Primo is not a disposable email service

Last reviewed: 30 August 2026 · primoinbox.com · operated by Primo Labs LLC

Primo gives one person one real, permanent email address that they read and answer from inside WhatsApp. If you maintain a disposable-domain blocklist or an email-validation service, this page is the evidence you would otherwise have to ask us for. If you are considering using Primo, it is also an honest description of what we allow and what we do not.

The two facts that decide the question

Nobody can create an account on primoinbox.com. There is no form anywhere on this site that produces a mailbox. An account requires an activation code that an operator issues by hand from a command line: 52 random Base32 characters, single-use, time-limited, and redeemed through a compare-and-swap so a code can be spent exactly once. The public site has a waitlist form; joining it creates no mailbox and no address.

Blocklist maintainers normally ask for a screenshot of a page where a stranger can generate an address on the domain. No such page exists here, and we could not add one without abandoning the invitation model the product is built on. If you believe you have found one, send it to abuse@primoinbox.com and we will treat it as a security report.

Addresses are permanent and are never reissued. They have no expiry. When an account is deleted, its local parts — and their confusable-folded forms — are written to a table with no foreign keys, specifically so it outlives the account and the string can never be given to anyone else. That is deliberate: recycling an address is how a new holder starts receiving the previous holder's password resets. An address you collect from a Primo user today still belongs to that same person years from now.

The limits, as actually enforced

• Addresses: 4 active on a free account — one main address plus 3 per-service addresses. 100 on Pro.
• Outbound: 5 sends per UTC day on free, 10 on Pro. The cap is decided inside the database write rather than read-then-write, so concurrent requests cannot slip past it.
• Free accounts can only reply to mail they received. Composing to a stranger and forwarding are paid-only, with their own budget of 3 per day.
• 200 outbound sends per hour across the entire service, checked at execution time. One account cannot burn the domain's reputation, and neither can several.
• 3 sends per browser session, which bounds a stolen session cookie.
• Chosen names are screened for impersonation. Role words (support, billing, security, admin, refund, postmaster) and brand words (paypal, irs, zelle, netflix) are rejected as substrings after confusable folding, so adm1n, paypa1 and s.upport are rejected too.

Not a catch-all, and not a forwarder

Mail addressed to a local part we never issued, or to one its owner has switched off, is refused: Unknown or disabled recipient. The address space is not open for strangers to conjure into existence. Our MX is a shared front end, so that refusal happens when the message is delivered rather than at RCPT TO.

Mail we accept terminates here. There is no second inbox behind a Primo address: the message is stored encrypted at rest under a key derived per mailbox, and the owner reads it in WhatsApp or in a browser session minted from WhatsApp. Primo is the destination, not a relay.

Our MX records point at Cloudflare Email Routing, which is our hosting provider. Some validators classify any domain behind a forwarding-capable MX as a relay domain. That is a fact about our host, not about what happens to the mail.

Why some Primo addresses look random

An address like walmart.k6e8r@primoinbox.com is a per-service address belonging to one permanent account. The suffix exists because every Primo user shares one domain: without it, the first person to shop at a given retailer would take that retailer's name away from everyone else. Each of these is capped (3 on a free account), is never reissued, and can be switched off by its owner if that retailer leaks or sells it — which is the entire reason to use a different address per service.

Verify this without trusting us

• Try to sign up. There is no form that hands you an address.
• Send a message to a random local part at primoinbox.com and read the rejection.
• dig TXT primoinbox.com and dig TXT _dmarc.primoinbox.com — SPF, DKIM and DMARC records are published. Read the current values yourself.
• curl https://open.kickbox.com/v1/disposable/primoinbox.com
• Search the public lists directly. As of the review date above, primoinbox.com appears in neither disposable-email-domains nor wesbos/burner-email-providers. We check both automatically, every day.

Reporting abuse

abuse@primoinbox.com. Send the full Primo address, the message with its headers, and what happened. We act on spam, phishing, impersonation and fraud.

Reports reach the operator directly. Primo is run by one person, so there is no ticket queue and no published response-time target we could not honour. What we can state is the mechanism: an account can be suspended with a single operator command that takes effect immediately, with no code deployment, after which every identity, notification and session lookup refuses it.

If a website rejected your Primo address, tell us and we will contact them. We cannot promise they will change their decision.

What Primo is not

• Not anonymous. Every account is bound to a WhatsApp identity and to a code an operator issued.
• Not disposable, temporary or a burner. Addresses do not expire and are not recycled.
• Not a forwarder. No Primo address delivers to a mailbox somewhere else.
• Not a public inbox. No URL shows anyone's mail. Reading requires the account owner's WhatsApp.
• Not a cheap source of identities. Four addresses on a free account, and a new account needs a human being.

Contact

• abuse@primoinbox.com — abuse and security reports
• hello@primoinbox.com — everything else
• /.well-known/security.txt

Primo no es un servicio de correo desechable

Última revisión: 30 de agosto de 2026 · primoinbox.com · operado por Primo Labs LLC

El texto en inglés es el que prevalece.

Primo le da a una persona una dirección de correo real y permanente que lee y responde desde WhatsApp. Si administras una lista de dominios desechables o un servicio de validación de correo, esta página es la evidencia que de otro modo tendrías que pedirnos.

Los dos hechos que deciden el asunto

Nadie puede crear una cuenta en primoinbox.com. No hay ningún formulario en este sitio que genere un buzón. Una cuenta requiere un código de activación que un operador emite a mano desde una línea de comandos: 52 caracteres Base32 aleatorios, de un solo uso y con vencimiento. El sitio tiene una lista de espera; unirse a ella no crea ningún buzón ni dirección.

Las direcciones son permanentes y nunca se reasignan. No vencen. Cuando se elimina una cuenta, sus nombres locales quedan registrados en una tabla que sobrevive a la cuenta, para que esa cadena no pueda entregarse a nadie más. Reciclar una dirección es como un nuevo dueño empieza a recibir los restablecimientos de contraseña del anterior.

Los límites, tal como se aplican

• Direcciones: 4 activas en una cuenta gratuita — una principal más 3 por servicio. 100 en Pro.
• Envíos: 5 por día UTC en gratuita, 10 en Pro. El límite se decide dentro de la escritura en la base de datos.
• Las cuentas gratuitas solo pueden responder al correo que recibieron. Escribir a desconocidos y reenviar son de paga, con su propio límite de 3 por día.
• 200 envíos por hora en todo el servicio, verificados al momento de ejecutar.
• 3 envíos por sesión del navegador, lo que acota una cookie robada.
• Los nombres elegidos se filtran contra suplantación. Palabras de rol y de marca se rechazan como subcadenas tras plegar caracteres confundibles.

No es un catch-all ni un reenviador

El correo dirigido a un nombre local que nunca emitimos, o que su dueño desactivó, se rechaza. El correo que aceptamos termina aquí: se guarda cifrado con una clave derivada por buzón y su dueño lo lee en WhatsApp. Primo es el destino, no un relevo.

Reportar abuso

abuse@primoinbox.com. Envía la dirección completa de Primo, el mensaje con sus encabezados y qué ocurrió. Actuamos ante spam, phishing, suplantación y fraude. Los reportes llegan directamente al operador. Una cuenta puede suspenderse con un solo comando que surte efecto de inmediato, sin desplegar código.

Back to Primo / Volver a Primo · Privacy · Terms · Refunds