The test address in your CI belongs to somebody
16 July 2026 · 4 min read
Typo domains and plausible-looking addresses in fixtures end up receiving real mail. Someone owns qa@company.com. Someone owns the domain you invented in a hurry.
The safe options
- example.com, example.org and example.net are reserved by the IETF and accept nothing.
- .test, .invalid and .example are reserved TLDs.
- A sandbox domain from a service that captures rather than delivers.
The last one is the only option that also lets you assert on what was sent. The others are safe but silent.
Reserved domains publish a null MX, so mail to them fails immediately instead of sitting in your queue for five days.
More on for developers
Testing signup emails in CI without a real mailbox
Sleep-and-hope is why your email tests are flaky. Here is the shape that is not.
Webhook signatures, done properly
A shared secret in a header is not a signature. Here is what to send, what to check, and the two mistakes almost everyone makes on the receiving end.
Rate limiting on the wrong axis is worse than none
Per-IP limits punish shared offices and mobile networks while doing nothing to an attacker who rotates addresses for pennies.