After a Mailbox Expires

position: 25

"Deleted" is a word services use loosely. Here is precisely what happens when a temporary mailbox reaches the end of its life.

The mechanics

A background process runs continuously and looks for anything past its time. It removes expired messages first, then expired mailboxes. Removing a mailbox removes any messages still attached to it, and removing a message removes its stored files. All of it happens in the same pass.

The removals are actual deletions in the database, not a flag marking rows as hidden. Once the pass has run, a query for that address finds nothing, because there is nothing to find.

Stored attachments are deleted from object storage in the same operation, using keys collected before the database rows disappear. That ordering matters: after the rows are gone there would be no way to know which files to remove, and they would sit there indefinitely.

What survives

Server logs, briefly. They record that a request happened, not what a message contained. They are kept for a short period to keep the service running and to deal with abuse, then they age out.

Nothing else. There is no archive, no cold storage, no copy in a backup that somebody could restore from. This is intentional: a backup containing deleted mail would undo the entire point of deleting it.

Mail sent to an expired address

It is refused and discarded. The receiving side accepts messages for our domains in general, then looks for a mailbox matching the recipient. If none exists, the message is dropped without ever being written down.

The sender usually gets nothing back. We do not reply with an error saying the address is unknown, because that reply would confirm which addresses do exist, which is exactly the information somebody probing a domain wants.

So a message sent to an address that expired yesterday simply vanishes. Nobody is notified, including you.

The address can be issued again

Once a mailbox is deleted, the address returns to the pool and can be handed to somebody else later. With random names on several domains this is unlikely, and with a name you chose yourself it is more likely, because chosen names are predictable.

The practical consequence: mail sent to an address long after you finished with it might one day land in a mailbox belonging to a stranger. That is another reason not to use a disposable address for anything lasting.

Avoiding this entirely would mean keeping a permanent list of every address ever used, and a permanent list is exactly what a service built on deletion should not have.

Recovery is not possible

Not by writing to support, not by explaining the circumstances, not for any amount of urgency. The data does not exist anywhere we can reach.

If that sounds unhelpful, consider the alternative. A service that could restore your deleted mail on request could also be compelled to produce somebody else's, or breached by someone who wanted it. The inability to recover is the same property that makes the service safe to use.

What to do instead

Copy what you need while the message is in front of you. A verification code takes a second to use. A download link should be followed immediately. Anything you might want tomorrow belongs somewhere permanent, not in a mailbox designed to disappear.