A service where any address can receive mail instantly, without signing up, is an open invitation to spammers. We think it is only fair to explain what we do about that — and just as openly, where our options run out.
The underlying problem
An open mail service has two attack surfaces. The first is inbound: anyone with a list of addresses can throw advertising or phishing at them. Annoying, but contained — the damage stays inside our system.
The second is outbound, and that one is dangerous. If spam leaves through our servers, our domain ends up on blocklists. After that no message gets through at all, not even a legitimate one. For a mail service that is not an inconvenience, it is the end.
Outgoing messages are not delivered automatically
This is our most important measure and also the most inconvenient one. When you write a message through the form, it does not go out immediately. It is queued and released only after review.
That costs time and is noticeably slower than other providers. We still think the trade is right: automatic delivery without any control would be found and exploited by spammers within days.
Blocked aliases
Certain address names are blocked and cannot be created. These include names designed to look like official senders — variants of admin, support, billing or brand names. Anyone trying to register a blocked address simply does not get it.
The list grows whenever we notice new patterns of misuse. It is deliberately not public, because publishing it would double as a guide to working around it.
Attachments: banned types and size limits
We do not accept executable files. Blocked extensions include .exe, .bat, .cmd, .com, .scr, .msi, .jar, .vbs, .js, .ps1, .lnk and .reg — around forty extensions in total that are classically used to spread malware.
On top of that there are size limits: 20 MB outbound, 25 MB inbound. That caps both misuse as a file drop and the load on our servers.
An honest note: an extension blocklist is not antivirus. It stops the crude cases, not malware packed into an archive or simply renamed. Never open attachments from senders you do not know.
Captcha on every form
Creating an address, setting up forwarding, sending and the contact form are all captcha protected. One detail matters more than the captcha itself, and a surprising number of sites get it wrong: the response is verified server side against the provider's verification endpoint. A captcha that is only rendered in the browser and never checked is decoration — a script bypasses it by omitting the field entirely.
We took apart what a captcha can and cannot do in a separate article.
Forwarding requires confirmation
We only set up forwarding to your real address after you click a confirmation link. Without that step anyone could enter someone else's address and bury it in forwarded mail.
Every forwarded message also carries an unsubscribe link. One click ends the forwarding immediately and permanently, with no questions and no login. Each forwarding rule additionally has a fixed expiry date of at most six months.
Fixed retention periods
What is not stored cannot be misused. Incoming messages and their attachments are deleted after seven days at the latest, access logs after 90 days. Both run automatically, not on request.
Where our options end
Three things we would rather state plainly than gloss over:
- Mailboxes are not password protected. Anyone who knows or guesses the alias reads the messages too. That is not a bug, it is how a service without registration works. Never use it for anything confidential.
- A captcha does not stop humans. It stops scripts. Anyone willing to type by hand gets through. Hence the review before sending.
- We do not see everything. We run no virus scanner and no full content inspection of incoming mail. What lands in your mailbox could be anything.
Reporting abuse
If a message reached you through our infrastructure, or something looks wrong, write to us through the contact form. The full message header helps — how to get it and what it contains is covered in a separate post.