How it works
Pick any local part on grabmail.io, mixozia.com or linqmail.com and the mailbox already exists — there is no create step and nothing is reserved in advance. Whatever arrives is exposed two ways at once: an inbox page, and a REST API of three paths. GET /api/v1/mailbox lists what is waiting, GET /api/v1/message/{id} returns the headers, both body parts and any attachments, DELETE on the same path removes one early, and every message carries an expires_at timestamp five days out. The contract is published as OpenAPI 3.1, and the same operations are served over Model Context Protocol at /mcp, where wait_for_message blocks until mail lands instead of making an agent poll. A domain you own joins by pointing its MX at smtp.grabmail.io, and the first message to arrive is what connects it. Mail is only ever accepted, never sent: there is no send endpoint, which is what stops a keyless service from becoming a relay.
KYC & privacy
Nothing identifies a user because nothing is collected. No account, no email address, no password, no cookie and no analytics — the privacy policy enumerates the absences instead of promising restraint, and no page loads a third-party asset that would contradict it. Ordinary connection logs exist, are described as short-lived and rotated, and are not joined to message content. What is missing is authentication of any kind: on a shared domain the address is the only secret, and anyone who guesses it reads the mailbox through the same public API. GrabMail says so on the homepage, in the inbox, in the FAQ and in the policy, which is more candid than the category norm. The partial answer is the alias — a second address on every mailbox that delivers into it but returns an empty inbox when read back, so a service you signed up to cannot walk through everything else that arrived there.
Strengths and limits
The engineering is disciplined for something given away. Ceilings are published rather than discovered — 5 MB per attachment, one read per second per address, 1200 requests a minute per client, 429 with Retry-After beyond that — and the limiter enforces them from the first burst. Inbound mail is a conventional queueing MTA with STARTTLS, so a storage outage holds messages rather than bouncing them, and a message handed to it surfaces in the API within seconds. The limits are structural rather than fixable. The operator is anonymous: no company, no jurisdiction, no contact address, with formal notices routed through the registrar of record. The .io registry records the domain as created on 4 August 2026, so there is no history to weigh, and the service's own status board marks the API, mail delivery and retention as not yet reporting — three of its four components unmonitored, stated plainly rather than papered over. The custom-domain documentation also contradicts itself: the setup page calls it free, keyless and readable by anyone, while the terms bill it per domain and the privacy policy logs a key and a billing record against it.
Verdict
For catching a verification code in a test suite, a CI job or an agent run, GrabMail is well-made and unusually honest about what it refuses to be. For anything you would mind a stranger reading it is disqualified by design, and a service registered in August 2026 has had no time to earn trust or to break it. Grade: C (6.9/10). Trust: TRUSTED.
For catching a verification code in a test suite, a CI job or an agent run, GrabMail is well-made and unusually honest about what it refuses to be. For anything you would mind a stranger reading it is disqualified by design, and a service registered in August 2026 has had no time to earn trust or to break it. Grade: C (6.9/10). Trust: TRUSTED.
