation
A Mailgun route catches a reply sent to a per record address, verifies the HMAC signature and the token embedded in the recipient, then hands the message body to the channel the conversation actually lives on. Your team replies from the email client they already have open while the customer keeps receiving messages on SMS or a portal thread.
Use case: Two way email relay without asking staff to learn a new inbox
Bounce or complaint suppresses the contact everywhere
On a permanent failure or spam complaint, the workflow writes a suppression record and marks the contact inactive on every list they belong to, across every product you run rather than just the one that sent the message. Someone who asks one brand to stop emailing them stops hearing from all of them.
Use case: Cross product suppression and list hygiene
New lead triggers a tagged transactional send
A form submission or CRM record fires a Mailgun send with message tags and custom variables attached. Mailgun echoes those variables back on every later event, so the delivery, open, and click that follow correlate to the exact lead row without a separate lookup table.
Use case: Instant lead response with attributable tracking
Click on a proposal link creates a sales task
A click event on a quote or pricing URL writes an activity to the contact timeline and notifies the owner. The signal is that a specific person opened a specific document, not that a campaign got a percentage, which is the difference between a metric and a reason to pick up the phone.
Use case: Buying intent routed to a human
Soft bounce spike on one recipient domain raises an alert
The workflow counts temporary failures grouped by recipient domain over a rolling window. When one domain crosses a threshold, it pauses further sends to that domain and alerts you. A receiving provider that starts deferring your mail is throttling you, and continuing to push volume at it is what turns a deferral into a block.
Use case: Deliverability protection before reputation damage
Unsubscribe click closes the loop in the source system
An unsubscribe event removes the contact from the sending list, records the timestamp and the campaign that prompted it, and writes the opt out back to the CRM or platform the list was built from, so the next sync does not resurrect them.
Use case: Compliant opt out that survives the next import
AI drafted reply to an inbound support message
An inbound route delivers the message to a workflow that classifies it, pulls the matching customer record, and drafts a reply grounded in your own documentation. The draft waits for approval before it sends, because an unattended AI reply to a message you have not read is how an automation apologizes for something that never happened.
Use case: Faster first response without unattended sends
Pricing
The Mailgun integration is included in every Rain Automation plan. Mailgun bills you directly for volume under your own account, so your sending costs stay on your Mailgun invoice and Rain never marks them up or resells them. On the Rain side, each Mailgun event that starts a workflow counts as one workflow run against your plan quota, and a Mailgun send performed inside a workflow you are already running does not count as a second run. Subscribing to every Mailgun event type when you only act on a few is the usual reason a quota gets consumed faster than expected, so subscribe the webhook to the events your workflows actually use. See pricing for plan quotas, or get in touch if you want the integration configured for you.