The problem is that those basic fakes are normally rejected by the spam filter because they fail the SPF/DKIM checks on the receiving site.

If you actually use mailgun yourself then you add mailgun to the list of permitted senders and probably add a DKIM key as well. When someone else then fakes your email address without any validation, mailgun might sign the message and bypass every anti spam measure there is.

This could be solved without validation (for example by using dedicated IP addresses and DKIM keys per domain and attaching those to your specific account and API keys) but that'd take some significant engineering effort (and address space, loads of servers are still configured IPv4 only for some reason).

From the screenshot, I gather that the DKIM checks failed already. That still makes mailgun an open relay, though, so they should be added to the necessary IP blacklists if they can't fix this problem.

True, but do you just allow them to borrow the reputation of your other customers? If a scammer knows example.com is a customer (DNS records will tell me this quickly) and a scammer decides to open an account and send as example.com through the service. Does Mailgun have no responsibility or ability to stop this behavior?

Seems easy enough to stop from what I know of email. Otherwise DKIM and SPF are worth nothing in systems like this.

Mailjet stops this by simply requiring domains to be registered to accounts before an account can send from that domain. Registering a domain requires adding a DNS record or file on that domain with a random unique guid

Yep, and Mailgun requires a domain as well, they just don't do anything with it for filtering this behavior.

Josh CTO of Mailgun here - In this example, there is no actual sharing of domain reputation with other customers. Most inbox providers base reputation on the DKIM domain, which in this case is "sandbox.mgsend.net" not the header from address.

Each message is uniquely signed by the sending domain belonging to the account owner, meaning that the domain reputation cannot be borrowed/shared between customers.

Hm, strato, 1and1 and t-online only have one mx and spf record for all customers. Allowing you to send as anyone they have in their system and make it look authentic.

Surely they can cut off emails before it reaches the SMTP server though? Don't they have a milter that drops email sent by accounts that don't have the domain registered? They don't really forward spoofed mail do they??

They do, they only check if you are allowed to log in.

Exchange even has a feature built in for exactly this, their send connectors can’t store more than one account.