How to test an email marketing platform
Direct answer
Shipped untested, an email marketing platform lets a phished support-console login open customer accounts with every subscriber list and sending domain, and sends campaigns to imported lists with no consent record or with a broken unsubscribe link or missing postal address. 9 tests are mandatory here, each tied to a risk in the map below. After the release smoke check, start the risk tests with end-to-end functional tests: a subscriber who joins by double opt-in and unsubscribes in one click must get no later campaign from any list in that account.
9 mandatory testsfirst: end-to-end functional tests
What counts as an email marketing platform
An email marketing platform here is a web app and API where customers import contact lists, capture consent through hosted signup forms, build campaigns and send bulk mail from their own sending domain. It covers double opt-in, list imports and merges, suppression of unsubscribed, bounced and complained addresses, the one-click List-Unsubscribe header, sender authentication and the staff support console. Transactional mail sent by an app about a user's own account and person-to-person chat are out of scope.
Adjacent product types not covered here
- identity and access management service: An identity provider signs users in to other apps, so token and session flaws replace consent records, suppression lists and sender authentication.
- e-signature service: An e-signature service sends one document to named signers who must act on it, so signature validity and audit trails replace bulk sending to lists and one-click unsubscribe.
- messaging app: A messaging app carries conversations between people who chose to talk, so message delivery and abuse reports replace list consent and mailbox provider sender rules.
Risk map
| Risk | Grade | Note | Evidence | |
|---|---|---|---|---|
| Fine or enforcement by a regulator regulatory-penalty | legal | primary | A campaign to an imported list with no consent record, or with a broken unsubscribe link or missing postal address, breaks CAN-SPAM and GDPR for the sender. | |
| Personal or sensitive data exposed data-breach | data | primary | A support-console login phished from platform staff opens customer accounts, and with them every subscriber list and the account's sending domain. | |
| Records silently wrong data-corruption | data | primary | A mail scanner that prefetches the List-Unsubscribe link removes a subscriber who never clicked, and the audience shrinks with no complaint recorded. | |
| App rejected or removed by a store store-rejection | distribution | primary | Gmail and Yahoo spam-folder or refuse a bulk campaign whose sending domain lacks SPF, DKIM, DMARC alignment or a one-click List-Unsubscribe header. |
Mandatory tests (9)
Step 1: release smoke tests
Why:store-rejection
Done when: After every deploy, a test campaign to seed inboxes at Gmail and Yahoo lands in the inbox with SPF, DKIM and DMARC shown as pass in the headers.
Tool class: browser automation. Who usually runs it: QA engineer.
Step 2: end-to-end functional tests
Why:regulatory-penaltystore-rejection
Done when: A subscriber who joins through double opt-in, receives a campaign and unsubscribes in one click gets no later campaign from any list in that account.
Tool class: browser automation. Who usually runs it: QA engineer.
Step 3: regression suite
Why:data-corruptionregulatory-penalty
Done when: The unsubscribe, suppression and consent-capture cases rerun on every release, and a single failure blocks it.
Tool class: test management. Who usually runs it: QA engineer.
Step 4: data integrity and migration testing
Why:data-corruptionregulatory-penalty
Done when: After a list import or merge, previously suppressed contacts stay suppressed and every imported contact shows a consent source and date.
Tool class: data validation. Who usually runs it: QA engineer.
Step 5: unit tests
Done when: The suppression step drops every unsubscribed, bounced and complained address from a fixed send list before the send queue is built.
Tool class: unit framework. Who usually runs it: developer.
Step 6: compliance checks
Done when: Every campaign template carries a working unsubscribe link and the sender's postal address, and sending is blocked until both are present.
Tool class: test management. Who usually runs it: product manager.
Step 7: integration tests
Why:store-rejectiondata-corruption
Done when: Clicking one-click unsubscribe in a Gmail or Yahoo seed inbox removes the contact once, and a link scanner opening the same link leaves the contact shown as subscribed in the audience list.
Tool class: API client. Who usually runs it: developer.
Step 8: security scanning
Why:data-breach
Done when: The scan report for the app and API has no open high finding that exposes subscriber lists or sending domain settings, and API keys are shown once at creation and masked afterwards.
Tool class: DAST scanner. Who usually runs it: security specialist.
Step 9: penetration testing
Why:data-breach
Done when: A tester holding a staff support account cannot export a customer's audience or change its sending domain without a logged customer approval.
Tool class: proxy. Who usually runs it: security specialist.
Recommended and optional tests
contract testsrecommended
Becomes mandatory when partners sync contacts through the API.
exploratory testingrecommended
Becomes mandatory when list merges, re-subscribes or segment edits leave subscribers with the wrong status.
accessibility testingrecommended
Becomes mandatory when hosted forms serve public sector customers with accessibility rules.
performance and load testingrecommended
Becomes mandatory when large campaign sends drop or duplicate messages or make the app unusable.
resilience and failure testingrecommended
Becomes mandatory when an outbound mail relay outage loses or duplicates queued campaigns.
analytics and event tracking testsoptional
May help: catches open and click reports that do not match what seed inboxes did.
Not needed and why
Not needed: no attached risk comes from users misreading the editor. Becomes recommended when the campaign builder is redesigned.
device and browser compatibility
Not needed: no attached risk comes from how email clients render a template. Becomes recommended when broken rendering is linked to complaints or unsubscribes.
Not needed: the app and hosted forms ship in one language. Becomes recommended when the app or hosted forms ship a second language.
Order of work
First release
- release smoke tests: After the deploy, send a test campaign to seed inboxes at Gmail and Yahoo and confirm it lands in the inbox with SPF, DKIM and DMARC passing in the headers.
- end-to-end functional tests: Join a list through double opt-in, receive a campaign, unsubscribe in one click and confirm no later campaign arrives from any list in that account.
- regression suite: Rerun the unsubscribe, suppression and consent-capture cases and block the release on any single failure.
- data integrity and migration testing: Import and merge a test list that contains suppressed contacts and confirm they stay suppressed and every imported contact shows a consent source and date.
- unit tests: Run the suppression step on a fixed send list with unsubscribed, bounced and complained addresses spread across several lists and confirm all are dropped before the send queue is built.
- compliance checks: Try to send a campaign from a template without an unsubscribe link or postal address and confirm sending is blocked until both are present.
- integration tests: Click one-click unsubscribe in a Gmail and a Yahoo seed inbox and confirm the contact is removed once, then let a link scanner open the same link for another contact and confirm it still shows as subscribed in the audience list.
- security scanning: Scan the app and API for findings that expose subscriber lists or sending domain settings, and confirm API keys are shown once at creation and masked afterwards.
- penetration testing: Have a tester with a staff support account try to export a customer's audience and change its sending domain without a logged customer approval.
Ongoing cadence
- release smoke tests: After every deploy.
- regression suite: On every release that touches sending or list logic.
- data integrity and migration testing: After each change to list import or merge code.
- integration tests: When Gmail or Yahoo change their bulk sender requirements.
- compliance checks: After each change to campaign templates or the send gate.
- penetration testing: After each change to staff console access to customer accounts.
- contract tests: When partners start syncing contacts through the API.
Tools
Listed alphabetically inside each test type, filtered to the tests above and to the platforms of email marketing platform (web, api). Not recommendations.
release smoke tests
end-to-end functional tests
- ApplitoolsVisual comparison of screens across builds. webiosandroidcommercial
- BrowserStackCloud of real devices and browsers. webiosandroidcommercial
- CypressBrowser-based end-to-end testing with a visual runner. webfreemium
- DeepEvalUnit-style evaluation for LLM applications. apiopen-source
- LambdaTestCloud browser and device grid. webiosandroidcommercial
- PercyVisual review of UI changes. webcommercial
- PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
- PostmanAPI client with collections and scripted assertions. apifreemium
- PromptfooEvaluation and regression tests for LLM prompts and outputs. apiwebopen-source
- Sauce LabsCloud test infrastructure for web and mobile. webiosandroidcommercial
- SeleniumWebDriver-based browser automation. webopen-source
regression suite
- CypressBrowser-based end-to-end testing with a visual runner. webfreemium
- DeepEvalUnit-style evaluation for LLM applications. apiopen-source
- PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
- PromptfooEvaluation and regression tests for LLM prompts and outputs. apiwebopen-source
- TestRailTest case and run management. webiosandroidapicommercial
- XrayTest management inside Jira. webiosandroidapicommercial
data integrity and migration testing
- dbt testsTests on warehouse models inside dbt. apiopen-source
- Great ExpectationsData validation with declarative expectations. apiopen-source
unit tests
integration tests
- Charles ProxyHTTP proxy for inspecting and throttling traffic. iosandroidwebcommercial
- JestJavaScript test runner with mocking and snapshots. webapiopen-source
- JUnitTest framework for the JVM. apiandroidopen-source
- PostmanAPI client with collections and scripted assertions. apifreemium
- pytestTest framework for Python with fixtures and plugins. apiopen-source
- VitestTest runner for Vite-based JavaScript and TypeScript projects. webapiopen-source
security scanning
- Burp SuiteProxy and scanner for web application security testing. webapifreemium
- GarakProbing LLM applications for prompt injection and leakage. apiopen-source
- mitmproxyInteractive HTTPS proxy. iosandroidwebapiopen-source
- OWASP ZAPDynamic application security scanner. webapiopen-source
- SchemathesisProperty-based testing from OpenAPI and GraphQL schemas. apiopen-source
- SemgrepStatic analysis with custom rules. apiwebiosandroidfreemium
- SnykDependency and code vulnerability scanning. apiwebiosandroidfreemium
- TrivyScanner for containers, dependencies and configuration. apiopen-source
penetration testing
- Burp SuiteProxy and scanner for web application security testing. webapifreemium
contract tests
- PactConsumer-driven contract testing with a broker. apiopen-source
- PostmanAPI client with collections and scripted assertions. apifreemium
- SchemathesisProperty-based testing from OpenAPI and GraphQL schemas. apiopen-source
accessibility testing
- axe-coreAccessibility rules engine for automated checks. webopen-source
- LighthouseAudits for accessibility and performance in Chrome. webopen-source
- Pa11yCommand-line accessibility testing. webopen-source
performance and load testing
- ArtilleryLoad testing with YAML scenarios. apiwebfreemium
- GatlingLoad testing with Scala, Java or Kotlin scenarios. apiwebfreemium
- JMeterLoad testing tool from the Apache Foundation. apiwebopen-source
- k6Load testing scripted in JavaScript. apiwebopen-source
- LighthouseAudits for accessibility and performance in Chrome. webopen-source
- LocustLoad testing scripted in Python. apiwebopen-source
resilience and failure testing
- Chaos MeshFault injection for Kubernetes. apiopen-source
- GremlinManaged fault injection. apicommercial
- ToxiproxyTCP proxy for simulating network failures. apiopen-source
What to send to the person who will test
Send the checklist and the brief below. The printable checklist for email marketing platform has the same 9 items with checkboxes.
Download the checklistMarkdownCSVBrief (Markdown)
Acceptance criteria wording
A release of the email marketing platform is accepted when a test campaign to seed inboxes at Gmail and Yahoo lands in the inbox with SPF, DKIM and DMARC passing, and a subscriber who unsubscribes in one click gets no later campaign from any list in that account. A link scanner opening the unsubscribe link leaves the contact shown as subscribed in the audience list. Suppressed contacts stay suppressed after a list import or merge, and sending is blocked until a template carries an unsubscribe link and postal address.
Brief
# Test brief: email marketing platform Product type: email marketing platform. Campaigns, lists, consent and deliverability. Risk map and evidence: https://howtotestaproduct.com/how-to-test/email-marketing-platform/ Printable checklist: https://howtotestaproduct.com/checklists/email-marketing-platform/ Run these 9 mandatory tests in this order. A test is done only when its done condition is true on the build you will release. 1. release smoke tests (risks: store-rejection). Tool class: browser automation. Usually run by: QA engineer. Done when: After every deploy, a test campaign to seed inboxes at Gmail and Yahoo lands in the inbox with SPF, DKIM and DMARC shown as pass in the headers. 2. end-to-end functional tests (risks: regulatory-penalty, store-rejection). Tool class: browser automation. Usually run by: QA engineer. Done when: A subscriber who joins through double opt-in, receives a campaign and unsubscribes in one click gets no later campaign from any list in that account. 3. regression suite (risks: data-corruption, regulatory-penalty). Tool class: test management. Usually run by: QA engineer. Done when: The unsubscribe, suppression and consent-capture cases rerun on every release, and a single failure blocks it. 4. data integrity and migration testing (risks: data-corruption, regulatory-penalty). Tool class: data validation. Usually run by: QA engineer. Done when: After a list import or merge, previously suppressed contacts stay suppressed and every imported contact shows a consent source and date. 5. unit tests (risks: regulatory-penalty). Tool class: unit framework. Usually run by: developer. Done when: The suppression step drops every unsubscribed, bounced and complained address from a fixed send list before the send queue is built. 6. compliance checks (risks: regulatory-penalty). Tool class: test management. Usually run by: product manager. Done when: Every campaign template carries a working unsubscribe link and the sender's postal address, and sending is blocked until both are present. 7. integration tests (risks: store-rejection, data-corruption). Tool class: API client. Usually run by: developer. Done when: Clicking one-click unsubscribe in a Gmail or Yahoo seed inbox removes the contact once, and a link scanner opening the same link leaves the contact shown as subscribed in the audience list. 8. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist. Done when: The scan report for the app and API has no open high finding that exposes subscriber lists or sending domain settings, and API keys are shown once at creation and masked afterwards. 9. penetration testing (risks: data-breach). Tool class: proxy. Usually run by: security specialist. Done when: A tester holding a staff support account cannot export a customer's audience or change its sending domain without a logged customer approval. Acceptance criteria wording: A release of the email marketing platform is accepted when a test campaign to seed inboxes at Gmail and Yahoo lands in the inbox with SPF, DKIM and DMARC passing, and a subscriber who unsubscribes in one click gets no later campaign from any list in that account. A link scanner opening the unsubscribe link leaves the contact shown as subscribed in the audience list. Suppressed contacts stay suppressed after a list import or merge, and sending is blocked until a template carries an unsubscribe link and postal address. Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file). Licence: CC BY 4.0.
For founders: what to forward and what to ask back. For product managers: turning this page into tickets.
Questions about testing an email marketing platform
What testing does an email marketing platform need?
9 tests are mandatory, starting with a seed-inbox smoke test after every deploy and end-to-end tests of double opt-in and one-click unsubscribe. Each is tied to one of the 4 risks in the map: a phished staff console exposing lists, campaigns sent without consent or unsubscribe, bulk mail refused for missing sender authentication and subscribers removed by scanners that prefetch the unsubscribe link. Contract, exploratory, accessibility, performance and resilience tests are recommended, each with the event that makes it mandatory.
What does GDPR mean for testing an email marketing platform?
The map cites the General Data Protection Regulation, with the CAN-SPAM compliance guide, for campaigns sent to imported lists with no consent record or with a broken unsubscribe link or missing postal address. Data integrity tests confirm every imported contact shows a consent source and date and that suppressed contacts stay suppressed after an import or merge. Compliance checks block sending until a template carries an unsubscribe link and the sender's postal address.
What is the minimum testing for an email marketing platform at MVP stage?
The minimum is the 9 mandatory tests, because their conditions apply from the first bulk send: customers import lists, campaigns carry a List-Unsubscribe header and staff reach customer accounts through a console. Analytics tracking is optional, and usability, compatibility and localization tests are not needed until the conditions on this page change.
Which tests in a vendor test plan for an email marketing platform are not needed?
Compatibility testing of email client rendering is not needed until broken rendering is linked to complaints or unsubscribes. Localization is not needed while the app and hosted forms ship in one language. Usability testing is not needed until the campaign builder is redesigned.
When is test automation worth it for an email marketing platform?
The unsubscribe, suppression and consent-capture cases rerun on every release that changes sending or list logic, and a single failure blocks the release. The suppression step is a mandatory unit test while one contact can sit on several lists, and the seed-inbox smoke test runs after every deploy.
Evidence
ev-0025regulatorprimary
Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex, European Union
The GDPR sets lawful basis, consent, data subject rights, security of processing (Article 32) and breach notification duties for anyone processing personal data of people in the EU.
published undated · verified 2026-10-07
ev-0034regulatorprimary
CAN-SPAM Act: A Compliance Guide for Business, U.S. Federal Trade Commission
CAN-SPAM requires commercial email to carry a working opt-out and to honour opt-out requests promptly, and to include the sender's valid physical postal address.
published undated · verified 2026-10-07
ev-0227post-mortemprimary
Information About a Recent Mailchimp Security Incident, Mailchimp
The unauthorized actor conducted a social engineering attack on Mailchimp employees and contractors, and obtained access to select Mailchimp accounts using employee credentials compromised in that attack.
Official incident notice from an email marketing platform: staff credentials taken by social engineering opened customer accounts. Supports data-breach for email marketing platforms through internal support access.
published undated · verified 2026-10-07
ev-0228post-mortemprimary
Information About a Recent Security Incident Targeting Crypto Companies, Mailchimp
Official incident notice: an attacker reached an internal tool used for customer support and account administration through social engineering of staff and accessed customer accounts. Second incident of the same path, supports data-breach for email marketing platforms.
published undated · verified 2026-10-07
ev-0230standardprimary
RFC 8058: Signaling One-Click Functionality for List Email Headers, IETF
Standard for one-click unsubscribe: it exists because anti-spam software that fetches URLs in email headers triggered unsubscriptions nobody asked for. Supports data-corruption of subscriber status and the header requirement for email marketing platforms.
published undated · verified 2026-10-07
ev-0035store-guidelineprimary
Email sender guidelines, Google
Gmail requires bulk senders to authenticate mail and offer one-click unsubscribe; mail that does not comply can be rejected or sent to spam.
published undated · verified 2026-10-07
ev-0229store-guidelineprimary
Sender [...] Practices, Yahoo
Mailbox provider requirements for bulk senders: SPF, DKIM, a published DMARC policy and a working one-click List-Unsubscribe header. Supports store-rejection (mail filtered or refused by the mailbox provider) for email marketing platforms that send on customers' behalf.
published undated · verified 2026-10-07
Disclaimer
This page lists tests and risks for a product category, not for your product. Risks are attached only with the evidence shown in the Evidence section. Tools are listed alphabetically and are not recommendations. Nothing here is legal, regulatory or security advice; where a regulator or a store sets a requirement, their page is linked and takes precedence.