diff --git a/backend/tests/unit/mailOutcome.test.ts b/backend/tests/unit/mailOutcome.test.ts
index 920a882..8fb4a78 100644
--- a/backend/tests/unit/mailOutcome.test.ts
+++ b/backend/tests/unit/mailOutcome.test.ts
@@ -8,9 +8,17 @@ import { sendMail } from '../../src/mailer';
  * #260 needs to tell them apart so the admin is not told a link was emailed
  * when it was not.
  *
- * Only the two skip paths are covered. A real send needs an SMTP server, which
- * a unit test has no business starting; the integration test in Task 4 covers
- * the route's behaviour instead.
+ * Only the two skip paths are covered here. A real send needs an SMTP server,
+ * which a unit test has no business starting; the integration test in Task 4
+ * covers the route's behaviour instead.
+ *
+ * The allowlist's own behaviour — exact matches, plus-suffixes, domains,
+ * refusals — is covered directly and hermetically in
+ * backend/tests/unit/mailAllowlist.test.ts, against isAllowedRecipient itself.
+ * There is deliberately no third test here that sets SMTP_USER/SMTP_PASSWORD
+ * and an allowed recipient: that combination falls through both guards and
+ * reaches the real transporter, which opens a live TLS connection to
+ * smtp.gmail.com:465. Do not add one back.
  */
 describe('what sendMail reports', () => {
   const original = { ...process.env };
@@ -39,16 +47,4 @@ describe('what sendMail reports', () => {
       'skipped-blocked'
     );
   });
-
-  it('does not report blocked for an address that is on the allowlist', async () => {
-    process.env.SMTP_USER = 'user';
-    process.env.SMTP_PASSWORD = 'password';
-    process.env.MAIL_ALLOWLIST = 'allowed@example.com';
-
-    // Not asserting 'sent': that would need a live SMTP server. Asserting only
-    // that the allowlist did not refuse it, which is this test's subject.
-    await expect(
-      sendMail('allowed@example.com', 'subject', '<p>body</p>').catch(() => 'threw')
-    ).resolves.not.toBe('skipped-blocked');
-  });
 });