-- : -- : --
Home
Back to Projects
2026/ 02Live

Temp Mail

Temporary Email Service

View Live Project

Overview

An enterprise-grade temporary email service with a custom RFC 5321-compliant SMTP server, a RESTful API, and a real-time Next.js frontend. Provides zero-registration, disposable email addresses that automatically expire after 24 hours, with full MIME parsing for HTML content, attachments, and inline images.

Temp Mail is a full mail transfer agent built from scratch — a custom SMTP server implementing RFC 5321 receives and parses incoming email, an Express API exposes mailbox and message data, and a Next.js frontend renders inboxes in real time. PostgreSQL stores all records with a 24-hour TTL, cleaned up hourly by a leader-elected cron service.

Key Features

Custom SMTP Server

RFC 5321-compliant mail server built on smtp-server + mailparser, handling MIME multipart messages and attachments

Instant Mailbox Provisioning

Zero-registration custom or auto-generated addresses, created on first RCPT TO or via API

Automated Data Lifecycle

Hourly cron cleanup service with leader election deletes expired mailboxes and messages after a 24-hour TTL

Real-Time Inbox

Client-side polling with sanitized HTML rendering via DOMPurify and attachment downloads

Layered Security

Tiered IP-based rate limiting, whitelist input sanitization, CORS origin whitelisting, and SMTP relay prevention

Technology Stack

Next.js 15React 19TypeScriptTailwind CSS 4GSAPExpressPrismaPostgreSQLsmtp-servermailparser

Challenges

  • Implementing a spec-compliant SMTP server from scratch, including MIME multipart parsing and attachment handling

  • Preventing the service from becoming an open relay while still accepting mail for arbitrary usernames on the configured domain

  • Safely rendering untrusted HTML email content in the browser without exposing XSS vectors

  • Coordinating automated data expiration across multiple instances without duplicate or missed cleanup runs

Solutions

  • Built the SMTP layer on smtp-server with mailparser for MIME decoding, storing raw bytes plus parsed metadata

  • Enforced strict RCPT TO domain validation, rejecting any recipient outside the configured mail domain with a 550 response

  • Sanitized all HTML email content with DOMPurify before rendering, stripping scripts, iframes, and inline event handlers

  • Implemented a single-leader cron election pattern so only one instance runs the hourly expiration sweep in multi-instance deployments

  • Layered IP-based rate limits per endpoint category to blunt abuse of mailbox creation and message polling

Project Architecture

// Project Structure

temp-mail/
├── backend/
│   ├── src/
│   │   ├── api/         # Express REST API
│   │   ├── smtp/        # SMTP protocol server
│   │   ├── services/    # Cleanup + scheduler
│   │   └── lib/         # Prisma client, email utils
│   └── prisma/          # Schema + migrations
└── frontend/
    ├── app/             # Next.js App Router
    │   ├── mailbox/[username]/
    │   └── mailbox/[username]/message/[messageId]/
    ├── components/      # Layout + UI primitives
    └── lib/             # API client, sanitization

Key Learnings

  • Low-level SMTP protocol mechanics (RFC 5321) and MIME message structure

  • Building and securing an intentionally open, anonymous-by-design public service

  • Safe rendering of untrusted third-party HTML in a React application

  • Distributed cron/leader-election patterns for stateless horizontal scaling

  • Designing data lifecycle systems around automatic, time-based deletion

Future Enhancements

DKIM signing for outbound authenticity, database encryption at rest, WAF rules, and administrative request-logging for audit trails.