Why We Looked at Our Own Mail Data
People usually describe temporary email in terms of intent: "I just need the verification code" or "I don't want this shop in my real inbox." Those descriptions are plausible, but they are guesses. Because InboxBurn receives the mail itself, we can look at what actually arrives and check whether the guesses hold.
This article summarises aggregate figures from InboxBurn's production mail system between 30 March and 31 October 2026. No message bodies were read for this analysis and no individual inbox, address or user is described. Everything below is counts, shares and distributions. The point is not to impress anyone with a large number; it is to understand what disposable inboxes are really used for, and what that means for the people who use them and the people who send mail to them.
Methodology and What the Numbers Can and Cannot Tell You
Before the figures, the caveats, because they change how the figures should be read.
- Scope. The data covers messages delivered to InboxBurn addresses from 30 March to the morning of 31 October 2026 (UTC); the final day is therefore partial.
- Health checks excluded. InboxBurn sends test messages to its own domains to confirm that mail is still being received. Those internal probes are not counted.
- Purged notification mail excluded. In October 2026 the operators chose to reject future mail from a small set of notification senders and to delete their existing messages. Because that mail no longer exists, it is not part of these totals. The real historical volume was therefore higher than shown here, and the sender mix would have looked somewhat different.
- A sender domain is not a company. We grouped messages by the domain in the sender address. One company can send from several domains, and a domain can send on behalf of several businesses through an email platform. When we say "openai.com", we mean messages whose sender domain was openai.com, nothing more.
- Volume is skewed by bulk senders. A small number of automated senders produce a large share of all messages. Raw totals therefore describe mail traffic, not the number of people who used the service.
- The classifier is a heuristic. Some figures come from keyword matching on subject lines and from an automatic classifier that looks for codes and links. Both make mistakes in both directions.
With that in mind, here is what the data shows.
The Headline Numbers
Over the period, InboxBurn temporary inboxes received approximately 192,500 messages from 743 distinct sender domains.
Seven hundred and forty-three domains sounds like a wide spread, but the distribution is extremely uneven. The two largest senders alone accounted for roughly 53% of all messages. Both are automated bulk senders. We are not naming them: the purpose of this analysis is to describe patterns, not to single out particular businesses for how much mail they send to disposable addresses.
The practical consequence is simple. If you only looked at total volume, you would conclude that temporary inboxes mainly receive mail from two systems. That is true of the traffic, but it says little about the hundreds of other services people sign up for. The more interesting picture is in the long tail.
Monthly Volume: Growth Is Not a Straight Line
Monthly message counts were:
- April: 4,356
- May: 3,208
- June: 6,590
- July: 38,423
- August: 50,651
- September: 9,697
- October: 79,618 (through the morning of the 31st)
Two things stand out. First, the overall direction is up: the spring months are in the thousands, while the summer and October are in the tens of thousands. Second, the curve is jagged. September is far below both August and October.
The most likely explanation is the same concentration effect described above. When a large automated sender increases or decreases its activity, the monthly total moves with it, regardless of how many people actually used the service that month. A drop like September's should not be read as people abandoning temporary email, and October's peak should not be read as a precise measure of growth in users. Monthly volume tells you about traffic load, which matters for the people running mail servers, but it is a poor proxy for adoption.
Who Sends Mail to Temporary Inboxes
Outside the two largest senders, the top 30 sender domains fall into a few recognisable groups. The percentages below are each domain's share of all messages in the period.
AI tools
- openai.com: 6.1%
- lovart.ai: 6.0%
- aivideo.com: 4.1%
- capcut.com: 1.1%
- domoai.app: 0.5%
AI products form the largest recognisable group. This fits a common pattern: many AI tools offer free credits or a free tier behind an email sign-up, and people want to try them before deciding whether to give a long-term address. Video and image generation tools appear alongside general chat assistants.
Meta properties
- facebookmail.com: 3.7%
- instagram.com: 3.3%
- meta.com: 2.0%
- facebook.com: 0.3%
Social platforms send confirmation codes, login alerts and notifications. Note that the Meta figures are split across four domains, which is a good example of why "sender domain" and "company" are not the same thing.
Gaming
- raccoongame.com: 2.1%
- discord.com: 0.6%
- ggpass.com: 0.5%
- steampowered.com: 0.4%
Game launchers, community platforms and game account systems all require email verification. Their presence is consistent with people creating secondary or trial accounts.
Business and SaaS
- Zoho domains, combined: about 3.3%
- infomaniak.com: 1.1%
- justcall.io: 0.9%
- alchemy.com: 0.8%
Business software is an interesting category because it overlaps with legitimate testing. Developers and evaluators often sign up for a product trial to see how it works, and QA teams use disposable addresses to test their own sign-up flows.
Other recognisable senders
- google.com: 1.3%
- paypal.com: 0.4%
- substack.com: 0.3%
- proton.me: 0.3%
The appearance of payment and email-provider domains is worth a pause. Mail from a payment service suggests that some people attach disposable addresses to accounts that may hold money or payment details. That is risky, for reasons we cover below.
Most Messages Are About Proving You Own the Address
We matched subject lines against a set of verification and login keywords: code, verify, confirm, OTP, one-time, passcode, security code, log in or sign in, and activate. 70.7% of all subjects matched at least one of them.
That is the clearest finding in the data. The dominant job of a temporary inbox is to receive a message that proves you control an address: a sign-up confirmation, a one-time code or a login link. Newsletters, receipts and long conversations make up a much smaller share.
Keyword matching is crude. A marketing subject such as "Confirm your spot at our webinar" counts as verification, while a genuine code email with an unusual subject in another language may be missed. The exact percentage should be treated as approximate, but the direction is not in doubt.
Codes Versus Links in Recent Mail
InboxBurn runs an automatic classifier on incoming messages to highlight codes and verification links in the inbox. Classifier labels are only available for messages still in active inboxes, so this part of the analysis uses a smaller, recent sample of about 1,880 messages.
In that sample, the classifier labelled:
- 44% as plain messages with no detected code or verification link
- 43% as containing an OTP code
- 10% as containing a verification link
- 2% as containing both a code and a link
Two observations follow. First, codes are far more common than links, roughly four to one in this sample. Many services have moved from "click this link" to "type this code", partly because codes work when the user reads mail on a different device from the one they are signing up on. Second, the share of plain messages here is higher than the subject-line analysis might suggest. Some messages with verification-like subjects contain neither a detectable code nor a link (welcome mail, for example), and the classifier is deliberately conservative.
What the codes look like
Among detected OTP codes:
- 6 digits: 67%
- 4 digits: 24%
- 5 digits: 9%
- Numeric: 100%
Six digits is the clear convention. Four-digit codes are still common, which is a security consideration for the services sending them: a shorter code needs stricter attempt limits and expiry to resist guessing. Not a single detected code contained letters. This partly reflects the classifier, which is tuned for numeric codes, so alphanumeric codes may be under-counted, but it matches what most people see in practice.
If you want to understand how these codes are generated and why they expire, see What Is OTP Verification.
Mail Arrives Around the Clock
Grouping messages by hour of arrival in UTC produces an almost flat distribution. Every hour of the day received between roughly 6,100 and 9,900 messages over the period. The busiest hour was 12:00 UTC and the quietest was 22:00 UTC.
If temporary email were used mostly in one region, you would expect a pronounced daily peak and a deep overnight trough. Instead the trough is shallow. The audience is spread across time zones, and automated senders that run at all hours flatten the curve further. For operators, this means there is no reliable quiet window: maintenance at any hour affects someone who is waiting for a code.
Messages Are Small and Predictable
Message sizes were tightly clustered:
- Median: about 31 KB
- 90th percentile: about 32.5 KB
- 99th percentile: about 89 KB
The gap between the median and the 90th percentile is tiny. Most of these messages are templated transactional emails built from the same HTML layout every time, with only the code or link changing. Large messages with attachments are rare. For anyone building a test pipeline around disposable inboxes, this means storage and parsing costs are dominated by the number of messages, not their size.
What This Means for People Using Temporary Email
The data supports a few practical conclusions.
- The main job is verification, so speed matters most. Codes often expire within minutes. Open the inbox before you request the code, and keep the tab open while you wait. If a code seems late, our guide to why verification emails arrive late explains the usual causes.
- Think about the account, not just the sign-up. A disposable address is fine for proving ownership once. It is a poor choice for any account you will need to recover later. Payment and email-provider senders appear in the data too; for services like those, losing the inbox can mean losing the account. For accounts that matter, use your real address or a forwarding alias; see disposable email vs email alias.
- Choose the lifetime deliberately. InboxBurn inboxes last from 10 minutes to 7 days, with 24 hours as the default, and Extend adds another 24 hours. A trial you plan to evaluate for a week needs a longer lifetime than a one-off download. See how long temporary emails last.
- Expect some services to refuse you. Platforms that see heavy disposable use often block known domains. That is a legitimate choice on their part; why websites block disposable email explains the reasoning.
What This Means for Services Sending Verification Mail
If you run a product that sends codes, the data is a reminder of how your mail is consumed.
- Most recipients only want the code. Put it near the top of the message and in the subject line where appropriate, so it is visible in an inbox list or notification preview.
- Six numeric digits is the norm. Users expect it, and it balances usability with resistance to guessing. If you use four digits, pair them with strict attempt limits and short expiry.
- Mail volume can spike sharply. Our monthly figures show how quickly traffic can change when a large sender changes behaviour. Receiving systems have finite capacity; sending bursts of thousands of notifications at once can delay your own verification mail along with everyone else's.
- Disposable sign-ups are not all abuse. A meaningful share of business and SaaS traffic is consistent with evaluation and testing. Teams that test their own sign-up flows can use a dedicated workflow such as the QA email testing API rather than ad hoc addresses.
Limits Worth Repeating
These figures describe one service over seven months. They are not a census of the disposable email industry, and different services with different audiences will see different sender mixes. The totals exclude purged notification mail and internal health checks, are dominated by a few bulk senders, and group traffic by sender domain rather than by company. The code and link percentages come from a recent sample and a heuristic classifier. We have tried to avoid any conclusion that depends on precision the data does not have.
Within those limits, the pattern is clear: temporary inboxes are mostly used to receive a short message that proves ownership of an address, from a wide range of services, at every hour of the day.
If you want to see what that looks like in practice, open a temporary inbox or read how disposable email works for the technical side.