# Email walls

> Let prospects read their own verification codes and magic links.

Signups send codes and magic links. With a catch-all domain forwarded to an IMAP inbox, every prospect gets its own address and reads its own mail.

## Set up a mailbox

Copy `.env.example` to `.env` and fill it in. Never commit `.env`.

```
LEAKDOWN_IMAP_HOST="imap.gmail.com"
LEAKDOWN_IMAP_USER="you@gmail.com"
LEAKDOWN_IMAP_PASS="xxxx xxxx xxxx xxxx"   # an app password
LEAKDOWN_MAIL_DOMAIN="yourdomain.com"      # catch-all forwarded to that inbox
```

Older names

`CLIENTSIM_*` variables still work but are deprecated. Use `LEAKDOWN_*`.

## Test it

One command checks the whole mailbox round trip.

```
leakdown --mailtest   # create, receive, extract and destroy a mailbox  ✅ mailbox created: momus.4f1c@yourdomain.com
  ✉ probe 1 sent via SMTP — a second follows at 60s. Waiting up to 5 minutes.
  (a self-sent probe proves SMTP + IMAP; to prove the forwarder, also send one to that address from another account now)

  📬 arrived after 14s: probe 1

```

- Every run checks the mailbox once a day. If two prospects blame email and nothing arrived, those verdicts are marked unverified.
- Each prospect's mail moves to Trash when its session ends. It is not purged.

## Without mail

Prospects treat "check your email" as the point they leave, and the report says so. That is useful when you want to know how many people a verification step loses, and misleading when you don't.

---
Source: https://docs.leakdown.dev/email