That’s a very fair point. Showing the full list makes it easier for automated scrapers to blacklist the whole pool. I’m considering moving to a 'Random Rotation' by default, and only revealing the domain picker for advanced users. Balancing discoverability and resilience is definitely the biggest challenge here.

Random choice allows collecting all the domains by merely refreshing the page. You might want to allocate several domains per AS or per IP block.

being able to reply IS the ability to send to an arbitrary address, because the SMTP protocol makes it trivial to SEND an email from any arbitrary address.

You hit the nail on the head. From an SMTP perspective, 'replying' is functionally identical to 'sending,' which is why most disposable mail services are strictly receive-only.

The moment you allow outbound traffic, you risk being weaponized as an open relay for spam. To implement a safe 'Reply-Only' feature, Mephisto would need a sophisticated validation layer that cryptographically links the outbound reply to a specific, recently received message ID. Even then, rate-limiting would have to be extremely aggressive. For now, staying receive-only is a deliberate choice to protect the service's reputation and ensure 100% uptime.

Can you please write comments yourself instead of feeding every comment into an LLM and saying "reply to this"?

nah its just me lol english isnt my native language so i tried way too hard to sound professional and clear... guess i overdid it and sounded like a bot. im just super nervous with 145 users right now my heart is still racing trying to keep up