Your agent verifies OTPs, clicks magic links, claims free trials, all to do the work you asked. Hand it one API key and it spins up real inboxes on demand. No bot detection. No rate-limits. No automation clauses in our ToS.
The same encrypted infrastructure powers a clean web inbox, a built-for-code API, a tool your AI agents can call directly, and addresses on your own domain. Pick the surface, switch any time.
For when a website wants your "real" email but doesn't deserve it. Sign in, paste your address wherever you need to. Two hours later every message in it is gone, but the address is still yours.
When your test suite needs a different inbox every run. One call to create, one to read. The OTP your app just sent is one line away. No flaky polling, no shared mailbox state.
When your agent has to sign up, verify, or fetch an OTP to do its job. Hand it one API key and it spins up real inboxes on demand. No bot detection, no rate-limits, no automation clauses.
When you want inboxes on a domain you control. Verify it once, then spin up addresses on the fly. Addresses stay permanent, messages auto-clean after 30 days. No setup time for new mailboxes.
The same encrypted, auto-purging infrastructure under both surfaces. Use the web inbox, the API, or both. Your account works the same either way.
Every email is encrypted the moment it lands, with a key that only your device holds. We can't read your mail, and neither can anyone who'd subpoena us.
Every message expires on a timer. 2 hours by default for free accounts, configurable up to 30 days on paid plans. Your address stays put.
Spin up a new address whenever you want. No per-address quota, no "upgrade to continue". One account, as many inboxes as you need.
Create, list, read, delete inboxes from your code. Drop-in SDKs for every major language: a few lines and you're done.
Inboxes look real to the services your tests or agents sign up for. No bounces, no "this looks fake" flags, no disposable-list blocks.
No analytics on inbox content. No ads inside emails. Anonymous-by-default for free users, encrypted sync for paid.
Your agent signs up for tools, verifies OTPs, clicks magic links, all day, every day. It needs a real, working email. We hand it one. No rate-limits. No bot detection. No questions.
Hand your agent an API key and it spins up addresses as it needs them: newsletter confirmations, free-trial logins, third-party verifications. No per-inbox quota.
We don't fingerprint your agent. No captcha gate, no "are you a human" challenge, no fair-use lecture in the ToS. If your model wants 400 inboxes an hour, that's its business.
Stripe delivers. Gmail won't bounce. OpenAI verifies. Real mailboxes on real domains, not flagged as disposable by the services your agent is signing up for.
Old messages clear themselves every two hours, so your agent's email tool returns recent, relevant mail only, not a 10,000-line wall stuffed into its context window.
Whether you're clicking through a web UI or curling the API, you're hitting the same encrypted inbox under the hood.
mailflat.net. Your inbox is already waiting.
x7k2m@mailflat.net, one tap to clipboard.
Newsletter signup, free trial, app download.
Two hours later every message is wiped. Your address stays.
Free key, scoped to dev / staging / prod.
One call. Unique subdomain. Ready before your next line.
Use the address in your signup flow. Emails arrive in real time.
GET /emails, extract the OTP, assert the outcome.
One agent key, MCP server or SDK. Drop it into GPT, Claude, or LangChain.
mailflat.create(label="research"). Real address, ready in < 80ms.
Agent fills the form, waits for the OTP, parses the magic link, all in one tool call.
Inbox auto-clears after 2h. No cleanup logic, no 10k-line context pollution.
Add one TXT record and we confirm SPF & DKIM.
billing@acme.com. Random or named, on the fly.
Same encrypted inbox under the hood, your branding on top.
Auto-clear like the rest, or keep an address forever. Your call.
Zero-knowledge isn't a marketing line. It's the architecture. Your inbox key is generated and held only in your browser (or your CI runner). Without it, what's on our disk is encrypted noise. Even subpoenaed, there's nothing to hand over but ciphertext.
Most disposable email services get blocked by major platforms within days. MailFlat runs on real mail infrastructure. Connect your custom domain in seconds, verify your DNS records, and start receiving mails directly on your domain prefixes or sending DKIM-signed emails from your code.
DNS records correctly configured. DKIM signatures are active for all outbound mail sent from this domain.
| Type | Host | Value | Status |
|---|---|---|---|
| MX | @ | mx.mailflat.net. (Priority: 10) | ✓ Active |
| TXT | @ | v=spf1 include:spf.mailflat.net ~all | ✓ Active |
| TXT | mf._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w... | ✓ Active |
Make sure "Proxy status" is set to "DNS only" (grey cloud) for the MX and SPF records to allow direct SMTP mail delivery to MailFlat's servers.
Drag the slider to your monthly email volume (received + sent). The plan that fits rises to the top; Free covers everyday inboxes, Pro grows with you, and we'll talk for anything over 500k.
Everything, scaled to 10,000 emails / month.
Volume is total emails per month: received + sent. One plan, every surface: web inbox, agent keys, and test environment share the same allowance.
Plenty of disposable-email and email-testing services exist. Here's where MailFlat lines up, and where it doesn't. We named the alternatives on purpose; it's the comparison we'd want to see.
M MailFlat real receive · e2e · agents | Mailtrap captured in sandbox | Mailosaur QA-only · enterprise | 10minutemail disposable · burner | Gmail +alias real mail · no privacy | |
|---|---|---|---|---|---|
Real SMTP receipt Mail actually lands in a real mailbox, not a sandbox. | —sandbox only | ~often blocked | |||
Auto-purge by design Messages clear themselves on a timer, nothing accumulates. | 2h → 30d | — | — | 10 min | — |
End-to-end encrypted Server holds ciphertext only. We can't read your mail. | — | — | — | — | |
API + SDKs for tests Create, list, read, delete inboxes from code. | — | — | |||
AI agent tooling MCP server + tool spec for GPT / Claude / LangChain. | MCP + tool spec | — | — | — | — |
Not flagged by signup forms Real mailboxes on real domains. Stripe and Gmail accept them. | · | —blocklisted | |||
Custom domain Use your own brand on the inbox addresses. | Pro plan | — | · | ||
Free tier with real limits Usable without paying, not a 7-day trial in disguise. | 250 mails / mo | ~100/mo | ~14-day trial |
Don't see yours? Email hi@mailflat.net and a human replies, usually within a day.
Open the page and start typing, curl the API and start scripting, or hand the key to your agent. Same encrypted backend, same free tier, same zero setup.