Website profiles · Technology insights · Alternatives

testmail.app

Test new user signups, transactional emails, spam scores, and more. Get started on our free forever plan with unlimited email addresses and mailboxes.

Paid content
Visit website
Profile views 9 Outbound visits 3 Normal
Automate email tests | loved by developers & QA teams Full homepage screenshot

At a glance

Category
Development
Language
English
Paid-content signal
Paid contentObserved
Registered
2019
Hosting
CloudflareInferred
HTTPS certificate trusted
PassedObserved
Last updated

Website review

This review may include AI-generated content and is not individually verified. Domain, certificate and other facts come from the observed data on this page.

What is testmail.app?

testmail.app is an email testing service for developers and QA teams. It gives you disposable inboxes you can create programmatically, so automated tests can trigger real emails—signup confirmations, password resets, transactional messages—and then retrieve them via API instead of checking a human mailbox.

How it works

You get a namespace at signup, and any address of the form {namespace}.{tag}@inbox.testmail.app becomes a real, working inbox. The {tag} is arbitrary, so you can spin up unlimited distinct addresses just by changing it—one per test run, per user, or per scenario. testmail.app receives, parses, spam-scores, and indexes each message, then exposes it through a JSON or GraphQL API. Because you query over HTTP, it fits into any language or CI/CD pipeline.

What you get

  • Unlimited addresses and mailboxes from a single namespace
  • JSON and GraphQL APIs, plus an interactive GraphQL playground
  • Live queries that wait for a new email to arrive, useful when a test must block until delivery
  • Search with wildcard matching, sorting, pagination, and attachment retrieval
  • SpamAssassin reports if deliverability or spam scoring matters to you
  • Team collaboration: invite members, share namespaces and test emails, manage keys and usage

Who it suits

It is aimed at engineering teams writing end-to-end or integration tests, and at anyone who needs to verify email content and headers without risking a send to a real customer. The free tier covers a modest monthly volume, which is enough to evaluate the workflow; heavier CI usage will need a paid plan. Support is handled by engineers rather than bots, and the service advertises a 99.99% uptime SLA with a public status page.

A practical next step

If you are evaluating it, start with one real test: create a namespace, point your signup flow at a tagged address, and write a live query that waits for the confirmation email and asserts on its subject and link. That single test tells you more about fit than reading the docs. If your needs are broader than email—SMS, multiple channels—compare against a wider testing platform before committing.

How do I set up testmail.app for automated email testing in my CI/CD pipeline?

Testmail.app fits CI/CD email testing by giving you disposable inboxes you can generate from a tag, then query by API instead of clicking through a mail client.

The basic setup

  1. Sign up and get your namespace and API key. The free plan covers 100 emails/month, which is enough for a small suite or a trial run.
  2. Build test addresses from the pattern {namespace}.{tag}@inbox.testmail.app. The tag is arbitrary, so each test run, user ID, or parallel worker can get its own address.
  3. In your pipeline, trigger the app action that sends the email (signup, password reset, receipt).
  4. Query testmail.app's JSON or GraphQL API for messages matching that tag, then assert on subject, body, links, or attachments.
  5. Store the API key as a CI secret and pass it in as an environment variable, the same way you handle other service credentials.

A minimal flow in a CI job might look like:

# after triggering the signup
curl -s "https://api.testmail.app/api/json?apikey=$TESTMAIL_KEY&namespace=$NS&tag=ci-run-42" \
  | jq '.emails[0].subject'

Practical choices

  • Tag strategy: use one tag per test or per worker so parallel jobs do not read each other's mail. A timestamp or CI build number makes cleanup and debugging easier.
  • Polling vs. live queries: polling with a short retry loop is simple and portable. Live queries that wait for a new email reduce flakiness when delivery is slow, but they tie the test to the API's timeout behavior.
  • What to assert: prefer content that your app controls (subject line, template variables, links) over delivery metadata. SpamAssassin reports are useful when you are testing deliverability rather than correctness.
  • Language: any HTTP or GraphQL client works, so use whatever your test stack already uses.

Trade-offs

Testmail.app is a receiving and inspection service, not a sending service. You still need your app or an SMTP provider to send the mail. The free tier's monthly email cap will bite if you run large suites frequently; teams with heavy test volume should check the paid plans. Because addresses are public in form, never route real customer email through them.

For a concrete scenario: a QA engineer running Playwright tests in GitHub Actions can give each spec file a unique tag, trigger signup, poll for the welcome email, extract the confirmation link, and complete the flow, all without a shared inbox or manual cleanup.

Next step: read the quickstart and API reference at Testmail.app, then run one pipeline job with a single tag before expanding to parallel workers. If you need broader email-testing tooling comparisons, Mailtrap and MailHog cover related ground, though their models differ.

What are the differences between the free plan and paid plans, and what are the email limits?

The free plan is a real, ongoing tier rather than a trial: it includes unlimited email addresses and mailboxes, but caps you at 100 emails per month. Paid plans are where higher email volume, team management at scale, and the 99.99% uptime SLA live. The page does not publish the exact paid tiers or their monthly email allowances, so check testmail.app pricing for current numbers before you commit.

How the limits actually work

  • Mailboxes are never the constraint. Every plan lets you create addresses on the fly by changing the tag in {namespace}.{tag}@inbox.testmail.app, so each tag is effectively a new mailbox. You will not run out of addresses on the free tier.
  • Emails received are the constraint. The 100/month figure counts messages the service receives, parses, spam-tests and indexes for retrieval. A signup flow that fires a welcome email, a verification email and a receipt burns three of them.
  • Free is fine for one developer on one project. A single end-to-end signup test run a few times a day stays comfortably inside 100. A CI pipeline running the full suite on every pull request will not.
  • Paid is about throughput and team structure. Higher volume, plus separate namespaces per project and the enterprise option of managing multiple distinct teams. Collaborator invites are free on all plans, so adding teammates is not itself a reason to upgrade.

A quick way to decide

Estimate your monthly test emails: number of test runs × emails per run × working days. If that lands under roughly 80, stay free and keep headroom. If it is over, or if two or more projects need isolated namespaces, price the paid tier against the cost of a flaky test suite.

One practical note: because tags are arbitrary, use a naming scheme like {project}-{branch}-{runid} from day one. It costs nothing and makes wildcard searches and live queries far easier when you do scale up.

How does testmail.app help prevent sending test emails to real customers?

testmail.app prevents accidental sends to real customers by giving every test message a destination that only exists inside its own system. Instead of pointing a staging or test build at a real customer address, you send to a generated address in the form {namespace}.{tag}@inbox.testmail.app. Because the {tag} can be any string, each tag creates a separate, real deliverable mailbox on the fly — so your code can generate unlimited unique test addresses without touching a live inbox.

The service receives, parses, spam-tests, and indexes those messages, then exposes them through a JSON or GraphQL API. Your tests (or CI/CD pipeline) query the API to confirm the email arrived and inspect its contents. The practical benefit is that test traffic never leaves this sandbox, so a misconfigured recipient list, a hard-coded staging address, or a copy-paste error cannot reach a customer's inbox.

What this looks like in practice

  • Signup and verification flows: Your end-to-end test registers a user with [email protected], triggers the welcome or verification email, then queries the API for that tag to assert the subject, body, and links.
  • Transactional emails: Order confirmations, password resets, and receipts can be checked with "live" queries that wait for a new message, plus sorting, pagination, wildcard search, and attachment retrieval.
  • Deliverability checks: SpamAssassin reports let you see how a message scores before it ever goes to a real recipient.
  • Team workflows: You can invite collaborators at no extra cost, create separate namespaces per project, and share test emails or API keys securely. The page also notes a free forever tier with 100 emails per month and no credit card required.

Trade-offs and a decision criterion

The main limitation is that this is a testing sandbox, not a real mail provider: it validates that your application sent the right message, not that a customer's mailbox provider will accept it. For inbox placement at major providers, you still need seed-list or real-account testing. Also, because tags are effectively public address components, avoid putting sensitive production data in test emails.

Use testmail.app when your risk is "our test suite emailed a real person" or "we can't verify email content automatically in CI." If your risk is "Gmail is marking us as spam," pair it with a dedicated deliverability tool. To start, sign up, grab a namespace and API key, then replace hard-coded test recipients with generated {namespace}.{tag}@inbox.testmail.app addresses in your test fixtures. The official documentation at testmail.app covers the API reference and an interactive GraphQL playground.

Can I use testmail.app with any programming language or HTTP client, and how do I query emails via the API?

Yes. testmail.app is designed to be language- and client-agnostic: you send test emails to an address it generates and then retrieve them over HTTP, so anything that can make a web request can use it.

How the address works

testmail.app gives you a namespace, and every address follows this pattern:

{namespace}.{tag}@inbox.testmail.app

The tag is arbitrary. Each unique tag creates a separate real mailbox, so you can generate unlimited addresses in a test simply by changing the tag — useful for giving each test run, user, or CI job its own inbox.

Querying emails via the API

The flow is: send a test email to a generated address, then call the API to fetch and parse it.

  • JSON API — a simple REST-style endpoint for retrieving emails.
  • GraphQL API — a more expressive query interface, with an interactive GraphQL Playground for testing queries.
  • Any HTTP or GraphQL client — use whatever your language or environment provides, including CI/CD pipelines.

Query features the product highlights include wildcard search, "live" queries that wait for new emails, sorting, pagination, attachment handling, and SpamAssassin spam reports.

Typical example

A signup test might look like this:

  1. Build the address [email protected].
  2. Submit your app's signup form with that address.
  3. Query the API filtered by that tag.
  4. Assert on the subject, body, links, or spam score.

Next step

Get your namespace and API key, read the quickstart and API reference, then try queries in the GraphQL Playground before wiring them into your test suite. See testmail.app.

Decision criterion

Choose the JSON API for straightforward fetch-and-assert steps; choose GraphQL when you need combined filters, wildcard matching, or live waits. Either way, the deciding factor is usually whether your test runner can block on a request until the email arrives.

How does testmail.app handle team collaboration and what security measures are in place?

testmail.app handles team collaboration through shared namespaces, email-based invitations, and per-project separation, while its security model rests on forced HTTPS/TLS, encryption in transit and at rest, passwordless logins, and a claimed 99.99% uptime SLA.

H3 Collaboration

  • Invite team members by email; collaborators can share test emails, mailboxes, and namespaces.
  • Create separate namespaces per project so teams don't mix test data.
  • Provision and retrieve API keys per namespace, so credentials can be scoped rather than shared globally.
  • Monitor usage and manage team membership from the same interface.
  • The page states collaborators are unlimited on all plans at no extra cost; multiple separate teams are positioned as an enterprise feature.

H3 Security and reliability

  • HTTPS/TLS is forced on all traffic.
  • Data is encrypted in transit and at rest.
  • Logins are passwordless.
  • APIs are distributed across multiple data centers with around-the-clock monitoring.
  • A public status page provides real-time uptime checks, and the page cites a 99.99% uptime SLA tied to paid plans.

H3 Practical takeaway

For a small QA team, the namespace-per-project model is the main collaboration win: each tester can generate addresses like {namespace}.{tag}@inbox.testmail.app without stepping on a colleague's inbox. The trade-off is that namespace access is the real security boundary, so treat namespace API keys like production secrets and rotate them when someone leaves. If you need isolated teams rather than one shared account, the enterprise tier is the stated path.

Next step: read the official docs and pricing page to confirm current plan limits before standardizing your CI pipeline on it. See testmail.app and testmail.app pricing.

Related questions

More questions →
How secure and reliable is testmail.app?

testmail.app is built for automated email testing in CI/CD pipelines and development workflows, and its security and reliability posture reflects that: all traffic is forced over HTTPS/TLS, data is encrypted in transit and at rest, logins are passwordless, APIs are distributed across multiple data centers with around-the-clock monitoring, and the service backs its availability with a 99.99% uptime SLA. A public status page provides real-time uptime checks so you can verify current reliability yourself rather than taking a vendor's word for it.

Security measures

Encryption everywhere

  • HTTPS/TLS is forced on all traffic — you cannot accidentally send or retrieve test emails over an unencrypted connection.
  • Everything is encrypted in-transit and at-rest — this covers both the emails your tests generate and the data stored around them.

For teams that handle test emails containing realistic payloads (tokens, links, user data), forced TLS plus at-rest encryption is the baseline you'd want before pointing a CI pipeline at a third-party inbox.

Passwordless login

testmail.app uses passwordless logins. There is no password to leak, reuse, or phish — a meaningful reduction in the most common account-takeover vector. Combined with HTTPS enforcement, the authentication surface is smaller than a typical email-testing tool that relies on stored credentials.

API key provisioning

Namespaces come with API keys that can be securely provisioned and retrieved, and teams can create separate namespaces (and mailboxes) per project. That separation matters for security hygiene: a key scoped to one project's namespace doesn't need to be shared with unrelated work.

Team access

You can invite team members by email and share test emails, monitor usage, and manage membership. Collaborators can be added on all plans at no extra cost, and the enterprise plan supports managing multiple separate teams. Access is therefore managed per team rather than through a single shared account.

Reliability measures

Distributed, monitored APIs

The APIs are distributed across multiple data centers and actively monitored around the clock. Distribution across data centers is what keeps a single facility outage from taking down your test runs.

99.99% uptime SLA

testmail.app states a 99.99% uptime SLA for its highly available APIs. That's roughly 52 minutes of allowed downtime per year — a level appropriate for something wired into CI, where a flaky dependency blocks merges.

Public status page

The company says it is fully transparent about uptime and publishes a public status page with real-time uptime checks. This is the practical verification step: before adopting any tool as a CI dependency, check the status page history for incidents that would have failed your pipeline.

What this means for your workflow

Concern How testmail.app addresses it What you should still verify
Eavesdropping on test traffic HTTPS/TLS forced; encrypted in transit and at rest That your HTTP client enforces TLS verification
Credential theft Passwordless login Who on your team can access the account
Single point of failure APIs across multiple data centers, 24/7 monitoring Your own retry/timeout handling in CI
Availability guarantees 99.99% uptime SLA Whether the SLA terms match your plan
Visibility into outages Public status page with real-time checks Incident history against your release cadence

Practical caveats

  • The security and reliability claims above come from testmail.app's own product page. The status page is the independent-ish check you can perform yourself; the SLA terms are referenced as living under the plans/pricing pages, so read those for the exact commitments attached to your plan.
  • Reliability of the service doesn't remove the need for resilience in your tests. Even with a 99.99% SLA, a CI job that queries for a new email should handle timeouts and retries — the "live" query feature (waiting for new emails) is the intended mechanism for that, but your client still needs sane timeouts.
  • Passwordless login shifts the security burden to your email account. If your team's email is compromised, so is your testmail.app account — so the strength of your email provider's own authentication now matters more, not less.

If your requirement is a third-party inbox that CI can hit without exposing credentials or plaintext test data, and you want a published uptime commitment plus a status page you can audit, testmail.app's stated posture covers those points. Start by checking the status page for recent incidents, then confirm the SLA terms on the plans page before making it a hard dependency in your pipeline.

How to Get Started with testmail.app for Email Testing

testmail.app gives you unlimited real email addresses and mailboxes for automated email testing, and you can start on a free forever plan (100 emails/month) with no credit card required. You sign up, get a namespace and API key, then send test emails to {namespace}.{tag}@inbox.testmail.app and retrieve them via JSON or GraphQL API. This guide covers the setup steps, how the addressing scheme works, and how to integrate it into CI/CD.

What testmail.app Does

Instead of sending test emails to real customer inboxes, you route them to a catch-all address that testmail.app receives, parses, spam-tests, and indexes for retrieval through an API. Each tag you invent becomes a separate real email address and mailbox, so you can generate unlimited addresses on the fly without pre-registering them.

The core address format is:

{namespace}.{tag}@inbox.testmail.app
  • namespace — assigned to you at signup; identifies your account.
  • tag — anything you choose. Changing the tag creates a new address and mailbox.

Step 1: Sign Up and Get Your Namespace

Sign up on the site (the page states it takes about 30 seconds). You receive:

  • A namespace for your account.
  • An API key for authenticating API requests.

No credit card is required for the free forever plan, which covers 100 emails/month. If you need more volume or team features, check the pricing page for plan details.

Step 2: Send a Test Email

Point your application's email-sending code at an address built from your namespace and any tag:

[email protected]

Because the tag is arbitrary, you can create a unique address per test run — for example, using a timestamp or build ID as the tag — so parallel test runs don't collide.

Step 3: Retrieve Emails via API

testmail.app offers two query interfaces:

Interface Best for
JSON API Simple HTTP requests from any language or environment
GraphQL API More precise queries, interactive testing via the GraphQL Playground

You can use any HTTP or GraphQL client in any language, including inside CI/CD pipelines. Supported query features include:

  • Advanced search with wildcard match
  • "Live" queries that wait for new emails to arrive
  • Sorting and pagination
  • Attachments
  • SpamAssassin spam reports

For exact request formats and parameters, use the quickstart and API reference in the documentation.

Step 4: Integrate into CI/CD

The typical pattern:

  1. Your test suite triggers a signup or transactional email flow.
  2. The app sends to {namespace}.{tag}@inbox.testmail.app.
  3. Your test code calls the API (often with a live query) to fetch the email.
  4. Assert on the subject, body, links, or spam score.

Because retrieval is API-based, it fits any pipeline that can make HTTP requests — no mailbox UI or manual checking needed.

Verification and Common Pitfalls

  • Confirm the address format. A wrong namespace means the email never reaches your account.
  • Use unique tags per test. Reusing a tag mixes emails from different runs into one mailbox.
  • Prefer live queries over polling when you need to wait for delivery, to avoid timing flakiness.
  • Watch your monthly volume on the free plan (100 emails/month) if you run large suites.

Team and Security Notes

  • Invite team members by email; collaborators can be added on all plans at no extra cost, with separate namespaces/mailboxes per project, shared test emails, and usage monitoring.
  • Multiple separate teams are available on the enterprise plan.
  • HTTPS/TLS is forced on all traffic, data is encrypted in transit and at rest, and logins are passwordless.
  • APIs are distributed across multiple data centers with a stated 99.99% uptime SLA and a public status page.

Next Steps

Sign up to get your namespace and API key, read the quickstart, and try queries in the interactive GraphQL Playground before wiring the API into your test suite.

What Does testmail.app's Free Plan Include and What Are the Paid Options?

testmail.app's free plan is a "free forever" tier that includes 100 emails per month, unlimited email addresses and mailboxes, and unlimited collaborators at no extra cost — no credit card required to sign up. Paid plans exist for higher usage and advanced features, but the site's pricing page is the only place to see current tiers and limits, since specific paid-plan quotas and prices aren't listed in the material available here. If your testing volume stays under 100 emails a month, the free plan is likely enough; if you need more throughput or enterprise-level team management, you'll need a paid plan.

What the free plan includes

Based on the site's own description, the free forever plan gives you:

  • 100 emails per month — the usage cap that defines the free tier.
  • Unlimited email addresses and mailboxes — you generate addresses on the fly by changing the {tag} in {namespace}.{tag}@inbox.testmail.app, so each tag is effectively a new real mailbox.
  • Unlimited collaborators — invite as many team members as you need on all plans at no extra cost.
  • No credit card required to get started.
  • Full API access — the JSON API and GraphQL API, usable from any HTTP or GraphQL client, including CI/CD pipelines.
  • Core retrieval features — advanced search with wildcard match, "live" queries that wait for new emails, sorting, pagination, attachments, and SpamAssassin spam reports.
  • Security and reliability — HTTPS/TLS forced on all traffic, encryption in transit and at rest, passwordless logins, and APIs backed by a 99.99% uptime SLA.

The 100 emails/month figure is the practical constraint to watch: every test email you send to your inbox namespace counts against it.

What paid plans add

The site points to a pricing page and mentions paid options in a few specific ways, without listing exact tiers or prices in the source material:

  • Higher usage — paid plans are the path when 100 emails/month isn't enough.
  • Advanced features — the site frames paid plans as offering more, alongside the free tier's feature set.
  • Enterprise plan for multiple teams — the free and standard collaboration model lets you invite unlimited collaborators and create separate namespaces per project. The enterprise plan is what you need if you want to manage multiple separate teams.
  • Billing — payments are handled through Stripe.

Because the source doesn't publish per-plan quotas or prices, check the pricing page directly for current numbers before deciding. Don't assume the free tier's limits carry over unchanged to paid tiers.

Free vs. paid: how to choose

Dimension Free forever plan Paid plans
Monthly email volume 100 emails/month Higher (see pricing page)
Email addresses & mailboxes Unlimited Unlimited
Collaborators Unlimited, no extra cost Unlimited, no extra cost
API access (JSON + GraphQL) Yes Yes
Search, live queries, attachments, spam reports Yes Yes
Multiple separate teams Not indicated Enterprise plan
Credit card required No Yes (via Stripe)

Choose the free plan if you're testing signup flows, transactional emails, or spam scores at low volume — a handful of test runs per day fits comfortably in 100 emails/month. Move to a paid plan when your CI/CD pipeline sends enough test emails to exceed that cap, or when you need to manage several independent teams rather than one namespace-per-project setup.

Practical notes before you sign up

  • Plan your tag strategy. Since each {tag} creates a separate address, you can isolate tests by feature, branch, or run without creating accounts — but every message still counts toward your monthly total.
  • Watch the counter, not the mailbox count. Unlimited mailboxes don't mean unlimited emails; the 100/month cap is on messages received.
  • Verify current pricing yourself. The free tier's inclusions are stated on the site, but paid-tier quotas and prices are only on the pricing page — treat anything beyond "higher usage" and "enterprise multi-team" as unconfirmed until you read it there.
  • Signup is quick. The site says getting an API key takes about 30 seconds, and support is handled by engineers rather than bots, with most priority requests answered within minutes.
What is testmail.app?

testmail.app is an email testing API service for developers and QA teams. It gives you unlimited email addresses and mailboxes so you can automate end-to-end tests that involve email — signup confirmations, transactional messages, password resets — without ever sending test mail to real customers. You send test emails to a generated address, and testmail.app receives, parses, spam-tests, and indexes them so your test code can retrieve them through a JSON or GraphQL API.

It fits teams that need to assert on email content inside CI/CD pipelines, and it is not a production mail-sending service or a marketing email platform.

How it works

The mechanism is a namespace plus a tag:

  1. You sign up and receive a namespace.
  2. Any address of the form {namespace}.{tag}@inbox.testmail.app is a real, deliverable address. The {tag} can be anything — each tag creates a separate email address and mailbox, so you can generate unlimited addresses on the fly just by changing the tag.
  3. testmail.app receives the message, parses it, runs a spam check, and indexes it.
  4. Your test queries the API to fetch the email and assert on its contents.

Because the address is under inbox.testmail.app rather than a real customer domain, a misconfigured test cannot accidentally email a real user.

What you can do with the API

The service exposes both a simple JSON API and a GraphQL API, usable from any HTTP or GraphQL client in any language or environment, including CI/CD pipelines. Documented capabilities include:

  • Advanced search with wildcard matching
  • "Live" queries that wait for a new email to arrive
  • Sorting and pagination
  • Attachment retrieval
  • SpamAssassin reports, so you can assert on spam scores

A quickstart, API reference, and an interactive GraphQL Playground are provided for building and testing queries.

Team and security characteristics

  • Collaboration: invite team members by email; create separate namespaces and mailboxes per project; provision and retrieve API keys; share test emails; monitor usage; manage membership. Collaborators can be invited on all plans at no extra cost, and an enterprise plan supports managing multiple separate teams.
  • Security: HTTPS/TLS is forced on all traffic, data is encrypted in transit and at rest, and logins are passwordless.
  • Reliability: APIs are distributed across multiple data centers with around-the-clock monitoring, backed by a 99.99% uptime SLA, and a public status page shows real-time uptime checks.

Pricing and getting started

The site advertises a free forever plan with unlimited email addresses and mailboxes, no credit card required, and a limit of 100 emails/month. Paid plans and the SLA details are listed on the pricing page, and Stripe is used for payments. Signup is described as taking about 30 seconds and yields your namespace and API key.

When it is a good fit

Choose testmail.app if your tests need to receive and inspect real email programmatically, you want disposable addresses generated per test case, and you want that flow to run unattended in CI. If you only need to send email in production, or you need a full inbox UI for manual QA, this is not the tool for that job.

To evaluate it, start with the free plan, send one message to {your-namespace}.{any-tag}@inbox.testmail.app, and query it back through the GraphQL Playground — that single round trip tells you whether the API shape fits your test framework.

How does testmail.app provide unlimited email addresses and mailboxes?

testmail.app gives you unlimited addresses by making the address itself the mailbox. After you sign up and receive a namespace, any address in the form {namespace}.{tag}@inbox.testmail.app is valid, where {tag} can be anything you choose. Each distinct tag is a separate email address and mailbox, so you create them on the fly without registering or provisioning anything. This applies to every plan, including the free forever plan (100 emails/month, no credit card required).

The addressing model

The service separates two parts of every address:

Part Example What it does
Namespace myproject Identifies your account/project; you get it at signup
Tag signup-user-42 Anything you want; each unique tag is its own mailbox

So [email protected] and [email protected] are two independent mailboxes, both belonging to the same namespace. There is no list of pre-created mailboxes to manage — the tag is the mailbox.

Because the tag is arbitrary, you can generate addresses programmatically: use a test run ID, a timestamp, a UUID, or a user identifier. This is what makes the count effectively unlimited.

Why this matters for testing

The intended workflow is to send test emails to these addresses instead of to real customers. testmail.app receives, parses, spam-tests, and indexes each message so you can retrieve it later through an API. That turns email verification into a normal API call inside your end-to-end tests or CI/CD pipeline.

A typical loop looks like this:

  1. Generate a unique tag for the test (for example, run-2024-06-01-001).
  2. Use the address {namespace}.{tag}@inbox.testmail.app wherever your app sends mail — signup confirmation, password reset, transactional receipt.
  3. Query the API for messages matching that tag.
  4. Assert on the subject, body, links, or attachments.

Because each run gets its own tag, parallel test runs don't collide, and you don't need to clean up mailboxes afterward.

Retrieving and managing mail

You interact with mailboxes entirely through APIs, not a manual inbox UI:

  • JSON API for straightforward queries.
  • GraphQL API for more flexible queries, with an interactive GraphQL Playground for testing queries.
  • Any HTTP or GraphQL client works, in any language or environment, including CI/CD pipelines.

Features that support real test scenarios include wildcard search, "live" queries that wait for a new email to arrive, sorting, pagination, attachments, and SpamAssassin reports. The live-query option is what lets a test block until the expected email shows up rather than polling blindly.

Teams and namespaces

You can invite team members by email and share test emails, API keys, and usage monitoring. Separate namespaces (and therefore separate mailboxes) can be created per project, which keeps projects isolated. Collaborators can be invited on all plans at no extra cost; managing multiple separate teams is an enterprise-plan feature.

Practical notes

  • Signup is required to get your namespace and API key — the address format only works within your own namespace.
  • The free tier is capped at 100 emails/month, so "unlimited addresses" does not mean unlimited message volume. Check the pricing page for current plan limits.
  • Security posture: HTTPS/TLS is forced, data is encrypted in transit and at rest, logins are passwordless, and APIs are distributed across multiple data centers with a published 99.99% uptime SLA and a public status page.

The short version: unlimited mailboxes come from treating the tag portion of the address as the mailbox identifier, so you never create a mailbox — you just pick a new tag and query for it.

Website Overview

An established domain and managed infrastructure suggest continuity of operations and may support dependable delivery, although neither guarantees service quality. Page metadata, canonical configuration and social previews work together to provide more consistent search and sharing presentation.

Domain and Registration

Registered in 2019, this domain has about 7 years of history. That suggests continuity, although ownership and purpose may have changed. Transfer-protection status is present, helping reduce the risk of unauthorized domain transfers. The registrar is Squarespace Domains II LLC., a widely used domain service provider. The domain uses the common .app extension, which is not an independent safety signal.

DNS and Email

Nameservers are provided by Cloudflare, indicating managed DNS hosting. MX records point to the Google Workspace email service. DNSSEC is enabled, allowing validating resolvers to authenticate signed DNS data. CAA records restrict which certificate authorities are authorized to issue certificates. No CNAME was found; the observed records resolve directly to addresses.

TLS and Certificates

The public key uses EC with 256 bits. The server supplied a complete certificate chain. No organization name is present in the certificate; the available fields are consistent with domain validation. The certificate was issued within the Google Trust Services cloud or CDN ecosystem. The certificate's total validity is about 90 days, consistent with a short renewal cycle.

HTTP and Browser Security

The response lacks these common security headers: CSP, Permissions-Policy. CORS permits any origin to read this response. This is common for public resources; sensitive responses need narrower handling. No X-Powered-By header was found, reducing one common source of backend fingerprinting information. The cf-ray response header indicates a CDN or caching proxy in the delivery path. No obvious internal addresses or debug information were found in the headers.

Technology Stack Analysis

The public page identifies Next.js, Google Tag Manager, Stripe, Cloudflare without precise versions, leaving fewer clues for version-specific scanning.

Search and Social Sharing

Open Graph is partially configured; og:image is missing. Twitter Card metadata is configured. The title has 53 characters, within a common display range. A meta description is present, with 150 characters. No Generator meta tag is publicly exposed.

Hosting and Email

DNSCloudflare
HostingCloudflare
EmailGoogle Workspace
Approximate IP geolocation (inferred; a CDN or proxy may differ from the origin server) Location unknown Inferred 104.26.0.4

Registration details

RDAP / WHOIS

RegistrarSquarespace Domains II LLC.
Registered2019-01-13
Expires2035-01-13
Domain statusclient delete prohibited、client transfer prohibited
Nameservershans.ns.cloudflare.com、lady.ns.cloudflare.com
DNSSECsigned

DNS records

DNS

TypeNameValueTTLPriority
Atestmail.app104.26.0.4300—
Atestmail.app104.26.1.4300—
Atestmail.app172.67.68.229300—
AAAAtestmail.app2606:4700:20::681a:104300—
AAAAtestmail.app2606:4700:20::681a:4300—
AAAAtestmail.app2606:4700:20::ac43:44e5300—
MXtestmail.appsmtp.google.com3001
NStestmail.apphans.ns.cloudflare.com86400—
NStestmail.applady.ns.cloudflare.com86400—
TXTtestmail.appMS=2C975DD523069725EAB1E3A2D538EE9C9B1C32AE300—
TXTtestmail.appSendinblue-code:b86b80d0ef05d5f6068330bee14a0063300—
TXTtestmail.appgoogle-site-verification=2cu40uTJF8WNeRhsD5MRJjWFSrtttYZDEvYLvkuQKxY300—
TXTtestmail.appstripe-verification=dfdf66f0aa99079b305f17b659adb26db258d812e5edef389c7d60856b3d047f300—
TXTtestmail.appv=spf1 include:_spf.google.com include:spf.sendinblue.com include:helpscoutemail.com include:sender.zohoinvoice.com ~all300—
CAAtestmail.app0 issue "comodoca.com"3600—
CAAtestmail.app0 issue "digicert.com; cansignhttpexchanges=yes"3600—
CAAtestmail.app0 issue "letsencrypt.org"3600—
CAAtestmail.app0 issue "pki.goog; cansignhttpexchanges=yes"3600—
CAAtestmail.app0 issue "ssl.com"3600—
CAAtestmail.app0 issuewild "comodoca.com"3600—
CAAtestmail.app0 issuewild "digicert.com; cansignhttpexchanges=yes"3600—
CAAtestmail.app0 issuewild "letsencrypt.org"3600—
CAAtestmail.app0 issuewild "pki.goog; cansignhttpexchanges=yes"3600—
CAAtestmail.app0 issuewild "ssl.com"3600—
DStestmail.app2371 13 2 ce9c6a0c68c92a6f26a8ecf3e7eda960c15f61ed93d442f418dd6502373760f81800—
DMARC_dmarc.testmail.appv=DMARC1; p=none; sp=none; rua=mailto:[email protected],mailto:[email protected]!10m; ruf=mailto:[email protected]!10m; rf=afrf; pct=100; ri=86400300—

TLS and certificates

TLS / SSL

AssessmentNormal configuration
Supported protocolsTLSv1.2、TLSv1.3
Negotiated protocolTLSv1.3
Certificate subjecttestmail.app
IssuerGoogle Trust Services
Valid until2026-11-29T09:34 · Remaining when checked: 54 days
Verification detailsCertificate trust: Passed · Hostname match: Passed

HTTP response headers

HTTP

HeaderValue
content-typetext/html; charset=utf-8
cache-controlpublic, max-age=0, must-revalidate
servercloudflare
strict-transport-securitymax-age=15552000; includeSubDomains; preload
x-frame-optionssameorigin
x-content-type-optionsnosniff
referrer-policystrict-origin-when-cross-origin
access-control-allow-origin*

Identified technologies

Next.jsGoogle Tag ManagerStripeCloudflare

Pages, Search and Sharing

Meta descriptionTest new user signups, transactional emails, spam scores, and more. Get started on our free forever plan with unlimited email addresses and mailboxes.
Canonical URLhttps://testmail.app/
LanguageEnglish (default)
Twitter Cardsummary
All bots 1 allowed · 1 disallowed
  • Allow/
  • Disallow/github-student

User reviews (0)

  • No reviews yet.