what is a disposable email address?

A disposable email address is a real, working inbox you didn't have to sign up for and that disappears on a timer. Mail you send to it is accepted by a normal SMTP server, stored briefly, and then deleted. It is useful for testing, throwaway signups, and keeping a low-value address away from your real one. It is not a tool for evading abuse rules.

"Disposable" sounds like a trick, but the address itself is ordinary.tmp.ab12cd@ephemail.io resolves like any other email address — there's a domain, an MX record, and a mail server that knows what to do with it. The only difference is the policy that wraps it:

• you didn't have to register to use it
• it exists for minutes to hours, not forever
• everything received is deleted on a schedule

That's it. There's no clever protocol, no fake SMTP. It's a normal inbox with short retention.

When someone sends mail to tmp.ab12cd@ephemail.io, this is roughly what happens:

• The sender's mail server looks up the MX record for ephemail.io in DNS. That record points at our inbound mail server.
• The sender opens an SMTP connection to that server, says HELO, announces a recipient, and streams the message body.
• Our server runs the standard checks (SPF, DKIM,DMARC), accepts the message, and writes it to storage keyed by the recipient address.
• The inbox UI subscribes to that key over a WebSocket and shows the message as soon as it lands — usually in well under a second.
• A background job deletes the message when the retention window expires.

The lifespan is what makes it "disposable". Everything else is the same boring email plumbing that runs the rest of the internet.

Not all disposable addresses behave the same way. The three shapes you'll see:

public

A short, easy-to-guess address that anyone can open by typing it into the UI. Convenient, but assume someone else may have used the same address before you and could open it after you. Good for one-off signups where you don't care who else sees the mail.

private

An address tied to your account. Only you (and people you explicitly share the inbox link with) can see what arrives. Good for QA teams, shared test inboxes, and anything you don't want a stranger reading.

catch-all

A whole domain pointed at one inbox: every address at yourdomain.com lands in the same place. Useful when you want per-service addresses like spotify@yourdomain.com and netflix@yourdomain.com without provisioning each one.

• QA and end-to-end testing. Spin up an address per test, trigger the signup flow, read the verification code from the mail that comes back, and let the inbox auto-expire.
• Throwaway signups. A site you'll use once. A whitepaper gated behind an email form. A coupon. Anything where giving your real address means six months of newsletters.
• Privacy hygiene. Per-service addresses on a catch-all domain make it obvious which vendor leaked your address when the spam starts.
• Demos and screenshots. A fresh inbox with no history is the cleanest way to record a product walkthrough.
• Onboarding rehearsals. Run your own welcome flow as a user without polluting your real inbox.

Disposable addresses are a poor fit — and sometimes a bad idea — for:

• Anything you need to log into later. Bank accounts, tax portals, your AWS console. If you lose the inbox, you lose password recovery.
• Receipts and warranties. A retention timer of ten minutes is great for OTPs and terrible for a year-old order confirmation you actually need.
• Evading abuse controls. Free-trial farming, ban evasion, and creating fake accounts on platforms you've been removed from. Don't. Most services already detect and block known disposable domains.
• Anything regulated as identity. KYC flows, healthcare portals, government services. Use a real, durable address.

rule of thumb: if losing access to the inbox tomorrow would be annoying, don't use a disposable one.

The mechanics are the same as any other disposable mail service. A few things we do differently:

• Real MX, real SMTP. No simulator — mail that bounces off a real spam filter would bounce off ours too. That makes it useful for testing deliverability, not just "did the message arrive".
• Realtime via WebSocket. The inbox UI doesn't poll; messages appear the instant they're written to storage.
• Typed extraction at delivery time. OTPs and magic links get parsed out and attached to the message payload, so your tests don't need to maintain a regex zoo.
• Sandboxed HTML rendering. Marketing email is full of tracking pixels and remote assets. We render in a sandbox so opening a message doesn't quietly leak that the inbox is alive.
• Hard retention by default. Public addresses delete messages after ten minutes; private inboxes default to twenty-four hours. Both are policy, not best effort.

The simplest way to see all of that is to open one:

# no signup. instant. gone in ten minutes.
open https://app.ephemail.io/inbox

• A disposable email address is a real inbox with short retention — same MX, same SMTP, same DKIM checks as any other.
• Three shapes worth knowing: public (anyone can open it), private (only you), catch-all (a whole domain → one inbox).
• Best for testing, throwaway signups, demos, and per-service privacy addresses.
• Bad for anything you need to log into later, anything regulated as identity, or evading abuse controls.
• ephemail adds realtime delivery, typed OTP / magic-link extraction, sandboxed HTML rendering, and hard-coded retention windows.

try one in a browser tab — open a throwaway inbox →

This article describes how disposable inboxes work generally; it isn't legal or compliance advice. If you're handling regulated data, check with your own counsel.