> ## Documentation Index
> Fetch the complete documentation index at: https://developer.karmacheck.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify sandbox email addresses

> How to verify email addresses in the staging sandbox so that candidate and user invitation emails reach your inbox.

KarmaCheck staging uses an **allowlist and routing layer** to prevent test emails from reaching arbitrary people. When you verify an inbox through the sandbox account, staging allows delivery to that address. Every other address is intercepted or redirected for safety.

Staging sends emails to the candidates you order background checks for, and to the dashboard users you invite to your company. How each email is handled depends on the recipient:

* **Candidates:** If a candidate's email address isn't verified, the email goes to a catch-all inbox at KarmaCheck and isn't delivered to you for testing. The exception is when your sandbox has a [default email address](#set-a-default-email-address). In that case, emails to unverified candidates are sent to the default address.
* **Dashboard users:** The user's email address **must** be verified before you invite them to your sandbox company. Invitations to dashboard users are never sent to the default address.

For more on the sandbox, see [Environments](/background-check-api/overview/api/environments.md) and [Testing considerations](/background-check-api/sandbox-testing/testing-considerations.md).

## Verify an email address

1. In the staging dashboard, open the profile menu and select **Company Settings**.

   ![The profile menu in the staging dashboard with Company Settings highlighted.](https://mintlify.s3.us-west-1.amazonaws.com/karmacheck/images/sandbox-email-company-settings-menu.png)

2. Select **Verified Emails**, and then select **Add Verified Email**.

3. Enter an email address that you control.

4. KarmaCheck sends a one-time verification link to that inbox. Select the link to verify the address.

After you select the link, the address is stored as verified and associated with your sandbox.

### Address matching rules

* **Case-insensitive:** Capitalization doesn't create a different verified address.
* **Plus aliases supported:** If the recipient's email provider supports plus aliases, also known as plus addressing, verifying `qa@company.com` also permits addresses such as `qa+candidate1@company.com`.

## Set a default email address

Set a default email address so that candidate emails sent to unverified addresses are delivered to you instead of the KarmaCheck internal staging inbox. To set the default, select **Set Default** next to a verified address. The default address is marked with a **Default** label.

![The Verified Emails page with the Default label highlighted on a verified email address.](https://mintlify.s3.us-west-1.amazonaws.com/karmacheck/images/sandbox-email-verified-emails-default.png)

> [!NOTE]
>
> The default address applies only to candidate emails. Invitations to dashboard users are never redirected to the default address, so you must verify each user's email address before you invite them.

## What happens when staging sends an email

For candidate and background check invitations, the routing logic checks whether the intended recipient:

* Is a user in the current sandbox account, or
* Matches a verified sandbox contact.

If the recipient is verified, the email can be delivered to the intended real inbox.

If the recipient isn't verified, the email is redirected to a safe destination instead of being sent to the unverified person. That destination is the company's default verified sandbox contact or, ultimately, KarmaCheck's internal staging inbox.

## Routing summary

| Recipient state | Typical result |
| - | - |
| **Verified account user or sandbox contact** | Delivery to the intended real inbox is allowed. |
| **Unverified candidate recipient** | Redirected to a safe verified or default destination, or the internal staging inbox. |
| **Unverified company-user invitee** | Currently redirected to the internal staging inbox because the default-contact fallback is skipped. |