Over 306 billion emails traverse the internet daily according to 2024 Radicati Group data, yet disposable email addresses power everything from QA automation to privacy‑conscious signups. Running your own temporary email service backend on virtual private servers gives you full control over retention policies, API shape, and deliverability — without the per‑mailbox fees of SaaS alternatives. This guide walks through provisioning a Postfix‑and‑Dovecot stack on a VPS, wiring DNS for inbound mail, automating mailbox expiry, and hardening the stack against abuse so you can launch a production‑grade disposable inbox platform in an afternoon.
Quick Answer: Provision a VPS, install Postfix (MTA) and Dovecot (IMAP/POP3), configure MX and SPF/DKIM/DMARC DNS records, write a cleanup daemon that purges mailboxes older than your TTL, expose a REST API for frontend consumption, and harden with rate limits, TLS, and DNSBL checks.
Why Host Your Own Temporary Email Backend on a VPS
Cost Predictability and Data Sovereignty
A $6‑month VPS from providers like DigitalOcean, Linode, or Hetzner handles tens of thousands of ephemeral inboxes for a flat fee. Third‑party APIs such as Mailinator or 1secmail charge per request or impose strict rate caps; self‑hosting removes those ceilings and keeps user data on infrastructure you control. The 2024 Open Email Survey shows Dovecot powers 76.9% of IMAP servers worldwide, confirming the stack's maturity for high‑volume workloads.
Custom Retention and API Contracts
SaaS disposables often hard‑code 10‑minute lifespans. Your own backend lets you tailor TTL per project — 5 minutes for QA smoke tests, 24 hours for trial signups — and expose exactly the JSON endpoints your frontend expects. Postfix's lookup‑table architecture makes dynamic address routing trivial: a single SQLite or Redis map can resolve `token@temp.example.com` to an on‑disk Maildir without creating system users.
Provision the VPS and Harden the OS
Choose Specs and Base Image
- Select a VPS with 2 vCPU, 4 GB RAM, 80 GB SSD — enough for Postfix queue, Dovecot indexes, and a lightweight API worker.
- Deploy Ubuntu 24.04 LTS or Debian 12; both receive security updates until 2029 and ship Postfix 3.8+ and Dovecot 2.3+ in default repos.
- Disable password SSH, enforce key‑only auth, and enable UFW allowing only 22 (SSH), 25 (SMTP), 587 (submission), 993 (IMAPS), and 443 (API).
Configure Hostname, Reverse DNS, and Time Sync
Set the FQDN to `mx.temp.example.com` in `/etc/hostname` and `/etc/hosts`. Ask your VPS provider to set the PTR record to match — critical for deliverability. Install `chrony` so logs and DKIM timestamps stay accurate; clock skew breaks DKIM verification.
Install and Configure the Mail Stack
Postfix as MTA with Dynamic Alias Maps
- `apt update && apt install -y postfix postfix-sqlite dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-sqlite`.
- During Postfix setup choose "Internet Site" and set system mail name to `temp.example.com`.
- Create `/etc/postfix/sqlite-aliases.cf` pointing to a SQLite DB with table `aliases(token TEXT PRIMARY KEY, maildir TEXT, expires_at INTEGER)`.
- In `main.cf`: `virtual_alias_maps = sqlite:/etc/postfix/sqlite-aliases.cf`, `virtual_mailbox_domains = temp.example.com`, `virtual_mailbox_base = /var/vmail`, `virtual_uid_maps = static:5000`, `virtual_gid_maps = static:5000`.
- Run `postmap /etc/postfix/sqlite-aliases.cf` and `systemctl reload postfix`.
Dovecot for IMAP/POP3 Access and LMTP Delivery
- Edit `/etc/dovecot/dovecot-sql.conf.ext` with the same SQLite DB; query `SELECT maildir AS mail, 5000 AS uid, 5000 AS gid FROM aliases WHERE token = '%u' AND expires_at > strftime('%s','now')`.
- Enable `mail_location = maildir:/var/vmail/%d/%n` and `protocol lmtp { mail_plugins = $mail_plugins sieve }` in `10-mail.conf`.
- Configure TLS with Let's Encrypt certs: `ssl_cert =
- `systemctl enable --now dovecot`.
DNS, Authentication, and Deliverability
MX, SPF, DKIM, and DMARC Records
- Create MX record: `temp.example.com. 300 IN MX 10 mx.temp.example.com.`.
- SPF TXT: `v=spf1 ip4:YOUR_VPS_IP ~all` — RFC 7208 defines this syntax.
- Generate DKIM keypair with `opendkim-genkey -d temp.example.com -s default`; publish the public key as `default._domainkey.temp.example.com. TXT "v=DKIM1; k=rsa; p=..."`.
- DMARC TXT: `v=DMARC1; p=quarantine; rua=mailto:dmarc@temp.example.com` — start with `p=none` for two weeks, then escalate.
Test Inbound Flow End‑to‑End
Send a test mail from Gmail to `test123@temp.example.com`. Watch `/var/log/mail.log` for `postfix/smtpd` acceptance, `dovecot/lmtp` delivery to `/var/vmail/temp.example.com/test123/new/`, and IMAP `FETCH` via `openssl s_client -connect localhost:993`. Verify `Authentication-Results` headers show `spf=pass`, `dkim=pass`, `dmarc=pass`.
Automation: Mailbox Creation, Expiry, and API Layer
Token Generator and Cleanup Daemon
- Write a Go or Python service with two endpoints: `POST /api/v1/inboxes` returns `{token, address, expires_at}` and inserts a row into the SQLite aliases table with `expires_at = now() + TTL`.
- Schedule a cron `* * * * * /usr/local/bin/cleanup-inboxes.sh` that `DELETE FROM aliases WHERE expires_at < strftime('%s','now')` and removes the corresponding Maildir directories.
- Expose `GET /api/v1/inboxes/{token}/messages` querying Dovecot's index via `doveadm search` or reading Maildir files directly for simplicity.
Rate Limiting and Abuse Mitigation
Place the API behind NGINX with `limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;`. In Postfix, enable `postscreen` on port 25 and `smtpd_client_connection_rate_limit = 50`. Subscribe to Spamhaus ZEN DNSBL: `smtpd_recipient_restrictions = reject_rbl_client zen.spamhaus.org`. These layers drop 90%+ of bot traffic before it hits your queue.
Comparison: Self‑Hosted vs. SaaS Disposable Email
Self‑hosting trades operational overhead for flexibility; SaaS trades flexibility for convenience. The table below uses real 2024 pricing and throughput numbers from vendor docs and the Open Email Survey.
| Factor | Self‑Hosted on VPS | SaaS (Mailinator Team Plan) |
|---|---|---|
| Monthly cost (100k inboxes) | $6‑$12 | $299 |
| Max retention | Unlimited (your policy) | 24 hours |
| API rate limit | Your hardware | 5,000 req/min |
| DKIM/SPF control | Full | Shared domain only |
| Setup time | 2‑4 hours | 5 minutes |
| Deliverability ownership | You manage reputation | Vendor manages |
Common Mistakes and Pro Tips
Mistake: Skipping Reverse DNS
Why It Hurts: Major receivers (Gmail, Outlook) reject or bulk‑folder mail from IPs without matching PTR records. Fix: Set PTR to `mx.temp.example.com` in your VPS control panel before sending first mail.
Mistake: Using a Shared IPv4 Block
Why It Hurts: Cloud providers recycle IPs; previous tenants may have burned reputation. Fix: Request a clean IP or warm the address with low‑volume transactional mail for two weeks before enabling disposable inbound.
Mistake: No Queue Monitoring
Why It Hurts: A stuck queue silently drops user messages. Fix: Alert on `postqueue -p | wc -l` exceeding 100; graph queue depth in Prometheus/Grafana.
Mistake: Ignoring IPv6
Why It Hurts: Gmail and Yahoo prefer IPv6; missing AAAA records degrade deliverability. Fix: Add AAAA for `mx.temp.example.com` and update SPF to `ip6:YOUR_VPS_IPV6`.
Pro Tips
- Run `postfix check` nightly via cron; it catches config drift before reload failures.
- Store Maildir on a separate XFS volume with `noatime` — reduces IOPS 30% on SSD.
- Use `doveadm expunge -u '*' mailbox Trash savedbefore 7d` to auto‑purge user‑deleted mail.
- Log all API calls with correlation IDs; debug nondelivery reports in seconds, not hours.
- Rotate DKIM keys every 90 days; publish new selector `default2._domainkey` before retiring old.
FAQ
What is a temporary email service backend?
A temporary email service backend is the server‑side infrastructure that receives, stores, and expires short‑lived email addresses. It typically comprises an MTA (Postfix), an IMAP/POP3 server (Dovecot), a database for address‑to‑mailbox mapping, and an API layer for frontend integration.
How does self‑hosting compare to using a disposable email API?
Self‑hosting on a VPS costs $6‑$12 monthly for unlimited inboxes and full DNS control, while SaaS APIs charge $100‑$300 monthly with rate caps and shared reputation. Self‑hosting requires 2‑4 hours initial setup and ongoing OS/mail‑stack maintenance.
What are the minimum VPS specs for a production disposable email backend?
2 vCPU, 4 GB RAM, and 80 GB NVMe SSD handle 50k‑100k active inboxes with sub‑second API latency. Scale vertically to 4 vCPU/8 GB RAM if queue depth exceeds 500 messages during peak.
Why are my inbound emails going to spam or being rejected?
Missing or mismatched PTR, absent SPF/DKIM/DMARC, IP reputation issues, or missing IPv6 AAAA records are the top causes. Verify each with `dig`, `mxtoolbox.com`, and Gmail Postmaster Tools.
What trends will shape disposable email infrastructure in 2025?
Wider adoption of ARC (Authenticated Received Chain) for forwarding chains, mandatory TLS‑RPT reporting per RFC 8460, and increased use of IPv6‑only VPS instances as IPv4 exhaustion drives dual‑stack costs up.
Conclusion
Building a temporary email service backend on a virtual private server gives you predictable costs, unlimited retention policies, and full control over authentication and reputation. The Postfix‑Dovecot stack, hardened with SPF/DKIM/DMARC, rate limiting, and automated expiry, runs reliably on a $6‑month VPS and scales vertically before you need horizontal sharding. Start with the minimal viable config in this guide, validate deliverability against Gmail and Outlook, then layer on monitoring, DKIM rotation, and API caching as traffic grows.
- Provision VPS, harden OS, set PTR, install Postfix + Dovecot with SQLite alias maps.
- Publish MX, SPF, DKIM, DMARC; verify inbound flow end‑to‑end.
- Build token API and cleanup daemon; protect with NGINX rate limits and Postscreen.
- Monitor queue depth, rotate DKIM quarterly, and warm IPs before high volume.
0 comments:
Post a Comment