Email, SMS & Notification Testing

Notifications are user-visible, legally regulated, and easy to break silently. Never test against real customers' addresses.

Capture, don't send

curl -s localhost:8025/api/v1/messages | jq '.messages[0] | {Subject, To, Created}'
curl -s localhost:8025/api/v1/search?query="subject:Reset" | jq '.messages_count'

// Playwright: request reset, read link from Mailpit, complete flow
await page.getByRole('button', {name:'Send reset link'}).click();
const msg = await (await request.get('http://localhost:8025/api/v1/message/latest')).json();
const link = msg.Text.match(/https?:\/\/\S+\/reset\S+/)[0];
await page.goto(link);

What to verify

• Trigger: sent once per event (no duplicates, no missing); correct recipient (To/Cc/Bcc); sender name/address; reply-to.
• Content: subject/preheader, personalization tokens (no {{name}} leaks; fallback when missing), currency/date/locale formatting, plain-text alternative, RTL, long names, emoji.
• Links & tokens: correct environment domain; tracking params; magic links single-use, expire, bound to user; unsubscribe works without login and is honored within 10 days (CAN-SPAM) — immediately is better.
• Rendering: Litmus/Email on Acid or Playwright screenshots; dark mode; Outlook (Word engine) tables; image blocking + alt text; mobile width ≤ 600px; size < 102 KB (Gmail clipping).
• Deliverability: SPF, DKIM, DMARC pass (dig TXT, mail-tester.com, Google Postmaster); List-Unsubscribe + One-Click header; bounce/complaint webhooks suppress addresses; warm-up; no spammy content.
• Timing & retries: send delay SLA; queue outage → retried, not lost; time-zone aware scheduling; quiet hours; rate limits/digest batching.
• Preferences & consent: opt-in/out per channel/category, double opt-in, GDPR/PECR consent records; transactional mail still sent to unsubscribed users only if truly transactional.
• Security: no secrets/passwords in email; header injection (\r\n in name/subject); HTML injection; account-existence not leaked by "we sent an email" messaging.
• Multi-channel: SMS length/segments (GSM-7 vs UCS-2), opt-out keywords (STOP/HELP), short-code compliance; push permissions denied path, deep-link routing, badge counts.

Related

functional-testing, localization-testing, security-testing, compliance-testing, test-data-engineering