How it works

You bring a domain. We put a catch-all mailbox on a subdomain of it and touch nothing else in your DNS.

Three steps

  1. 1Add a domain in the panel. Either paste a Cloudflare bootstrap token and we write the MX record ourselves, or add one TXT and one MX record by hand on any DNS.
  2. 2We create the mailbox before the MX goes live, then send a test message end to end from our own mail domain. The domain counts as live only after that message arrives.
  3. 3Your tools log in with the mailbox credentials over POP3S on 995 or IMAPS on 993 and read the codes.

One record on your zone

The MX of the subdomain, and nothing else. No SPF, no DKIM, no DMARC: those are sender records, and this service only receives. The probe message is sent from our own mail domain to your address, so your zone needs nothing for it.

A subdomain, never the apex

Live mail may already sit on your apex. Adding a second MX there splits delivery; replacing it destroys the mail. Checking that the apex has no MX is not enough either — with no MX at all, senders fall back to the A record, so mail can flow without a single MX record and our record would divert it. So the apex is not supported at all, rather than supported with a check.

The label is yours, and it is not otp

You pick the subdomain label; the default is a neutral random one. A label like otp is a ready-made disposable-mail marker, and a site can reject the address before the message is even sent.

Pickup, and why POP3 is serialized

One POP3 session per mailbox at a time; a second one is told to wait and retries. Many threads against one mailbox otherwise see the same message twice, both take the code, and one deletes it from under the other. IMAP is there for clients that prefer it.

What we keep

Messages live 72 hours in the copies we control and are not backed up. What you have already downloaded is yours and we cannot take it back. No web API sits in the message path: mail never leaves the mail host, and only counters and the access log reach the panel.