Maildrop alternative: GrabMail vs Maildrop

At a glance

Fourteen rows. Every Maildrop cell is what its home page, how-it-works page, privacy page and developer documentation said on 2 September 2026; every GrabMail cell is read from the constants the service enforces. “Partly” means a caveat the row cannot hold — the sections below say which.

Checked 2 September 2026. Maildrop’s documentation says authentication “currently” is not required and that a bearer token may be introduced if rate limiting proves insufficient. Its dedicated clusters are offered by inquiry with no published price. Where a figure is not published, the cell says so.

What Maildrop does well

Maildrop is run by a spam-filtering company, and it shows. Four things it does that GrabMail does not:

• Filtering at the door. Greylisting plus Heluna’s filters, which its site says cut spam by more than ninety percent, so a Maildrop inbox stays quiet. GrabMail accepts what arrives and lets you delete it.
• One GraphQL query for everything. Inbox, message, delete, alias, statistics and status through one endpoint with a documented schema — a shape that suits a front end talking to it directly. GrabMail is three REST paths.
• Documentation a model can read. An llms.txt and a Markdown twin of every docs page. GrabMail has an llms.txt too, and no MCP-free equivalent of Maildrop’s per-page Markdown.
• Honesty about itself. “Maildrop is designed for no security. Maildrop is designed for little to no privacy.” Its limits and its rate limits are written down in numbers, which is rarer than it should be.

Where GrabMail is different

GrabMail keeps Maildrop’s openness and removes the four limits that stop it being useful for a test suite or a trial.

• Attachments arrive. Maildrop strips every attachment and refuses bodies over 500k. GrabMail delivers up to 5 MB per message, downloadable from the page and the API. A PDF receipt or a signed document is readable here and gone there.
• 5 days, and no ten-message cap. A Maildrop inbox is wiped after a day without a new message and holds ten at most, oldest out first. A GrabMail mailbox keeps every message 5 days, however many arrive and however quiet it goes in between.
• Your own domain, free. Maildrop offers maildrop.cc and nothing else. Here one MX record at smtp.grabmail.io turns any domain into a catch-all inbox, unlimited — the fix for sign-up forms that refuse a known disposable domain.
• An MCP server and a per-address limit. An agent opens an inbox at https://grabmail.io/mcp and waits up to 25 seconds for a message with nothing to sign up for. And the rate limit is one read a second per address, so polling twenty mailboxes is twenty reads a second, not a shared budget of fifty queries per ten seconds.

Price, side by side

There is little to price: Maildrop is free and sells only dedicated clusters, by inquiry, at an unpublished price. GrabMail’s only paid plan buys access to a pool of domains kept off the disposable-mail blocklists; everything in the table above stays free.

As published on 2 September 2026. GrabMail’s pricing page has the full grid.

For developers: reading a mailbox

The whole difference in one command. This reads a GrabMail mailbox with no header, no key and no account:

$ curl -sG https://grabmail.io/api/v1/mailbox --data-urlencode "address=anything@grabmail.io" | jq '{count, alias}'

The Maildrop equivalent is a POST to api.maildrop.cc/graphql with Content-Type: application/json and the query { inbox(mailbox: "name") { id subject } } — as keyless as this one, GraphQL-shaped, and rate-limited at 50 queries per ten seconds for your client as a whole. GrabMail’s reference is three REST endpoints; the Python and Node.js guides show the wait loop with a deadline.

The habit carries over exactly: on both, an address is a name you typed, so a suite that builds run-{id}@ addresses works unchanged. Check the attachment row before you move a test that reads a file, and the retention row before you move one that runs overnight — in both directions.

For AI agents

Maildrop publishes no MCP server, but its keyless GraphQL API and its llms.txt make it usable by an agent that can write a query. GrabMail’s server at https://grabmail.io/mcp removes even that: create_inbox, a blocking wait_for_message of up to 25 seconds, read_message.

Email for AI agents covers the four-call loop and the guard rails; the client guide has the configuration for Claude, Cursor and five others.

Switching from Maildrop

Both are keyless and public, so the switch is the domain and the query shape:

1. Keep your names, change the domain. name@maildrop.cc becomes name@grabmail.io, or any name on a domain of yours with its MX at smtp.grabmail.io.
2. Turn the GraphQL query into a GET. inbox(mailbox:) becomes GET /api/v1/mailbox?address=…; message(mailbox:, id:) becomes GET /api/v1/message/{id}?mailbox=…; delete becomes a DELETE on the same path.
3. Relax the polling interval. Maildrop asks for ten seconds between queries; GrabMail expects one second per address. Drop the shared back-off you wrote for the 50-per-ten-seconds meter.
4. Use the alias the same way. Both give each mailbox an alias that delivers to it and cannot open it. Hand out the alias; keep the address.

Which one, for what

The honest split:

When to stay with Maildrop

Three situations where switching would cost you something real:

• Spam is your problem. Maildrop’s greylisting and filters are a real service; GrabMail filters nothing. An address that is going to be harvested is quieter there.
• Your front end queries it directly. A React app using Maildrop’s GraphQL schema with Apollo has no equivalent here; it would become three fetch calls.
• You want it to forget fast. Ten messages and a 24-hour wipe is a smaller surface than 5 days of mail on a public address. If less is what you want, Maildrop has less.

Questions