Email Testing: MailParse vs Mandrill Inbound

Why email testing capability matters for inbound workflows

Inbound email often acts as the front door for support tickets, automated approvals, lead capture, and CI alerts. A broken parser or a misrouted hook can silently drop business critical data. Reliable email testing is therefore not an optional extra, it is how teams prove that MIME parsing, routing logic, and security checks behave correctly before production traffic flows. The right provider will make it easy to create disposable test addresses, simulate real-world MIME, and validate webhooks repeatedly in CI without complicated domain setup.

This article focuses specifically on email testing for inbound processing. You will see how a disposable address model compares with a domain-and-route approach, how each provider posts structured JSON, and what it looks like to exercise edge cases like nested multiparts and large attachments. We will use precise examples so you can decide what improves developer velocity and reduces risk.

How MailParse handles email testing

Testing starts with instant inboxes. Instead of requiring MX records up front, engineers create a disposable address through API or UI, send a message, and receive structured JSON by webhook or via REST polling. That workflow shortens the time from hypothesis to verification and fits naturally into CI pipelines and preview environments.

Disposable, time-boxed addresses

• Create an inbox programmatically that expires after minutes or hours. Ephemeral addresses reduce cleanup and prevent cross-test contamination.
• Tag inboxes by pull request, branch, or test suite. Tags make it straightforward to aggregate results in CI logs.
• Generate many inboxes in parallel to test routing and multi-tenant scenarios.

Webhook-first delivery and REST polling

When an inbound message arrives, the service parses MIME into JSON and posts to your HTTPS endpoint. You can also poll a REST endpoint to fetch the same events when you do not want to expose a public URL during local development. For webhook setup and signature validation guidance, see Webhook Integration: A Complete Guide | MailParse.

Realistic MIME for confidence

• Binary and quoted-printable bodies are decoded, charsets are normalized, and multipart nesting is preserved as a tree.
• Inline images include content IDs and disposition to help you reconstruct the message or strip them in pipelines.
• Attachments keep their original filenames and MIME types, with size and checksum metadata for validation.

If you want to understand how nested multiparts and encodings are transformed into a navigable JSON structure during tests, review MIME Parsing: A Complete Guide | MailParse.

How Mandrill Inbound handles email testing

Mandrill Inbound is part of Mailchimp Transactional Email. It processes inbound mail by routing messages for domains where you control MX records and then posting events to a webhook. It supports patterns like plus addressing and wildcard routes.

Account and domain prerequisites

• You need a Mailchimp Transactional account that includes inbound features.
• Verify an inbound domain and update MX records to point to Mandrill. This step is required before messages will flow to your webhook.
• Create inbound routes that map local parts or patterns to specific webhooks.

This setup is production grade, but it introduces lead time for testing. Teams usually create a separate sandbox domain to avoid impacting live routes.

Test tooling and event shape

• In the dashboard you can trigger a sample inbound event to your webhook. The event payload includes a parsed view along with a raw message.
• For end-to-end tests, you send a real email to the verified inbound domain and route matching your test pattern. That allows full SMTP traversal before JSON emission.

Mandrill's webhook posts use a standard structure that includes event: "inbound", a msg object with raw_msg, text, html, headers, from_email, to, and an attachments map with base64 content.

Limitations for quick iteration

• No instant disposable inboxes, so you must manage routes and sometimes additional domains for short-lived tests.
• Inbound testing usually requires live DNS and MX changes. That can be inconvenient for CI and local development.
• The dashboard test is helpful, but it is a single-sample approach rather than a high-volume disposable address generator.

Side-by-side comparison for email testing

Feature	MailParse	Mandrill Inbound
Disposable test addresses	Yes - create instantly by API, optional expiry and tags	No - requires domain and route configuration
Sandbox without DNS changes	Yes - webhook and REST polling available immediately	No - MX records must point to Mandrill
Dashboard sample event	Yes - generate test payloads to any webhook	Yes - dashboard test posts sample inbound event
MIME parsing granularity	Structured JSON with nested multiparts, charset normalization	Parsed fields plus raw_msg for custom parsing
Attachments in JSON	Array with filename, content-type, size, hash, disposition, inline flag	Map keyed by filename with base64 content and type
Webhook security	HMAC signatures with timestamp and replay protection	X-Mandrill-Signature HMAC-SHA1 verification
CI friendliness	High - ephemeral inboxes fit per-PR and ephemeral envs	Medium - requires preexisting routes or dashboard sample
Time to first test	Minutes - no DNS or MX needed	Hours or more - depends on DNS propagation and domain setup
Standalone usage	Standalone inbound parsing service	Requires Mailchimp Transactional account

Code examples

Create a disposable test inbox and receive a webhook

This example shows how a test can create a temporary address, send a message, and verify the webhook signature locally.

# 1) Create a disposable inbox that expires in 15 minutes
curl -s https://api.example.test/v1/inboxes \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "expires_in": "15m",
    "tags": ["ci", "pr-1421"]
  }'

# Response:
# {
#   "inbox_id": "ibx_01J2Y2H0M6V8YF",
#   "address": "t.cx7pq4@in.testmail.example",
#   "expires_at": "2026-05-02T12:45:13Z"
# }

# 2) Send a test message with attachments using any SMTP sender or a library.
# Example using Node.js and nodemailer is omitted for brevity.

# 3) Webhook handler (Node.js/Express)

import crypto from "node:crypto";
import express from "express";

const app = express();
app.use(express.json({ limit: "25mb" }));

function verifySignature(req, secret) {
  const timestamp = req.header("X-Parse-Timestamp") || "";
  const signature = req.header("X-Parse-Signature") || "";
  const body = JSON.stringify(req.body);
  const mac = crypto
    .createHmac("sha256", secret)
    .update(timestamp + "." + body)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(signature));
}

app.post("/webhooks/inbound", (req, res) => {
  if (!verifySignature(req, process.env.PARSE_WEBHOOK_SECRET)) {
    return res.status(401).send("invalid signature");
  }

  const msg = req.body.message;
  // Basic assertions for a test run
  if (!msg.subject.includes("CI test")) {
    return res.status(422).send("unexpected subject");
  }

  // Access decoded parts
  console.log("From:", msg.from.email, msg.from.name || "");
  console.log("To:", msg.to.map(t => t.email).join(","));
  console.log("Text length:", msg.text?.length || 0);
  console.log("HTML length:", msg.html?.length || 0);

  for (const a of msg.attachments || []) {
    console.log(`Attachment ${a.filename} ${a.content_type} ${a.size} bytes`);
  }

  res.sendStatus(204);
});

app.listen(3000, () => console.log("listening on 3000"));

Webhook payload example:

{
  "id": "evt_01J2Y2H7A2BK2E",
  "received_at": "2026-05-02T12:31:01Z",
  "message": {
    "subject": "CI test - multiparts and attachments",
    "from": {"email": "qa@example.org", "name": "QA Bot"},
    "to": [{"email": "t.cx7pq4@in.testmail.example", "name": ""}],
    "headers": {"message-id": "<abc123@example.org>"},
    "text": "Hello test runner",
    "html": "<p>Hello <strong>test runner</strong></p>",
    "attachments": [
      {
        "filename": "report.pdf",
        "content_type": "application/pdf",
        "size": 345672,
        "disposition": "attachment",
        "inline": false,
        "sha256": "f7b3..."
      },
      {
        "filename": "logo.png",
        "content_type": "image/png",
        "size": 12034,
        "disposition": "inline",
        "inline": true,
        "content_id": "logo@cid"
      }
    ],
    "spam": {"score": 0.1, "is_spam": false},
    "dkim": {"valid": true},
    "spf": {"valid": true},
    "mime": {"content_type": "multipart/related", "boundary": "----=_Part_12345"}
  }
}

Mandrill Inbound webhook verification and parsing

Mandrill posts form-encoded data to your webhook and includes an X-Mandrill-Signature header. The signature is a base64 HMAC-SHA1 of the webhook URL and POST parameters concatenated in alphabetical order, keyed by your webhook signing key from the dashboard.

import crypto from "node:crypto";
import express from "express";
import qs from "qs";

const app = express();
// Mandrill posts as application/x-www-form-urlencoded
app.use(express.urlencoded({ extended: false, limit: "25mb" }));

function verifyMandrillSignature(req, webhookKey) {
  // Build the signed payload: url + sorted key=value for all POST fields
  const url = "https://example.test/webhooks/mandrill"; // must match configured webhook exactly
  const sorted = Object.keys(req.body).sort().map(k => k + req.body[k]).join("");
  const data = url + sorted;

  const hmac = crypto.createHmac("sha1", webhookKey).update(data).digest("base64");
  const provided = req.header("X-Mandrill-Signature") || "";
  return crypto.timingSafeEqual(Buffer.from(hmac), Buffer.from(provided));
}

app.post("/webhooks/mandrill", (req, res) => {
  if (!verifyMandrillSignature(req, process.env.MANDRILL_WEBHOOK_KEY)) {
    return res.status(401).send("invalid signature");
  }

  // inbound events arrive in mandrill_events as a JSON array
  const events = JSON.parse(req.body.mandrill_events);

  for (const evt of events) {
    if (evt.event !== "inbound") continue;
    const msg = evt.msg;

    // Parsed fields
    console.log("Subject:", msg.subject);
    console.log("From:", msg.from_email);
    console.log("Text length:", (msg.text || "").length);
    console.log("HTML length:", (msg.html || "").length);

    // Attachments map keyed by filename with base64 content
    if (msg.attachments) {
      for (const [name, meta] of Object.entries(msg.attachments)) {
        console.log(`Attachment ${name} ${meta.type} ${Buffer.from(meta.content, "base64").length} bytes`);
      }
    }

    // Raw MIME if you need to run a custom parser
    const raw = msg.raw_msg || "";
    console.log("Raw size:", raw.length);
  }

  res.sendStatus(204);
});

app.listen(3001, () => console.log("listening on 3001"));

Sample mandrill_events payload with a single inbound event:

[
  {
    "event": "inbound",
    "ts": 1714665600,
    "msg": {
      "from_email": "qa@example.org",
      "from_name": "QA Bot",
      "to": [["support@test-sandbox.example", ""]],
      "subject": "Inbound CI test",
      "text": "Plain body",
      "html": "<p>Plain <strong>body</strong></p>",
      "headers": {"Message-Id": "<abc123@example.org>"},
      "attachments": {
        "report.pdf": {
          "name": "report.pdf",
          "type": "application/pdf",
          "content": "JVBERi0xLjcK..."  // base64
        }
      },
      "raw_msg": "Return-Path: ...\r\nReceived: ...\r\nContent-Type: multipart/mixed; boundary=..."
    }
  }
]

Performance and reliability in test environments

Latency and throughput expectations

• Fast feedback loops are crucial for testing. In practice, both systems deliver events quickly once mail is accepted. Without DNS propagation delays, disposable inboxes typically yield end-to-end times measured in seconds.
• When using mailchimp mandrill inbound with a fresh sandbox domain, latency includes DNS changes. Plan test runs accordingly or pre-provision a stable test domain.

MIME edge cases you should test

• Quoted-printable with soft line breaks and mixed encodings. Verify that your webhook handler receives text that matches expectations and that character sets are normalized.
• Nested multipart/related with inline images. Confirm that inline attachments include content IDs and that your HTML rewriting logic references them correctly.
• Large attachments and content-type guessing. Ensure that filenames, sizes, and types propagate cleanly and that your storage layer enforces limits.
• Non-ASCII addresses and headers. Validate that display names are properly decoded from RFC 2047 and that punycode domains are handled end to end.
• SPF, DKIM, and spam annotations. Use these fields to make test assertions for security policies before rollout.

Failure modes and resilience

• Webhook retries: configure idempotency keys and a replay-safe signature scheme in your handler so that re-delivery does not duplicate work.
• Temporary 5xx errors: simulate backoffs in tests by intentionally returning 503 and validating that the provider retries on a sane schedule.
• Partial MIME: send truncated or malformed raw messages to verify that your code either rejects or falls back gracefully.

Verdict: which is better for email testing

If your priority is fast, repeatable testing with disposable addresses and no DNS changes, MailParse is the more efficient choice for email-testing workflows. The disposable inbox model and immediate webhook delivery make it easy to wire tests into CI and to spin up per-branch environments that validate complex MIME. The structured JSON is suited for assertions and audits without extra parsing.

If your organization already uses mailchimp transactional and you prefer to mirror production MX-based routing in tests, Mandrill Inbound is a solid path. You will get parsed fields plus the raw MIME and you can leverage the dashboard test capability. Expect additional setup time and less convenience for ephemeral tests, since routes and domains must be managed per environment.

For most development teams that value speed of iteration and isolation, the disposable address approach provides a smoother experience and lowers the cost of catching bugs before they reach production.

FAQ

Can I run end-to-end tests locally without exposing a public webhook URL

Yes. Use REST polling during local development or start a tunnel only for the duration of a test run. Polling lets your test runner fetch recent inbound events by inbox ID and assert on parsed content without internet routing back to your laptop.

How do I validate webhook authenticity

Use HMAC signatures coupled with a timestamp to protect against tampering and replay. Your handler should reject requests with missing or stale timestamps and must compare hashes using constant time functions. Mandrill provides X-Mandrill-Signature and a signing flow based on your webhook URL and form fields. Confirm that the configured URL in the signature computation matches exactly, including scheme and trailing slashes.

What is the best way to test large attachments

Generate attachments that match production sizes and types, for example PDFs and images. Assert on decoded sizes after base64 or quoted-printable processing, not just on the reported metadata. Store only what you need in tests to keep CI fast and predictable and include checksums in assertions to detect accidental binary transformations.

How can I simulate complex MIME structures

Create messages with nested multiparts using a mail library or by posting crafted raw MIME. Include text/plain, text/html, multipart/alternative, and multipart/related with inline images. Validate that your JSON includes the expected tree and that inline relationships via content IDs are present. For deeper background, review MIME Parsing: A Complete Guide | MailParse.

Where do I start integrating webhooks into my CI

Begin with a single test that creates a disposable inbox, sends a minimal email, and asserts on the webhook payload. Add cases for attachments, HTML-only messages, and malformed messages. Rotate a per-run secret for webhook signatures and keep endpoints private. If you need a primer on webhook patterns, see Webhook Integration: A Complete Guide | MailParse.