Help & Documentation

GPTMail provides temporary inboxes for testing sign-ups, receiving verification codes, protecting your primary address, and building automated email workflows. You can use the public domains immediately without creating an account.

Public inboxes are address-based. Anyone who knows the full public email address may be able to open that inbox, so do not use public temporary addresses for banking, identity documents, account recovery, private conversations, or other sensitive information.

When the site opens, GPTMail assigns a temporary email address automatically. You can generate a new random prefix, edit the prefix manually, or choose a different public domain from the domain selector.

Custom prefixes are useful when a website requires a stable address. After editing the prefix, confirm it with the check button in the input; the random generation button remains available for creating a fresh address.

Quick access: open https://mail.chatgpt.org.uk/user@domain.com to go directly to a specific inbox.

• Copy the current address from the address area or the inbox toolbar.
• Copy an inbox link when you need to reopen the same address later.
• Refresh manually if the sender says the email was sent but it has not appeared yet.
• Delete a single message from the message view when it is no longer needed.
• Clear the inbox when you want to remove all messages for the current address.

Most messages arrive within seconds, but external sender queues, greylisting, DNS propagation, and provider throttling can cause delays.

Click a message to open the reader. GPTMail shows the sender, recipient, subject, received time, and the HTML or plain-text body. Remote images are loaded through a privacy proxy by default; loading an image directly can reveal your IP address to the sender. Avoid clicking suspicious links or downloading unexpected files.

If the same inbox is opened on multiple devices, each device reads the same temporary mailbox state. Deleted messages are removed for that inbox, not only for the current browser.

You can add your own root domain to GPTMail when you want temporary addresses under a domain you control. Point the domain's MX record to the public MX target shown on the Domains page, then submit the root domain for verification.

After a public domain passes MX verification: submitted while signed out → API Key (20000 requests); submitted while signed in → 200 points. Each domain receives only one reward. Important: once connected, that domain suffix becomes a public suffix available to all users on this site, so other users can also generate mailbox addresses under it. After activation, do not delete, replace, or modify the MX record that points this domain to our service. Otherwise, later checks may treat the domain as misconfigured. If a later check finds the MX record invalid, the domain will be deactivated. If the MX record remains invalid for 3 consecutive checks, the associated API key will also be deactivated. If the MX record becomes valid again later, the domain will be reactivated automatically.

Private domains are for personal or team inboxes. Adding one requires signing in with your GPTMail account: the domain is linked to that account, uses a dedicated private MX target, and its inboxes open only for that account while it is signed in. No password is needed. This differs from a public domain, where anyone who knows an address can open that inbox.

Private domains added before account linking keep working with their password. Sign in and enter the password once (when opening one of its inboxes, or by adding the domain again) to link such a domain to your account.

Members-only domains are available only to signed-in accounts (sign in with Cloudflare and choose a username). They are hidden from anonymous visitors and public domain lists and cannot be used with API keys, the browser extension, or Telegram monitoring.

Keep your account secure. GPTMail cannot make an address private retroactively once it has been shared.

Telegram monitoring forwards new mail for the current inbox to a private chat with the GPTMail bot. Each alert contains the sender, subject, a link to the inbox, and the message text; very long messages are shortened.

A private inbox must be open in your browser before monitoring starts: sign in with the account that owns the domain, or enter the password of a domain added before account linking. To stop alerts, send /unbind to the bot and choose the inbox. Monitoring is not available for members-only domains.

The API lets developers generate inbox addresses, list messages, read message details, and delete mail, so temporary email can be built into tests and automation. Authenticate with the X-API-Key header.

The shared public key shown on the API page changes every day, and its daily quota is shared by all users, so use it only for quick evaluation. For dependable automation, use a personal key (issued when you add a public domain, or redeemed through LDC Store) and handle quota responses, empty inboxes, and delayed delivery in your client.

Temporary email is convenient, but it is not secure long-term storage. GPTMail keeps message metadata in Cloudflare D1. Message bodies of up to 64 KB without attachments are stored there too; larger messages and attachments are stored in Cloudflare R2. Messages are kept for at most 24 hours (the site may use a shorter period), and scheduled cleanup then removes them.

Do not receive passwords, recovery links, payment records, government documents, medical data, or confidential business information in a public temporary inbox. For sensitive workflows, use a private mailbox that you control. The Terms & Privacy page explains cookies, advertising, and the data GPTMail processes.

• If no email arrives, confirm the address spelling and wait a few minutes for the sender retry queue.
• If a custom domain does not validate, check that the MX record points to the exact required target and that DNS propagation has completed.
• If a public domain becomes disabled, its MX record likely failed repeated checks or no longer points to the configured target.
• If the inbox count or domain list looks stale, refresh the page; public pages and API summaries may use short cache windows for speed.
• If an API call fails, check the HTTP status, the API key and its remaining quota, and the base URL. HTTP 429 means a quota or rate limit was reached, so wait before retrying.