diff --git a/src/server/smtp/client.test.ts b/src/server/smtp/client.test.ts
index aa6e434..e05ca5d 100644
--- a/src/server/smtp/client.test.ts
+++ b/src/server/smtp/client.test.ts
@@ -62,7 +62,8 @@ describe('sendEmail', () => {
   })
 
   it('loggt keine E-Mail-Adresse im Klartext', async () => {
-    const consoleSpy = vi.spyOn(console, 'log')
+    const logSpy = vi.spyOn(console, 'log')
+    const errorSpy = vi.spyOn(console, 'error')
     await sendEmail({
       to: 'geheim@example.com',
       subject: 'Test',
@@ -70,7 +71,7 @@ describe('sendEmail', () => {
       text: 'Hi',
       listUnsubscribeHeader: '<https://example.com/unsub>',
     })
-    const loggedOutput = consoleSpy.mock.calls.flat().join(' ')
-    expect(loggedOutput).not.toContain('geheim@example.com')
+    const output = [...logSpy.mock.calls, ...errorSpy.mock.calls].flat().join(' ')
+    expect(output).not.toContain('geheim@example.com')
   })
 })
diff --git a/src/server/smtp/client.ts b/src/server/smtp/client.ts
index 7d9e317..27a8426 100644
--- a/src/server/smtp/client.ts
+++ b/src/server/smtp/client.ts
@@ -14,7 +14,7 @@ const transport = nodemailer.createTransport({
   port: Number(process.env.SMTP_PORT ?? 1025),
   secure: false,
   auth: process.env.SMTP_USER
-    ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS }
+    ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASS ?? '' }
     : undefined,
 })
 
diff --git a/src/server/suppression/check.test.ts b/src/server/suppression/check.test.ts
index 6891ec9..edb6dd6 100644
--- a/src/server/suppression/check.test.ts
+++ b/src/server/suppression/check.test.ts
@@ -42,4 +42,10 @@ describe('checkSuppression', () => {
     expect(call[0]).toContain('$1')
     expect(call[1]).toEqual(['x@x.com'])
   })
+
+  it('propagiert Fehler bei ungültiger tenantId nach oben', async () => {
+    const { withTenant } = await import('../db/tenant')
+    vi.mocked(withTenant).mockRejectedValueOnce(new Error('Ungültige tenantId'))
+    await expect(checkSuppression('invalid!', 'x@x.com')).rejects.toThrow('Ungültige tenantId')
+  })
 })
diff --git a/src/server/suppression/check.ts b/src/server/suppression/check.ts
index 38a2536..4185596 100644
--- a/src/server/suppression/check.ts
+++ b/src/server/suppression/check.ts
@@ -3,7 +3,10 @@ import { withTenant } from '../db/tenant'
 export async function checkSuppression(tenantId: string, email: string): Promise<boolean> {
   const normalized = email.toLowerCase().trim()
   const rows = await withTenant(tenantId, (client) =>
-    client.query('SELECT 1 FROM suppression_list WHERE email = $1 LIMIT 1', [normalized])
+    client.query<{ '?column?': number }>(
+      'SELECT 1 FROM suppression_list WHERE email = $1 LIMIT 1',
+      [normalized]
+    )
   )
   return rows.length > 0
 }