# Test brief: email marketing platform

Product type: email marketing platform. Campaigns, lists, consent and deliverability.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/email-marketing-platform/
Printable checklist: https://howtotestaproduct.com/checklists/email-marketing-platform/

Run these 9 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: store-rejection). Tool class: browser automation. Usually run by: QA engineer.
   Done when: After every deploy, a test campaign to seed inboxes at Gmail and Yahoo lands in the inbox with SPF, DKIM and DMARC shown as pass in the headers.
2. end-to-end functional tests (risks: regulatory-penalty, store-rejection). Tool class: browser automation. Usually run by: QA engineer.
   Done when: A subscriber who joins through double opt-in, receives a campaign and unsubscribes in one click gets no later campaign from any list in that account.
3. regression suite (risks: data-corruption, regulatory-penalty). Tool class: test management. Usually run by: QA engineer.
   Done when: The unsubscribe, suppression and consent-capture cases rerun on every release, and a single failure blocks it.
4. data integrity and migration testing (risks: data-corruption, regulatory-penalty). Tool class: data validation. Usually run by: QA engineer.
   Done when: After a list import or merge, previously suppressed contacts stay suppressed and every imported contact shows a consent source and date.
5. unit tests (risks: regulatory-penalty). Tool class: unit framework. Usually run by: developer.
   Done when: The suppression step drops every unsubscribed, bounced and complained address from a fixed send list before the send queue is built.
6. compliance checks (risks: regulatory-penalty). Tool class: test management. Usually run by: product manager.
   Done when: Every campaign template carries a working unsubscribe link and the sender's postal address, and sending is blocked until both are present.
7. integration tests (risks: store-rejection, data-corruption). Tool class: API client. Usually run by: developer.
   Done when: Clicking one-click unsubscribe in a Gmail or Yahoo seed inbox removes the contact once, and a link scanner opening the same link leaves the contact shown as subscribed in the audience list.
8. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist.
   Done when: The scan report for the app and API has no open high finding that exposes subscriber lists or sending domain settings, and API keys are shown once at creation and masked afterwards.
9. penetration testing (risks: data-breach). Tool class: proxy. Usually run by: security specialist.
   Done when: A tester holding a staff support account cannot export a customer's audience or change its sending domain without a logged customer approval.

Acceptance criteria wording:
A release of the email marketing platform is accepted when a test campaign to seed inboxes at Gmail and Yahoo lands in the inbox with SPF, DKIM and DMARC passing, and a subscriber who unsubscribes in one click gets no later campaign from any list in that account. A link scanner opening the unsubscribe link leaves the contact shown as subscribed in the audience list. Suppressed contacts stay suppressed after a list import or merge, and sending is blocked until a template carries an unsubscribe link and postal address.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.