SpamEater

Paid APILinuxSelf-hostedWeb

What SpamEater is

SpamEater is a free, MIT-licensed system for hosting disposable email inboxes on a domain and server you own. It creates inboxes without user accounts, then deletes each inbox and its messages after 24 hours; the deletion cannot be reversed. Email bodies are encrypted at rest with AES-256-GCM. The web interface adapts HTML email for dark mode, embeds inline images and keeps remote images blocked until loaded. It lists protections including ModSecurity with the OWASP Core Rule Set, fail2ban, CSRF and HMAC delete tokens, and rate limits across SMTP, web application firewall and API layers. The web interface is HTTPS-only, but inbound SMTP on port 25 is plaintext. Anyone who knows an inbox name can read it, so random names are recommended for mail meant to remain private. Deployment options include Docker and a native installer. Setup requires a domain, configured DNS, a static public IP, and open ports 25, 80 and 443. The project describes the service as intended for throwaway mail, not anything important.

Who it suits

SpamEater may suit people who want disposable inboxes on infrastructure and a domain they control. Its short retention period makes it unsuitable for mail that must be kept or recovered.

What it does well

No user accounts, tracking or analytics.
Email bodies are encrypted at rest with AES-256-GCM.
Web interface uses HTTPS and blocks remote images initially.
Offers Docker deployment and a native installer.
Supports custom domains, attachments and API access.

What to know first

Inboxes and mail are permanently deleted after 24 hours.
Anyone who knows an inbox name can read it.
Inbound SMTP on port 25 is plaintext.
Setup requires DNS, a static IP and open ports.

Limits

Every inbox and its messages are permanently deleted after 24 hours, with no recovery. Anyone who knows an inbox name can access that inbox.

Getting started

Prepare a domain with configured DNS and a static public IP
Open ports 25, 80, and 443 on the server
Deploy with Docker Engine 20.10+ and Docker Compose v2+, or use the native installer
Use a listed Linux release for native installation
Create inboxes without user accounts and use random names for private mail

Verdict

SpamEater provides short-lived inboxes with a self-hosted deployment model and several listed security protections. The 24-hour deletion, exposed inbox-name access and plaintext inbound SMTP are important limits to consider.

Questions

Is SpamEater free?

Yes. It is free and open source, with an MIT license.

Where can it run?

It provides API and web access, supports self-hosting on Linux, and offers Docker deployment. Native installation lists AlmaLinux, RHEL, Rocky Linux 9 and 10, Ubuntu 22.04 or later, and Debian 11 or later.

Does it require user accounts?

No. It runs on your domain and server without user accounts.

How long do inboxes last?

Inboxes and their mail are deleted after 24 hours and cannot be recovered.

Does it support custom domains and attachments?

Yes. Custom domains, API access, and attachments are supported.

Is inbound email encrypted in transit?

The web interface is HTTPS-only, while inbound SMTP on port 25 is plaintext.

Facts from SpamEater's own pages

Architecture: The project uses Haraka SMTP, an Express API, SQLite storage, and a vanilla JavaScript frontend. · github.com, 5 Oct 2026
Components: SpamEater uses Haraka for SMTP, Express for its API, and SQLite for storage. · github.com, 5 Oct 2026
Deletion: Inboxes and mail are deleted after 24 hours with no recovery. · github.com, 5 Oct 2026
Deployment: The project offers Docker deployment and a native installer; the Docker setup requires Docker Engine 20.10 or later and Docker Compose v2 or later. · github.com, 5 Oct 2026
Email privacy: Email bodies are encrypted at rest with AES-256-GCM. · github.com, 5 Oct 2026
Email rendering: HTML email is adapted for the dark interface, inline images are embedded, and remote images stay blocked until loaded for that email. · github.com, 5 Oct 2026
Encryption: Email bodies are encrypted at rest with AES-256-GCM. · github.com, 5 Oct 2026
Inbox lifetime: Inboxes and their mail are deleted after 24 hours, with no recovery. · github.com, 5 Oct 2026
Inbox privacy limit: Anyone who knows an inbox name can read it, so the README recommends random names for mail users want to keep private. · github.com, 5 Oct 2026
Intended use: The README describes SpamEater as intended for throwaway mail and says not to point anything important at it. · github.com, 5 Oct 2026
License: The repository identifies SpamEater as MIT licensed. · github.com, 5 Oct 2026
Limit: Anyone who knows an inbox name can read that inbox, and the project recommends random names for inboxes users want to keep private. · github.com, 5 Oct 2026
Mail transport: Inbound SMTP is plaintext, while the web interface is HTTPS-only. · github.com, 5 Oct 2026
Privacy: The service has no user accounts, tracking, or analytics. · github.com, 5 Oct 2026
Purpose: SpamEater is self-hosted disposable email, with inboxes that delete themselves after 24 hours. · github.com, 5 Oct 2026
Rendering: The web interface adapts HTML email for dark mode and blocks remote images until the user loads them. · github.com, 5 Oct 2026
Requirements: Setup requires a domain, configured DNS, a static public IP, and open ports 25, 80, and 443. · github.com, 5 Oct 2026
Security: The project lists ModSecurity with the OWASP Core Rule Set, fail2ban, CSRF and HMAC delete tokens, and rate limiting across SMTP, WAF, and API layers. · github.com, 5 Oct 2026
Security protections: The project lists ModSecurity with OWASP Core Rule Set, fail2ban, CSRF tokens, HMAC delete tokens, and rate limiting across SMTP, WAF, and API layers. · github.com, 5 Oct 2026
Setup: It runs on a domain and server you own and requires no user accounts. · github.com, 5 Oct 2026
Support: The repository says to report vulnerabilities through its GitHub Security tab. · github.com, 5 Oct 2026
Supported systems: The native installer lists AlmaLinux, RHEL, and Rocky Linux 9 and 10, plus Ubuntu 22.04 or later and Debian 11 or later. · github.com, 5 Oct 2026
Web transport: The web interface is HTTPS-only, while inbound SMTP on port 25 is plaintext. · github.com, 5 Oct 2026

Where SpamEater stands on Freedom251

Temporary email services#44 of 44
Disposable Email Services#25 of 25