GrabMail 6.9 / 10

GrabMail is a disposable email service that hands out throwaway addresses on shared domains and lets you read what arrives at them from a browser, a REST API or a Model Context Protocol server. The .io registry dates the domain to 4 August 2026, which makes it one of the newest entries in this directory. Nothing is created in advance, nothing is paid for, and every message is deleted five days after it lands.

How it works

Pick any name on grabmail.io, mixozia.com or linqmail.com — the mailbox exists as soon as mail reaches it. That inbox is exposed through three API paths: GET /api/v1/mailbox lists what is waiting, GET /api/v1/message/{id} returns headers, both body parts and attachments, and DELETE on the same path removes one early. Every message carries an expires_at five days out, and the whole contract is published as an OpenAPI 3.1 document. An MCP server at /mcp exposes the same operations to AI agents, including a wait_for_message call that blocks until mail lands rather than polling in a loop. A domain you own joins by pointing its MX at smtp.grabmail.io; the first message that arrives is what connects it. The service receives only — there is no send endpoint at all, which is what keeps an unauthenticated service from being used as a relay.

KYC and privacy

There is no signup, so there is nothing to ask for: no email, no password, no phone, no payment and no cookie. The privacy policy lists what is never collected rather than promising restraint, and no page on the site loads a third-party script or an analytics tag. Ordinary connection logs exist, are described as short-lived and rotated, and are not joined to message content. The trade-off is stated everywhere on the site and deserves repeating: on a shared domain the address is the only secret. Anyone who knows or guesses it reads that mailbox through the same public API. The partial mitigation is the alias — a second address on every mailbox that delivers mail into it but returns an empty inbox when it is read, so a service you handed the alias to cannot come back and read the rest of the box.

Strengths and limits

Every ceiling is published rather than discovered: 5 MB per attachment, one read per second per address, 1200 requests a minute per client, and a 429 with Retry-After past that. Inbound mail runs on a conventional queueing MTA with STARTTLS, so an outage in the storage layer holds messages instead of bouncing them, and a delivered message shows up in the API within seconds. The limits are structural. The operator is anonymous — no company, no jurisdiction, no contact address, with formal notices routed through the domain registrar — and the code is closed with no published audit. The service's own status board currently marks the API, mail delivery and retention as not yet reporting, which is candid but leaves three of four components unverified from outside. The custom-domain documentation also contradicts itself: the setup page describes it as free, keyless and readable by anyone, while the terms of service bill it per domain and the privacy policy records a key and a billing entry.

Verdict

GrabMail scores 6.9 / 10 at KYC level anonymous (L1). As plumbing for a verification code — a test suite, a CI job, an agent filling in a signup form — it is well-built and fast, and it is unusually honest about the one property that disqualifies it for anything else: a public mailbox has no lock on it. Anyone who needs privacy rather than disposability should point their own domain at it and still treat the inbox as readable by strangers, or pick an alias relay with real authentication instead.