Either of those two should allow you to do the SPD/DKIM/DMARC validation on your own.
I wouldn't call this a security vulnerability.
At best, is a lack of functionality on their part, where a (reasonable) wish would be that they as a email receiver would perform the SPF/DKIM/DMARC validation and provide the results of that check as headers or other metadata.
They seem to provide raw headers in the JSON payload, and if they don't, they also have another mechanism where you can do the MIME parsing yourself.
https://documentation.mailgun.com/en/latest/user_manual.html...
Either of those two should allow you to do the SPD/DKIM/DMARC validation on your own.
I wouldn't call this a security vulnerability.
At best, is a lack of functionality on their part, where a (reasonable) wish would be that they as a email receiver would perform the SPF/DKIM/DMARC validation and provide the results of that check as headers or other metadata.