Compare plans and features

An inbox is one capture address. Inboxes on your subdomain are addressed as name@your-org.mailqa.io; the SMTP sink also files mail sent to any other recipient (user@gmail.com) into an inbox of its own, created on first use. Deleting an inbox frees its slot straight away.

Your capture allowance for a calendar month, counted across every inbox in the organization. A message sent to recipients in several inboxes is filed in each of them and counts once per inbox.

The most recent messages an inbox holds. When a new one would exceed the cap the oldest is evicted, first in, first out, so a test loop left running overnight fills one inbox rather than your whole account.

The largest single message the listeners accept, attachments included. Anything larger is refused on the wire with a 552, so your app sees the rejection in its own log instead of a message that silently never arrives.

How long a captured message stays before a daily sweep deletes it, along with its attachments and raw source. Long enough to debug a failed CI run, short enough that stale test data does not pile up. You can delete messages or empty an inbox sooner from the dashboard or the API.

Seats in the organization, the owner included. Everyone you invite sees every inbox, so QA, developers and support share one capture space instead of forwarding screenshots.

Point your app at smtp.mailqa.io (port 587 or 2525) with your organization’s SMTP credentials and everything it sends is captured, whoever the recipient, and filed by recipient. Nothing about your code changes between local development, CI and staging except the SMTP host.

Every organization gets *@your-org.mailqa.io. Mail sent there over the public internet — DNS, SPF, DKIM and DMARC and all — lands in the matching inbox exactly as production delivery would. Public delivery opens once an owner has verified their email address.

Point a domain you control — test.yourcompany.com — at mailQA by adding one MX record, and your inboxes answer there as well as on your mailQA subdomain. Test mail then arrives at addresses that look like production’s, which is what the screenshots in your bug reports show. The mailQA address keeps working, so nothing you have already configured breaks.

qa+signup@… and qa+reset@… both land in the qa inbox, each tagged with the part after the plus. Filter by tag in the dashboard or with the API’s tag parameter to tell one flow’s mail from another’s without a separate inbox for each.

Send to any address on your subdomain and the inbox is created on first delivery, with no setup step in between — ideal for signup tests that mint a fresh address every run. Without catch-all, mail to an address you have not created yet is refused with “no such mailbox”. Auto-created inboxes still count toward the inbox limit.

Every message carries all three results, verified when it arrives. A test can assert that staging signs its mail correctly before production ever sends any.

Messages appear in the dashboard the instant they are parsed, streamed over server-sent events. No refresh button, no polling interval to tune.

The rendered HTML, the plain-text part, the original .eml and every header, side by side. The raw message is the source of truth and is stored before anything is parsed, so it is always there to download.

Links and one-time codes are pulled out of every message as structured data — one click to copy in the dashboard, links and codes arrays in the API — so a test asserts on the code instead of on a regular expression over the body.

Listed with name, type and size, downloadable individually from the dashboard or the API. Inline images referenced from the HTML render in the preview.

Search subject, sender and body — a typo away still matches, ranked by relevance with the matching text highlighted — and filter by recipient, sender, tag, unread state or arrival time.

Rendered email is attacker-controlled HTML and is treated that way: sanitized server-side against a strict allowlist, with remote images blocked and counted, then displayed in a sandboxed iframe on a separate origin that runs no scripts.

Everything a test suite needs lives under /v1, authenticated with an API key: inboxes, messages, attachments and SMTP credentials. Cursor-paginated, with a stable machine-readable code on every error.

A typed JavaScript and TypeScript client. waitForMessage, waitForCode and waitForLink resolve the moment mail lands, so a test never writes sleep(5000) again. Works in Playwright, Cypress, Jest, Vitest or any Node script.

Creating an inbox is idempotent: the same name returns the same inbox at the same address, and empty: true clears what the last run left behind. A CI fixture can hardcode its address and run twice without a cleanup step.

Named keys you create and revoke individually, with an optional expiry. A key carries access to the whole organization, so one key serves every inbox a suite touches.

The API reference is generated from the same contracts the server validates against and served at /openapi.json — generate a client in another language, or load it into Postman.

Owner, admin and member. Owners handle billing; owners and admins manage members, roles and the SMTP credentials; members read every inbox and manage the inboxes they create.

Invite a teammate by email. The link they receive is the credential, so they join the organization in one click with no separate signup to complete.

One username and password for the whole organization, shown in the dashboard whenever you need them and rotated by an owner or admin at any time. Every configured mailer on the team uses the same pair.

Every request is scoped to your organization on the server; no endpoint accepts an organization id from the client, so cross-tenant access is structurally impossible rather than something each handler remembers to check.

Pay month to month, or annually and save 20%. Payments are processed by Stripe.

Move between tiers or cancel from the dashboard. Your limits update the moment the subscription changes, and a cancelled plan keeps capturing until the end of the period you paid for.

Captured mail stops here. There is no forwarding and no relay, so a misconfigured staging environment cannot reach a real customer through mailQA on any plan.