imarc / mailgate
Whitelist outgoing mail recipients in Laravel—filter To, Cc, and Bcc before send and cancel when no allowed addresses remain.
Requires
- php: ^8.2
- laravel/framework: ^11.0|^12.0|^13.0
Requires (Dev)
- orchestra/testbench: ^9.8|^10.0|^11.0
- phpunit/phpunit: ^11.5.3|^12.0
Suggests
None
Provides
None
Conflicts
None
Replaces
None
README
Laravel package that whitelists outgoing mail recipients (To, Cc, Bcc) in non-production environments. When enabled, only configured addresses survive; if every recipient is removed, the send is canceled.
Why Mailgate?
Staging and QA often use real mail transports (Mailgun, SES, etc.) while the app still generates notifications with production-like recipient lists. Mailgate hooks Laravel’s pre-send mail event so you can limit delivery to your team without changing application code.
Behavior
- Disabled — message unchanged; send proceeds.
- Enabled — each To/Cc/Bcc address must match an entry in the allow list exactly (case-insensitive; no domain wildcards). Non-matching addresses are stripped.
- If no recipients remain, the send is canceled.
- Debug logs record stripped addresses, canceled sends, and successful sends.
Installation
composer require imarc/mailgate
Laravel auto-discovers MailgateServiceProvider and registers the listener on Illuminate\Mail\Events\MessageSending.
Optional — publish config:
php artisan vendor:publish --tag=mailgate-config
Configuration
| Env | Purpose |
|---|---|
MAILGATE_ENABLED |
true / false |
MAILGATE_ADDRESSES |
Comma-separated exact email addresses |
Config keys (config/mailgate.php):
mailgate.enabledmailgate.addresses— array of strings
Example (staging)
MAIL_MAILER=mailgun MAILGATE_ENABLED=true MAILGATE_ADDRESSES="you@imarc.com,team@imarc.com"
Leave MAILGATE_ENABLED false (or unset) in production.
License
MIT