Mailgun Webhooks

When to Use This Skill

• Setting up Mailgun webhook handlers
• Verifying Mailgun webhook signatures (HMAC-SHA256 over timestamp + token)
• Debugging Mailgun signature verification failures
• Handling email delivery events: delivered, failed, opened, clicked
• Handling list events: unsubscribed, complained
• Distinguishing permanent vs temporary failures via the severity field
• Verifying subaccount webhooks via the optional parent-signature field

How Mailgun Webhooks Differ

Unlike most providers, Mailgun puts the signature inside the request body, not in a header. The webhook payload always has this shape: