Give every test its own email address
Catch-all email testing lets every address on a subdomain receive mail, so each test can invent its own address, such as signup-1042@otp.example.com, with nothing to create in advance. MailBots receives mail for a subdomain you point at it with one MX record. Your company email stays untouched, and messages are readable on the web, over IMAPS and POP3S, through a REST API or by signed webhook.
Or start free with thebrowser extension
How it works
- Choose a subdomain you control, for example
otp.example.com. - Add a TXT record that proves you own it and an MX record that sends its mail to MailBots.
- MailBots checks both records, then asks you to send one email from an outside account to confirm that mail really arrives.
- Provision the mailbox and save its credentials, which are shown once. From then on, every address at
otp.example.comlands in that mailbox.
- TXT name
_mailbots-challenge.otp.example.com- TXT content
mailbots-verification=mb-…- MX name
otp.example.com- MX target
mx1.mailbots.top
The dashboard shows the exact values for your domain. The DNS setup guide walks through every step, including DNS providers that display relative names.
Why a subdomain and not your main domain
MX records apply to one name at a time. Pointing otp.example.com at MailBots changes where mail for that subdomain goes and nothing else: mail to you@example.com keeps reaching your company's mail provider.
Never change the MX records of your root domain for testing. MailBots only ever asks for the subdomain.
Ways to read the mail
| Method | Best for | Details |
|---|---|---|
| Web inbox | Manual QA | The MailBots dashboard |
| IMAPS | Mail clients and scripts | mx1.mailbots.top, port 993 |
| POP3S | Simple downloads | mx1.mailbots.top, port 995 |
| REST API | Assertions in CI | Messages with the detected code |
| Webhooks | Event-driven tests | Signed message.received events |
The mail client guide covers IMAPS and POP3S settings. For browser tests, see the Playwright and Cypress guides.
Isolation and security
- Each subdomain gets its own mailbox, quota and credentials.
- API keys are scoped to
domains:read,messages:readandusage:read, shown once and revocable at any time. - Webhook requests are signed with HMAC-SHA256, so your endpoint can reject anything MailBots did not send.
- Raw messages are deleted from the mail gateway after 72 hours, and the text and codes kept for the dashboard and API follow the same limit.
- MailBots is receive-only. There is no SMTP submission, so a leaked mailbox password cannot send mail as your domain.
Plans
Starter costs $10 a month for one subdomain, 5,000 messages a month and 250 MB of storage. Pro costs $15 a month for five subdomains, 25,000 messages a month, 1 GB of storage and three team members. Both include the web inbox, IMAPS, POP3S, the REST API and webhooks. See the full comparison.
Questions
Will a catch-all subdomain affect our company email?
No, as long as you only change records for the subdomain. Your root domain's MX records, and the mail they deliver, stay exactly as they are.
Does it work with any DNS provider?
Any provider that lets you add TXT and MX records for a subdomain works, including Cloudflare, Amazon Route 53 and most registrars.
Can one account use several subdomains?
Pro allows five, which suits separate environments such as staging, preview and CI. Starter allows one.
What happens to mail after 72 hours?
It is deleted automatically, from the mail gateway and from the dashboard and API alike. Export anything you need to keep before then.