Provide deep linking support (universal links) by client proxy
Today it is already possible for Mailgun clients to get deep linking working.
e.g.: Set up Cloudfront "in front of" Mailgun, proxying everything to malign, except the requests for association files.
This comes at one big downside. The IP resolution is now based on what ever AWS instance handled the request, not the client IP.
It should be easy to use the Client IP as given by the proxy.
For extra security, Mailgun could require the proxy to add a special header, to be sue the info is indeed coming from a trusted source.