System Design: Disposable Email Service with Expiring Inboxes

Context

Design a production-grade disposable/temporary email service for web/mobile clients. Anonymous users can create randomized inbox addresses that auto-expire after a configurable TTL (e.g., 10–60 minutes). The service must receive messages via SMTP (including attachments) and expose a simple UI/API to view messages before expiry.

Requirements

Design the system to cover:

1. High-level architecture
   • DNS/MX records and Mail Transfer Agent (MTA)
   • SMTP ingress and acceptance policy
   • Message pipeline (parsing, scanning, storage)
   • Storage layers (metadata and blobs)
2. Data model and indexing for inboxes, messages, attachments
3. Address generation, TTL, and cleanup/GC
4. Spam filtering and abuse controls
   • Rate limiting, blocklists, greylisting, CAPTCHAs/PoW
5. Attachment handling and size limits
6. Privacy and data retention policies
7. Multi-tenant domains (e.g., multiple receiving domains/brands)
8. Observability (metrics, logs, tracing, SLOs)
9. Scaling and cost considerations
10. Key APIs
    • Create/refresh inbox, fetch messages/attachments
11. Consistency and durability trade-offs
12. Mitigations for hot inboxes and denial-of-service attacks

State assumptions if needed and justify key trade-offs.