mailindia

disposable inboxesyour domainno signup

Mail thatforgets itself.

MailIndia mints a real address on a domain you control. Mail arrives through Cloudflare Email Routing, lands in a Durable Object with an expiry, and is readable from a plain REST API. No account, no database of inboxes, nothing to breach.

Retention60 seconds to 24 hours, chosen per mailbox
Accessan HMAC bearer token per address — no accounts
Surface19 documented endpoints, OpenAPI 3.1, SSE stream

no mailbox yet

Mint an address and it starts receiving immediately. Nobody can guess it, nobody can read it without its token, and it deletes itself.

step 1

mint

POST /v1/mailboxes

step 2

receive

SMTP → Durable Object

step 3

decay

alarm deletes on TTL

POST /v1/mailboxesGET /v1/mailboxes/{address}/messagesGET /v1/mailboxes/{address}/messages/{id}DELETE /v1/mailboxes/{address}GET /v1/mailboxes/{address}/eventsGET /v1/mailboxes/{address}/messages/{id}/emlPOST /v1/keysGET /v1/openapi.jsonPOST /v1/mailboxesGET /v1/mailboxes/{address}/messagesGET /v1/mailboxes/{address}/messages/{id}DELETE /v1/mailboxes/{address}GET /v1/mailboxes/{address}/eventsGET /v1/mailboxes/{address}/messages/{id}/emlPOST /v1/keysGET /v1/openapi.json

19

documented endpoints

60s

shortest retention

24h

longest retention

0

accounts required

how a message arrives

Four hops, zero servers

Receiving happens entirely on Cloudflare's edge. That is what lets you run disposable mail on a domain you own without operating anything that listens on a port.

  1. 01

    SMTP at the edge

    Cloudflare Email Routing accepts mail for every address on your domain and hands it to a Worker. No ports, no certificates, no daemon to babysit.

    email(message, env)

  2. 02

    One object per address

    The Worker resolves the recipient to a Durable Object keyed on the address itself, then writes the raw MIME into that object's SQLite.

    idFromName(address)

  3. 03

    A TTL on every message

    Each row carries an expiry. The object arms its own alarm and sweeps what has aged out, so deletion needs no external cron job.

    storage.setAlarm(t)

  4. 04

    Read through the API

    Express decodes MIME on read, stores no message bodies, and answers your browser or your server over plain JSON.

    GET /v1/mailboxes/{address}/messages

the api

Nineteen endpoints.
No SDK required.

Plain JSON over HTTPS, cursor pagination, a bearer token per mailbox, and a machine-readable OpenAPI 3.1 document that this page is built from. Everything you can do in the UI is one HTTP call.

read the reference →openapi.json
# 1 · mint a mailbox
curl -sX POST http://localhost:8790/v1/mailboxes \
  -H 'content-type: application/json' \
  -d '{"ttlSeconds": 900}'

# 2 · read the inbox once mail lands
curl -s http://localhost:8790/v1/mailboxes/ADDR/messages \
  -H 'authorization: Bearer mi_TOKEN'

principles

Small surface.
Boring guarantees.

Expiry is the default, not a cleanup job

Every message carries a deadline and the Durable Object that stores it owns the alarm that removes it. There is no sweeper service to fail open and quietly retain mail you expected to vanish.

Possession, not identity

A mailbox bearer token is an HMAC of its address. The API keeps no session table, so there is no user record to leak and no password to reset when you lose the token: re-mint the address and the same token comes back.

Sender HTML is treated as hostile

The reader shows plain text first and renders the HTML part in a sandboxed iframe with scripts, forms, popups and same-origin access all blocked by the browser. Marketing mail is untrusted input.

The API is the product

Every action in the interface is a documented HTTP call, and the docs page you are reading is generated from the same OpenAPI document that the server serves at /v1/openapi.json.

put it on your domain

Fifteen minutes of DNS and it is yours.

The setup guide walks through the Worker deploy, the Email Routing toggle, and the exact MX, SPF and DMARC records to add — plus what to check when mail arrives but the inbox stays empty.

domain setupapi reference