Abuse prevention
Last updated July 25, 2026
The concrete, automated protections TempMail runs today to keep the service usable for legitimate senders and receivers, and unattractive for abuse.
Rate limiting
Every account and API key is limited to a fixed number of requests per minute, scaled to its plan (see the pricing page). Limits apply per authenticated user first, then per API key, so a single compromised key can't be used to exceed an account's overall limit. Requests over the limit are rejected with a 429 response, not silently dropped or queued.
IP, domain, and email blacklisting
Known-abusive email addresses, domains, and IP addresses are checked automatically at two points: when a guest inbox is created, and when inbound mail is received. Matches are blocked before an inbox is created or a message is stored.
Inbox lifecycle and expiration
Temporary inboxes are not permanent. Guest inboxes expire automatically after a fixed retention window, and once expired, their messages and attachments are permanently deleted from storage. This limits how long any single inbox — legitimate or abused — can be used.
Email authentication
Inbound mail is checked against the sending domain's SPF, DKIM, and DMARC records. Authentication results are recorded with the message so spoofed or unauthenticated senders can be identified.
HTML sanitization
Message HTML is sanitized before it's ever rendered: scripts and event handlers are stripped, tracking pixels are removed, and remaining images are routed through a signed proxy. This runs automatically on every message.
User-reported abuse
Anyone can report a message as spam, phishing, or abuse directly from the inbox interface, or by emailing [email protected]. Reports are recorded for review and are themselves rate-limited to prevent report spam.
Policy enforcement
Accounts, API keys, or inboxes that violate our Acceptable Use Policy can be suspended or permanently disabled. See the Acceptable Use Policy for details.