tenmin.app is an independent email-infrastructure and privacy utility built and operated by Koracle LLC (koracle.ai). Most automated mail on the modern web consists of one-time verification tokens, staging QA payloads, and gated documentation links that do not belong in a permanent mailbox. We built tenmin.app to handle those ephemeral deliveries cleanly.
What it is
tenmin.app generates an ephemeral address ending in @tenmin.app and displays inbound RFC 5322 messages sent to it for the next ten minutes. After the 600-second window expires, both the routing entry and every message received are permanently purged. There is no signup, no user account, no password, and no persistent inbox archive.
The ten-minute window is calibrated for one-shot verification workflows: staging SPF, DKIM, and DMARC checks, transactional QA assertions, and single-use confirmation links. Clicking Extend resets the 600-second storage timer; clicking Refresh provisions a brand-new address immediately.
Why we built it
Many legacy disposable-email services surround the inbox viewer with intrusive ad networks, retain message logs for weeks, or render untrusted HTML directly in the host DOM. At Koracle LLC, we wanted to engineer a clean, fast utility on modern edge primitives with strict zero-retention guarantees and openly documented security boundaries.
Stateless edge routing makes this possible without traditional maildir servers. Inbound SMTP terminates over TLS at the edge, isolated serverless functions execute our MIME parsing pipeline, and our storage layer enforces a 600-second lease TTL so expired inboxes are purged automatically.
How it's built
We keep the system architecture minimal so every security boundary is easy to audit:
- Edge SMTP ingress. Our inbound gateway accepts mail for
*@tenmin.appover TLS and pipes the raw RFC 5322ReadableStreaminto an isolated ingestion handler. - Serverless MIME parsing. The ingestion pipeline decodes multipart boundaries, Quoted-Printable and Base64 transfer encodings, and RFC 2047 headers while validating the recipient local-part against a strict
[0-9a-f]{6}hex pattern. - Hard 600-second TTL storage. Parsed messages are stored with an explicit 600-second expiration timestamp. Expired leases are rejected at the SMTP layer and purged automatically.
- Two-layer XSS isolation. The frontend polls a read-only JSON endpoint every three seconds and renders HTML messages through a deterministic sanitizer inside a zero-privilege sandboxed iframe (
sandbox="") with scripts, forms, and same-origin access disabled.
What it isn't
tenmin.app is strictly receive-only. You cannot send outbound mail from a @tenmin.app address. There is no outbound MSA/SMTP relay, no reply button, and no outbound API. Keeping the domain strictly inbound prevents outbound spam abuse and protects our MX reputation for developers and privacy-conscious users.
It is also not an encrypted mailbox for sensitive or regulated communications. Because temporary inboxes require no authentication, anyone who knows or guesses an active 6-character hexadecimal ID during its 10-minute window could query that inbox. Use it for ephemeral verification and QA testing, never for banking, healthcare, or permanent account recovery.
Publisher & Engineering Team (Koracle LLC)
tenmin.app is owned, engineered, and maintained by Koracle LLC, a software engineering company focused on cloud infrastructure, developer utilities, and privacy-first web architecture.
Koracle LLC · Systems Architecture & Software Engineering
Our engineering work focuses on distributed systems, stateless edge compute, email authentication protocols (SPF, DKIM, DMARC, MIME), and browser security isolation. Every technical guide, architectural walkthrough, and policy document on tenmin.app is written and reviewed directly by our systems engineering team.
- Publisher
- Koracle LLC
- Corporate Site
- koracle.ai ↗
- Architecture
- System Design & Stack
- Editorial & Ops
- hello@tenmin.app
For bug reports, security disclosures, partnership inquiries, or legal correspondence, our contact page lists dedicated routing addresses (hello@tenmin.app, abuse@tenmin.app, and legal@tenmin.app). If our tools or engineering guides have saved you time in staging or kept your primary inbox clean, you can also support ongoing domain and infrastructure maintenance via Buy Me a Coffee.
Editorial standards & corrections
All thirteen technical guides in the tenmin.app Editorial Library are authored in-house by Koracle LLC engineers based on production operational experience running inbound email infrastructure at the network edge. We do not publish sponsored posts or paid affiliate placements. Technical corrections and protocol errata can be sent to hello@tenmin.app and are reflected alongside the page's Updated timestamp.