How does temporary email work? From the moment an email is sent to the moment it hits your screen

14:02 exactly. You press "Sign up" on an online shop's registration form. The email field contains the random address you just copied from Geçici Mail.

About four seconds later, a notification sound plays, the tab title flags a new message, and the shop's "Confirm your account" email is sitting in your inbox.

Quite a lot happens in those few seconds. In this article we unpack them one at a time. We'll use some technical terms, but we'll explain each one as it comes up, so that someone who has never thought about how email works can follow along comfortably.

A temporary email is basically an ordinary mail server

A temporary email service doesn't do anything magical. Email on the internet has travelled under the same shared rules for decades. Whether a shop's server is sending to your Gmail address or to your temporary address, it uses the same protocol, SMTP (Simple Mail Transfer Protocol). The difference is in what the receiving side does. A normal email provider is designed to store mail for years, sort it into folders and let you reply. A temporary email is designed to receive mail, show it for a short while and then delete it.

Let's follow that 14:02 email step by step.

Step 1. The sending server asks "where does this email go?"

All the shop's server has is an address, for example abc123@example-domain.com. The part after the @ sign, the domain, decides which server the email goes to.

To find out, the server asks DNS (the internet's directory that turns domain names into addresses) a question. "Which mail server handles this domain?" The answer comes from something called an MX record.

An MX record is the DNS record that says which server accepts incoming email for a domain. The MX record for Gmail's domain points to Google's servers; the MX record for a temporary email domain points to the temporary email service's servers. This lookup is usually over in the blink of an eye.

Step 2. The two servers talk

The sending server connects to the server named in the MX record, and a short, rule-based conversation begins. Roughly, it goes like this:

1. The sender introduces itself.
2. It says who the email is from.
3. It says who the email is for (abc123@example-domain.com).
4. The receiving server says "OK, I'll accept mail for this address".
5. The sender transfers the content of the email (headers, subject, text, the HTML part).
6. The receiving server says "got it" and the connection closes.

From this point on, the email is out of the sender's hands. On the shop's side, it's marked as "sent".

Step 3. Catch-all, or "accept everything sent to this domain"

A normal company mail server only accepts mail for accounts that exist. If alex@company.com exists, it accepts the email; if there's no account called xyz@company.com, it rejects it with "no such user".

Temporary email services usually work differently. Catch-all means a domain is set up to accept every email sent to it, whatever comes before the @ sign. The reason is simple. Random addresses are being created all the time, and opening a mailbox in advance for each one would be both unnecessary and slow. The server accepts the email; who it belongs to is worked out in the next step.

Step 4. The email is matched to the right inbox

When the email reaches the server, the recipient address is read and matched to the inbox linked to that address. The address created when you opened the home page is associated with your browser and with a recovery key. That's why the email only appears on the screen of the person who holds that address.

This is where the recovery key comes in. The XXXX-XXXX code shown under the address box, next to the green key icon, lets you say "this address is mine" from another device. We explain how to use it in a separate article.

Step 5. The email is parsed and cleaned

An email is more than plain text. Behind the scenes it's made of several parts packaged in a format called MIME, with header information (from, to, subject, date), a plain text version, an HTML version and any attachments. The system unpacks this bundle and separates out the parts that can be displayed.

This is where the security side starts. An HTML email is really a small web page, and someone with bad intentions can hide code (a script) inside it. So:

• Scripts are removed. Any executable code in the email is stripped out before you see it.
• Attachments aren't shown. Geçici Mail doesn't display attachments. Downloading a file when you don't know who sent it isn't a good idea anyway; this choice shuts that risk out from the start.
• Text and layout are kept. Confirmation buttons, links and codes stay readable, so the email is still usable.

Step 6. The email is shown in an isolated frame

The cleaned email opens inside an isolated frame, separate from the rest of the site. It works like a shop window. You can see what's inside, but the email can't reach through the glass to the site itself or to other information in your browser. Even if the cleaning step missed something, this works as a second layer of protection.

Because the inbox refreshes itself every 5 seconds, the email shows up in the list shortly after it reaches the server. In our own tests, the whole journey, from sending to appearing on screen, takes 3 to 5 seconds on average. Unread emails have a blinking green dot next to them, read ones a grey dot. The small circle to the left of the address box shows how many seconds are left until the next refresh.

Step 7. Deletion

This is the "temporary" part of temporary email. There are two separate time limits, and people often mix them up:

The point of deleting is to avoid piling up data. Confirmation emails, order summaries and codes sitting in a temporary inbox for months don't help anyone; at most, they're a risk. Twenty-four hours is enough to get your code and take another look if needed, but too short to build an archive.

You can also drop the current address and get a new one at any time with the DELETE button (it asks for confirmation).

So why can't a temporary email send messages?

Every step above is about receiving email. Sending is a completely different responsibility. If a service that needs no sign-up, where anyone can get an address in seconds, could send email, it would quickly become a source of spam and scam messages. The domains' reputation would sink, and other servers would start rejecting everything coming from them. That's why Geçici Mail only receives; you can't reply or send new emails.

For the same reason, there's protection against automated bot use. Anyone using the service at a normal human pace will never notice it.

What does this mean for privacy?

One result of this whole setup is that you don't hand over any personal information to get an address. No account, no password, no phone number. Because incoming emails are deleted soon after, nothing lingers for long. It also explains why a temporary email is good for getting a discount code or downloading a file, but not for your bank or your main accounts. Those accounts need to be able to reach you for years. We discuss that balance in more detail in is a disposable email address safe.

The whole journey of that email at a glance

Next time your tab title flags a new email, you'll know there's a few-second chain like this running behind it. Any other questions? Our FAQ page is always open.