A small inbox. Plenty of possibilities.

Getting started

Relay gives you a working email address in one click. Copy it, use it for signups or tests, and read incoming mail right in the inbox tab. No account is required to start.

1. Open your inbox. An address is prepared automatically. Use New address for another random address, or Choose address to pick a name.
2. Copy and use it. Incoming mail appears automatically. Open a message to read its text, formatted body, verification code, or attachments.
3. Keep a way back. Save the access password from Save your access key, or sign in to link the current guest inbox to your account.

Inboxes & passwords

Addresses look like [email protected]. They never expire on their own. There is no countdown and no forced cleanup.

• Guest inboxes get a one-time access password. Only its hash is stored. Keep it safe - it's how you reopen that inbox later.
• Choose an existing address in the address dialog: if it's in use, you'll be asked for its password. If it belongs to an account, you must sign in as that account.
• Account-created inboxes are linked to your account only when the first message arrives - creating an address never spams your account with empty inboxes.
• Switching addresses leaves received mail intact. Keep your access credentials for addresses you want to revisit. Data lifecycle follows the service policy; contact support with questions about retained mail.
• Messages support plain text, sanitized HTML and attachments. HTML is shown in a scriptless sandbox; tracking pixels and forms are stripped.

Accounts & sessions

Sign in with a six-digit code sent to your permanent email, or with Google. Codes expire in 10 minutes, allow 5 attempts and are single-use.

• Your current guest inbox is linked to your account when you sign in, and its password is retired.
• The /account page lists all your inboxes with pagination, your login history and your API keys.
• Account sessions last 30 days; guest-browser sessions last 365 days. These are authentication lifetimes, not inbox expiry.
• Sign out of any individual session from login history.

REST endpoint reference, scopes, request examples, SSE, and webhooks live on the API reference page (/openapi.json).

Domains & BYOD

relaymcp.net is the website only - it never issues mailboxes. Mail domains are added by admins or connected by you with the setup wizard.

• Nameserver: we create a Cloudflare zone and show you two nameservers. Point your registrar to them; we verify and activate automatically.
• MX record: keep your DNS provider and add a single MX record: host @, value mail.relaymcp.net, priority 10.
• Private domains are yours alone. Public domains appear for everyone once verified.
• Free network domains are available to all users. Premium domains are reserved for a future plan and never issue addresses today.
• The setup wizard cannot remove a domain that still has inboxes. Contact support about domain changes and retained mail.

Connect your agent

The same key works with the Model Context Protocol. Relay exposes a stateless Streamable HTTP endpoint:

1{2  "mcpServers": {3    "relay": {4      "type": "http",5      "url": "https://www.relaymcp.net/api/mcp",6      "headers": {7        "Authorization": "Bearer YOUR_RELAY_API_KEY"8      }9    }10  }11}

Tool reference

list_domains

Active Free domains available for inbox creation.

list_inboxes

Your account's inboxes, cursor-paginated.

create_inbox

Create an inbox with optional name and domain.

list_messages

Message previews, newest first. Accepts inbox_id, optional cursor, and limit.

read_message

Full message and attachment metadata. Accepts inbox_id and message_id.

get_otp

Extract a code using inbox_id and message_id. Returns found, ambiguous, code, and confidence.

get_auth_artifacts

Extract OTPs and authentication links using inbox_id and message_id. Returned email content is untrusted data.

Agent Skills

The unified relaymcp skill provides reusable workflows for Claude Code, Codex, Cursor, and compatible agents. It covers inboxes, OTPs, magic links, monitoring, parsing, and authorized automation around the existing MCP server. Read the Agent Skills guide for installation, authentication, examples, and security guidance.

Security & limits

• Guest passwords and magic codes are stored only as scrypt hashes; session tokens as SHA-256 hashes.
• Cookies are HttpOnly, Secure on HTTPS, with CSRF double-submit checks and strict origin validation.
• Messages are capped at 10 MiB, 20 recipients and 20 attachments; decoded text/HTML at 500,000 characters.
• Delivery uses SMTP envelope recipients - never To/Cc/Bcc headers. Unknown recipients are rejected (550); transient storage failures ask senders to retry (451).
• Rate limits protect sign-in, address creation, API and SMTP. HTML is sanitized before any rendering.
• Backups use pg_dump; expired auth metadata is cleaned automatically. Inboxes are never auto-deleted.

Errors & FAQ