How do I test email sending in staging without emailing real users?

A few good ways to test email in staging without risking real users:

1. Use a mail sandbox service

Set your staging app to send through a testing provider like:

• Mailtrap
• Ethereal Email
• Mailosaur
• Postmark test mode / similar provider features

These capture emails in a web UI or API instead of delivering them to real inboxes.

2. Route all staging mail to a safe inbox

Configure staging so every email goes to:

• a single internal mailbox, or
• a fixed allowlist like staging-test@yourcompany.com

You can also rewrite recipient addresses in staging, e.g.:

• alice@example.com → staging+alice@example.com

3. Use a recipient override in staging

Keep the email logic the same, but in staging replace the actual recipient with a test address:

• TO = QA inbox
• put the original intended recipient in the body or headers for verification

This is common for end-to-end testing.

4. Disable delivery and log only

In staging, swap the email provider with a mock backend that:

• logs subject/body/to/attachments
• stores emails in a local table or file
• never sends anything externally

Useful for automated tests.

5. Add a “fail-safe” blocklist

Even if you use test emails, add a staging guard like:

• only send to your company domain
• block all non-approved domains
• require an explicit ALLOW_EMAILS=true flag

This helps prevent accidents.

Recommended setup

Best practice is usually:

• staging uses a sandbox provider
• production uses real delivery
• all non-production environments have a hard recipient allowlist or override

Extra safety tips

• Use separate API keys for staging and production
• Add a big environment label in every test email subject/body
• Set up alerts if staging attempts to send to non-test domains
• Write automated tests that assert the recipient is rewritten correctly

If you want, I can help you design a safe staging email setup for a specific stack like Node/Express, Django, Rails, or Python.