The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To test a real verification email in GitHub Actions without mocking the mailer, run your application in the workflow, point its outbound SMTP at a mail catcher such as Mailpit or MailDev running as a service container, trigger signup, poll the catcher’s API until the matching message arrives, then extract the link or code and complete verification. The test then exercises the real send path and the real verification behavior. It does not prove that the message was delivered by your production email provider, so that boundary needs to be stated explicitly in your test plan.
What “without mocking” means here
A mocked mailer replaces the send call with a stub that records arguments. That tells you the application attempted to send something, but nothing about the message itself: its recipient, its subject, its body, or whether the link inside it works. Reading a verification email without mocking means letting the application hand a real message to a real SMTP server and then reading that message back out. The mail server is a test double of sorts, but the application code path, the MIME message, and the link or code inside it are all produced by the application under test.
As an Amazon Associate I earn from qualifying purchases.
Confirm you mean an application’s own verification email
Most readers searching this phrase are testing a signup or account-verification message sent by their own application. If you instead mean verifying your own GitHub account email address, that is a different flow. GitHub states that disposable email addresses cannot be verified, and it lists creating or using GitHub Actions among the actions restricted while an address remains unverified. See the GitHub email-address reference for the current list. The rest of this article assumes the application-under-test case.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe core workflow
- Decide what the test must cover. If it needs to verify generated content and verification behavior, a local catcher is sufficient. If it must also prove that the production provider delivers the message, you need a different boundary (covered below).
- Start a local mail catcher as a service container in the job, or provision an isolated hosted inbox for the run.
- Configure the application’s mail transport for that target. For a local catcher, this typically means the SMTP host is
localhostand the port is the catcher’s SMTP port, which is 1025 in the Mailpit example below. - Clear or isolate the mailbox before triggering the flow, so that an old message cannot satisfy the assertion.
- Trigger signup or verification in the test. Then poll for a message matching the expected recipient and subject. SMTP delivery is asynchronous, so a single immediate read can race the message’s arrival.
- Assert the subject, recipient, and expected body content. Extract the verification URL or code, follow or submit it, and assert the resulting application state, such as the account being marked as verified.
- Bound the polling deadline and make failures report which stage broke: sending, capture, extraction, or verification.
Why polling, not sleeping
MailDev’s CI guide describes the pattern directly: start the server, clear the inbox, trigger the action, poll its REST API, and assert on message fields or an extracted link. Its guide makes the key point that the request which triggered the email usually returns before the catcher has received it, so a single read is unreliable. A fixed sleep is also fragile, because it is either too short on a slow runner or wastes time on a fast one. Poll with a deadline, stop as soon as the message appears, and fail with the last observed state when it does not.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A Mailpit service-container example
A public GitHub Actions example runs Mailpit as a service container, sends mail through localhost:1025, and reads captured messages through its HTTP API on port 8025. Treat it as an illustration of the pattern rather than a guarantee that every project’s networking or service configuration will match. Check the ports and service settings against your own workflow. The example is in the action-send-mail test workflow, and the project itself is documented in the Mailpit project repository.
Choosing the right test boundary
The word “real” in this context can mean several different things. Pick the boundary that matches what you are trying to prove.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
| Approach | What it validates | Main trade-off |
|---|---|---|
| Local SMTP capture (Mailpit or MailDev) | The application’s send path to the configured catcher, the generated message, and link or code handling | The message stays local. It does not prove delivery through an external provider or inbox placement. |
| Hosted disposable inbox API | A message received by an externally hosted inbox, with the vendor API returning the code or link | Adds an external service, plus credentials, a network dependency, quotas, and retention rules to manage. |
| Shared real mailbox | That a message reaches a mailbox the test can read | Shared state, stale messages, and collisions across parallel runs. Credential handling needs care. |
| Mocked mailer | Application behavior around a stubbed send call | Does not test inbox receipt at all. Useful only when rendering logic or internal behavior is the target. |
What local catchers cover
Mailpit provides an SMTP server, a web interface, a REST API intended for integration tests, Docker images, and message inspection, including link checks. MailDev offers SMTP plus an HTTP API for assertions. Both let your test read the exact bytes the application generated, which is what makes the verification link testable without mocking the mailer.
Free tools Windows power users keep installed
One-click scans. No signup required.
What hosted inboxes add
A hosted inbox service is useful when the test must receive mail from outside your own job, for example when you need a real public mail path. The MailSink guide describes a hosted inbox API that creates a fresh inbox per run and waits for a code or link. That guide is vendor-authored, so treat its plan limits, feature list, and pricing as the vendor’s claims and check the current documentation before relying on them. Only the workflow pattern is independently useful here.
Rank #3
- FIDO2/Passkey Authentication – Secure, passwordless login with supported platforms. Check if your intended service supports hardware keys before purchase. Works with Gmail, Facebook, GitHub, Dropbox, and more.
- Enhanced Multi-Factor Authentication (MFA): Strengthen account security using either FIDO2.0 authentication or TOTP/HOTP codes, providing flexible options for added protection.
- Universal Connectivity: Features USB-A and NFC compatibility, making it easy to use across various devices including PCs, Macs, iPhones, and Android phones for seamless integration.
- Durable & Portable Design: Built with a 360° rotating metal cover for extra durability. Compact and lightweight, it easily attaches to a keychain for on-the-go convenience. No batteries or network required, ensuring dependable use anywhere.
- FIDO Certified & Business-Ready: Certified for FIDO standards and supported by a range of management software suites, ideal for both individual users and enterprise deployment.
Reliability and security
- Isolate each run. Use a fresh or cleared inbox per test or job, and filter by recipient and expected subject so an earlier message cannot pass the assertion.
- Bound the wait. Poll until a deadline, not for a guessed sleep, and report the last state when the deadline passes.
- Store API keys as secrets. If a hosted inbox needs a key, keep it in an Actions secret and expose it only to the step that uses it. GitHub’s secrets documentation says a secret is readable only when a workflow explicitly includes it, and it recommends granting credentials only the minimum permissions they need. See the GitHub Actions secrets documentation. Redaction does not reliably cover every transformed form of a value, so never print credentials or verification tokens to logs.
- Treat verification links as sensitive. Use test accounts in a test environment, and make sure test mail cannot reach real users.
- Assert the outcome, not just the email. Confirming that a message exists proves little. Follow the link or submit the code, then check the account state the product promises.
Troubleshooting a failing run
- No message ever appears. Check that the application reads the SMTP host and port from the test configuration, and that the service container is reachable from the job’s network.
- A message appears intermittently. The poll deadline is probably too short, or the mailbox is not cleared before the trigger.
- The message appears but the link fails. Inspect the captured HTML and text parts. Verify that the URL uses the test environment’s base address rather than a production one.
- The test passes locally but fails in Actions. Compare the service container port mapping and the hostname the application uses with the values in your workflow file.
What a local test does not prove
A local catcher proves that your application generated the right message and that its verification path works. It does not prove that the message would reach a real inbox through your production email provider, nor that it avoids spam filters. If you need that evidence, add a separate, smaller test against a hosted inbox or a staging provider configuration, and keep it out of the fast path that runs on every commit.
Source notes
The GitHub guidance on unverified email addresses and Actions secrets comes from GitHub’s own documentation. The local-capture pattern and its asynchronous-delivery caveat come from the MailDev project’s CI guide, and the Mailpit description comes from its project repository. The hosted-inbox workflow comes from a vendor guide, which describes its own service. Product details, plan limits, and release versions change over time, so confirm them against each project’s current documentation before you depend on them.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Retrieving a verification email in a GitHub Actions run is straightforward once you separate the application’s send path from external delivery. Capture the message locally to test generated content and verification behavior, use a hosted inbox only when external receipt matters, and always assert the outcome of following the link or code.
Bottom line
Use a local SMTP catcher for the everyday verification test, and reserve hosted inboxes for the smaller set of tests that must prove external receipt.
See also: the MailDev CI testing guide.
Full MailSink workflow: MailSink guide to testing email verification in GitHub Actions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
