Attachments

position: 19

Files sent to a temporary address are handled more strictly than in an ordinary mailbox, and deliberately so. Here is what gets through, what does not, and the reasoning.

What is accepted

Ordinary documents and media: images, PDFs, spreadsheets, text files, archives of them. Anything up to five megabytes per file. Larger files are skipped, and the message itself still arrives without them.

The whole message, including everything attached, must be under ten megabytes. Beyond that the message is refused at the door and never reaches us at all.

What is refused

Executable file types are dropped before anything is stored. That includes programs, scripts, installers, shortcuts and the various formats that exist mainly to run code on the machine that opens them.

This is not negotiable and there is no setting to change it. A disposable mailbox receives mail from strangers by definition, and an executable attachment from a stranger has no legitimate use that justifies the risk.

If a colleague genuinely needs to send you a program, that is a conversation for a real mailbox with a real relationship behind it.

How files are stored and served

Accepted files are held in object storage separate from the application, under a key that cannot be guessed. They are deleted along with the message, on the same schedule as everything else.

When you download one, it is always served as a download and never displayed in place, with a content type that prevents the browser from interpreting it. Even a file that is technically a web page cannot execute in the context of this site, because it is never treated as one.

The download link is signed and short lived. It works for a few minutes and then stops, which means a link copied out of the page cannot be shared or reused later.

Attachments require an account

Guest mailboxes receive messages but not files. This is one of the three things an account adds, along with private domains and multiple mailboxes.

The reason is practical rather than commercial. Storing files costs money and carries risk, and tying that to an account means there is somebody to hold responsible if it is misused. A completely anonymous file store attached to a disposable mailbox would be abused within a week, and then blocked everywhere, which helps nobody.

Still treat them with suspicion

Everything above reduces the risk. None of it makes an unexpected attachment safe.

A document from an unknown sender can still contain a hostile macro. A PDF can still carry an exploit. An archive can still expand into something unpleasant. The only defence that reliably works is not opening files you did not expect from people you do not know.

If you are using a disposable address, you almost certainly asked for exactly one thing and know what it should be. Anything else that arrives is not for you.

If a file did not arrive

Check the size first: over five megabytes and it was skipped, over ten and the whole message was refused. Check the type second: if it was an executable, it was dropped deliberately. If neither applies, the sender may simply not have attached it, which happens more often than any of the technical explanations.