Temp mail as
infrastructure

Self-hosted and receive-only. milbox hands you disposable mailboxes over an API, accepts mail for domains you own, and puts a panel on top so you can see every key, every rejection, and everything that ever touched the queue.

Free tier: published platform domains, 100 mailboxes, 100 new mailboxes a day.

Terminal
curl -s https://milbox.dev/api/v1/addresses \
  -H "authorization: Bearer ***" \
  -H 'content-type: application/json' \
  -d '{"domain":"example.com","local_part":"hello"}'

# read it back
curl -s https://milbox.dev/api/v1/inbox \
  -H "authorization: Bearer ***"_
Response200
{
  "ok": true,
  "data": { "messages": [
    { "from": "[email protected]",
      "subject": "Code: 482913" }
  ] },
  "meta": { "count": 1 }
}

What you get

Mailboxes

Create an address in one call, read what lands, and let the TTL clean it up. Read, star, search, and restore are separate calls, so a test can undo itself.

Your own domains

Point an apex at the platform, publish the challenge TXT, and mail starts routing. Rotate the token, suspend, or enable catch-all without touching DNS again.

Rules and limits

Block or allow senders before a message is stored, get a signed webhook the moment one lands, and keep quotas enforced per plan, per day, per key.

Mail travels. The box just listens.

A message hops between servers before it reaches you. milbox owns the last hop: the MX record points here, Postfix accepts the envelope, and the panel stores the parsed message for whichever mailbox owns that address.

2 unread
Your sign-in code is 482913[email protected]
2m
Receipt for November[email protected]
18m
Weekly digest[email protected]
1h
Deploy finished in 42s[email protected]
3h
TTL 24h4 of 10 used

Nothing here sends mail. That is why every hosted domain publishesSPF -all and DMARC p=reject: the only party who could spoof it is someone who is not us.

Create the first mailbox

Sign in, take an access key, and the first message is one POST away.