diff --git a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/EMailService.java b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/EMailService.java
index 8f5c54e5ddc42b29e9c78810d1fa423db98adb4d..1048f946648a9afb358199726052b3a1861f7629 100644
--- a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/EMailService.java
+++ b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/EMailService.java
@@ -25,18 +25,20 @@ package de.ozgcloud.nachrichten.email;
 
 import java.util.Objects;
 
+import jakarta.mail.MessagingException;
+import jakarta.mail.internet.MimeMessage;
+
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.mail.MailException;
 import org.springframework.mail.javamail.JavaMailSender;
 import org.springframework.mail.javamail.MimeMessageHelper;
+import org.springframework.scheduling.annotation.Async;
 import org.springframework.stereotype.Service;
 
 import de.ozgcloud.common.errorhandling.TechnicalException;
 import de.ozgcloud.nachrichten.email.MailSendRequest.MailAttachment;
-import jakarta.mail.MessagingException;
-import jakarta.mail.internet.MimeMessage;
 import lombok.extern.log4j.Log4j2;
 
 @Service
@@ -55,6 +57,7 @@ class EMailService {
 	@Autowired
 	private ApplicationEventPublisher publisher;
 
+	@Async
 	public void sendEmail(MailSendRequest request) {
 		MimeMessage message = sender.createMimeMessage();
 		prepareAndSendMail(message, request);
diff --git a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailRecipient.java b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailRecipient.java
index e5f76ec83abb204fb3e88ffd4c69f1ff243548b2..82a60a01e23b240de778cdba6a482af215c04a04 100644
--- a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailRecipient.java
+++ b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailRecipient.java
@@ -23,8 +23,10 @@
  */
 package de.ozgcloud.nachrichten.email;
 
+import jakarta.validation.constraints.NotBlank;
+
 import lombok.Builder;
 
 @Builder
-public record MailRecipient(String firstName, String lastName, String email) {
+public record MailRecipient(String firstName, String lastName, @NotBlank String email) {
 }
diff --git a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailSendRequest.java b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailSendRequest.java
index 8026f7cc8e9c1c1f287ec4621e7354092a02f648..8b5520d6b7a3e5c832add8d11c83dc9ee8f60785 100644
--- a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailSendRequest.java
+++ b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailSendRequest.java
@@ -26,6 +26,9 @@ package de.ozgcloud.nachrichten.email;
 import java.util.Collection;
 
 import jakarta.activation.DataSource;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotEmpty;
+
 import lombok.Builder;
 import lombok.Getter;
 import lombok.Singular;
@@ -36,7 +39,8 @@ public class MailSendRequest {
 
 	private String fromAddress;
 	@Singular
-	private Collection<MailRecipient> toAddresses;
+	@NotEmpty
+	private Collection<@Valid MailRecipient> toAddresses;
 
 	private String replyTo;
 
diff --git a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailService.java b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailService.java
index 1dd1bbde8018bbd11c39c1dff3c44590a05e20cc..9780a47ef8289807c7c62a57d56e20f3e43bb4e9 100644
--- a/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailService.java
+++ b/nachrichten-manager-server/src/main/java/de/ozgcloud/nachrichten/email/MailService.java
@@ -23,18 +23,20 @@
  */
 package de.ozgcloud.nachrichten.email;
 
+import jakarta.validation.Valid;
+
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.scheduling.annotation.Async;
 import org.springframework.stereotype.Service;
+import org.springframework.validation.annotation.Validated;
 
 @Service
+@Validated
 public class MailService {
 
 	@Autowired
 	private EMailService emailService;
 
-	@Async
-	public void sendMail(MailSendRequest request) {
+	public void sendMail(@Valid MailSendRequest request) {
 		emailService.sendEmail(request);
 	}
 }
diff --git a/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/email/MailSendRequestTestFactory.java b/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/email/MailSendRequestTestFactory.java
index 3e7fea3f26be53b05dd8e5aeccf7258f4b0c1076..4e8db6e836ef508e9514a835cb1616bd2ff5b351 100644
--- a/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/email/MailSendRequestTestFactory.java
+++ b/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/email/MailSendRequestTestFactory.java
@@ -25,9 +25,10 @@ package de.ozgcloud.nachrichten.email;
 
 import java.util.UUID;
 
-import de.ozgcloud.nachrichten.email.MailSendRequest.MailAttachment;
 import jakarta.mail.util.ByteArrayDataSource;
 
+import de.ozgcloud.nachrichten.email.MailSendRequest.MailAttachment;
+
 class MailSendRequestTestFactory {
 
 	public static final String FROM = "from@mailinator.com";
@@ -36,7 +37,7 @@ class MailSendRequestTestFactory {
 	public static final String SUBJECT = "The Subject";
 	public static final String BODY = "Lorem ipsum";
 
-	private static final String REFERENCE = UUID.randomUUID().toString();
+	public static final String REFERENCE = UUID.randomUUID().toString();
 
 	public static final String ATTACHMENT_NAME = "aFile";
 	public static final String ATTACHMENT = "BINARY_BLAH";
diff --git a/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/email/MailSendRequestValidationTest.java b/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/email/MailSendRequestValidationTest.java
new file mode 100644
index 0000000000000000000000000000000000000000..22d43927d9b88ab10164c7b75d4770c3cd7e46db
--- /dev/null
+++ b/nachrichten-manager-server/src/test/java/de/ozgcloud/nachrichten/email/MailSendRequestValidationTest.java
@@ -0,0 +1,82 @@
+package de.ozgcloud.nachrichten.email;
+
+import static de.ozgcloud.nachrichten.email.MailSendRequestTestFactory.*;
+import static org.assertj.core.api.Assertions.*;
+
+import jakarta.mail.util.ByteArrayDataSource;
+import jakarta.validation.Validation;
+import jakarta.validation.Validator;
+import jakarta.validation.ValidatorFactory;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullAndEmptySource;
+
+import de.ozgcloud.nachrichten.email.MailSendRequest.MailAttachment;
+
+class MailSendRequestValidationTest {
+
+	private Validator validator;
+
+	@BeforeEach
+	public void setUp() {
+		ValidatorFactory factory = Validation.buildDefaultValidatorFactory();
+		validator = factory.getValidator();
+	}
+
+	@Nested
+	class TestToAddressesValidation {
+		@Test
+		void shouldBeValid() {
+			var request = MailSendRequestTestFactory.create();
+
+			var violations = validator.validate(request);
+
+			assertThat(violations).isEmpty();
+		}
+
+		@Test
+		void shouldBeInvalidOnNull() {
+			var ds = new ByteArrayDataSource(ATTACHMENT.getBytes(), "plain/text");
+			ds.setName(ATTACHMENT_NAME);
+			var request = MailSendRequest.builder()
+					.fromAddress(FROM)
+					.subject(SUBJECT)
+					.body(BODY)
+					.requestReference(REFERENCE)
+					.attachment(MailAttachment.builder()
+							.dataSource(ds)
+							.build())
+					.replyTo(REPLY_TO)
+					.build();
+
+			var violations = validator.validate(request);
+
+			assertThat(violations).isNotEmpty();
+		}
+
+		@Test
+		void shouldBeInvalidOnEmpty() {
+			var request = MailSendRequestTestFactory.createBuilder().clearToAddresses().build();
+
+			var violations = validator.validate(request);
+
+			assertThat(violations).isNotEmpty();
+		}
+
+		@ParameterizedTest
+		@NullAndEmptySource
+		void shouldBeInvalidOnBlankRecipientEmail(String email) {
+			var recipient = MailRecipientTestFactory.createBuilder()
+					.email(email)
+					.build();
+			var request = MailSendRequestTestFactory.createBuilder().clearToAddresses().toAddress(recipient).build();
+
+			var violations = validator.validate(request);
+
+			assertThat(violations).isNotEmpty();
+		}
+	}
+}