Written and reviewed by the team operating TempMail Cloud. Product claims are checked against our live service and our editorial standards.
Catch-all routing accepts messages for recipient names that were not individually created in advance. It does not automatically give a user permission to read those messages. Keep mail acceptance, application storage and mailbox ownership separate when designing or testing a receiving domain.
A concrete routing example
Suppose you control a dedicated test subdomain, qa.example.com. A message to created-user@qa.example.com targets a known test mailbox. A message to typo-user@qa.example.com may be rejected, forwarded to a collection mailbox or stored as another recipient record, depending on the receiver configuration.
Those are different designs. The presence of an MX record does not choose between them. SMTP identifies the recipient, while the receiving system decides whether to accept it. SMTP recipient processing.
| Test recipient | What to record | What to verify separately |
|---|---|---|
| Pre-created authorized mailbox | SMTP result and visible delivery | The intended user can open it |
| Uncreated name on your own test domain | Accept, reject or route outcome | Nobody gains access merely by guessing its name |
| Previously deleted recipient | Whether mail is discarded or rejected by policy | The old identity is not silently reassigned |
| A recipient outside the configured domain | Receiver rejection or documented routing | The service is not acting as an open relay |
Run these checks only against infrastructure you administer or have permission to assess. This is a proposed acceptance matrix, not a report that every configured public domain has passed it.
How this relates to TempMail Cloud
Users create random or custom inboxes on domains available to them. The operator manages receiving-domain availability and any private-domain assignment. Selecting a custom name does not grant control over every address at that domain.
The current application can store an incoming message for an uncreated recipient on an accepted public domain under an unowned mailbox record with generated credentials. Receiving that message does not reveal those credentials or grant ownership to whoever later types the address. Create an authorized mailbox through the product before asking a third party to send to it.
Deleted-recipient protections and private-domain controls are additional boundaries. The exact public SMTP behavior depends on the deployed receiver configuration; do not infer it solely from a browser form or application source code.
Keep test routing separate from workplace mail
Use a dedicated receiving subdomain when you intend to preserve the existing root-domain mailbox provider. Follow the receiving operator's actual MX instructions; do not replace working root MX records with a guessed value. Cloudflare email DNS guidance explains the roles of the records.
Wildcard acceptance can attract typo traffic and unwanted messages. Plan the recipient policy, storage limits, monitoring and abuse response before enabling it. Catch-all is not a forwarding promise, unlimited storage allowance or substitute for access control.
For an address you want to use now, start with the available domains and custom-address guide. For operator-assisted domain onboarding, contact support with the domain name, without sending registrar passwords.