> ## Documentation Index
> Fetch the complete documentation index at: https://developer.karmacheck.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify Sandbox Email Addresses

KarmaCheck staging uses an **allowlist and routing layer** to prevent test emails from reaching arbitrary people.

**In short:** Verify the inbox through the sandbox account. Staging then selectively allows delivery to that address; everything else is intercepted or redirected for safety.

Emails are sent to candidates that you order background checks for as well as your dashboard users that you wish to invite to your company.

If you invite a candidate that has an email address that is not already verified, the email will end up in a catch-all inbox at KarmaCheck and will not be delivered to you to use for testing. The one exception to this rule is if you have a default email address set up in your verified emails. If there is a default then candidate emails that are addressed to unverified recipients will end up getting sent to the default address.

If you invite a dashboard user to be a part of your sandbox company that email address MUST be verified ahead of adding them as a user. User invites will not go to the default address.

## How an address becomes verified

1. In the staging sandbox, go to **Company Settings → Email Verification**.\
   ![Company Settings Menu](https://mintcdn.com/karmacheck/Tojc72hNn7p4RQgR/images/baa4b317-3f5f-418f-a0b4-2790ce64f82e.png?fit=max\&auto=format\&n=Tojc72hNn7p4RQgR\&q=85\&s=3cea1c130388b980ecada13959d35a78)

   **Company Settings Menu in the dashboard**
2. Enter an email address the tester controls.
3. KarmaCheck sends a one-time verification link to that inbox.
4. After the link is clicked, the address is stored as verified and associated with the sandbox.

### Address matching rules

* **Case-insensitive:** Capitalization does not create a different verified address.
* **Plus aliases supported:** If the recipient’s email provider supports “plus aliases” also known as “plus addressing”, verifying `qa@company.com` also permits addresses such as `qa+candidate1@company.com`.

Be sure to create a default email address

![Image](https://mintcdn.com/karmacheck/Tojc72hNn7p4RQgR/images/image.png?fit=max\&auto=format\&n=Tojc72hNn7p4RQgR\&q=85\&s=72b7c86a380f4a15027116b4844d6e66)

**Default Email Address Highlighted**

## What happens when staging sends an email

For candidate and background-check invitations, the routing logic checks whether the intended recipient:

* Is a user in the current sandbox account, or
* Matches a verified sandbox contact.

**If verified:** The email can be delivered to the intended real inbox.

**If not verified:** The email is redirected to a safe destination—the company’s default verified sandbox contact, or ultimately KarmaCheck’s internal staging inbox—instead of being sent to the unverified person.

## Routing summary

| Recipient state | Typical result |
| - | - |
| Verified account user or sandbox contact | Delivery to the intended real inbox is allowed. |
| Unverified candidate recipient | Redirected to a safe verified/default destination or the internal staging inbox. |
| Unverified company-user invitee | Currently redirected to the internal staging inbox because the default-contact fallback is skipped. |