MachineMail vs OpenMail

Both give AI agents their own inboxes through an API. MachineMail checks every inbound message before the agent reads it and includes a free custom domain. OpenMail keeps data in the EU on every plan. Where each is ahead, with sources.

MachineMail and OpenMail both give an AI agent an email address of its own through an API, with threads, webhooks, a hosted MCP server and a CLI. The difference is what happens when a message arrives. MachineMail computes a trust report for every inbound message before it is stored or announced, holds suspicious mail back, and gives the agent a cleaned-up trust.content.text to read. OpenMail decides who may write to an inbox with address-based sender rules and delivers everything that passes them as it came.

Facts about OpenMail come from its public pages and docs, checked on 4 November 2026. Each one links to its source. OpenMail ships often, so check its docs for anything newer.

In short

Pick MachineMail if your agents act on the mail they receive: sign-up and one-time-code flows, support inboxes, agents that reply on their own. You get a trust level on every message before the agent sees it, quarantine for phishing and injected instructions, agent-safe text, a wait_for_message tool for codes and links, inboxes that expire on their own, catch-all domains, agents that register themselves, and one custom domain on the Free plan. Prices are in US dollars.
Pick OpenMail if your data must stay in the EU on every plan, including Free, or if you want pre-parsed attachment text (PDFs, Office files and OCR of images) in the delivery event, WebSocket delivery with replay and a webhook fallback, a spend cap on usage billing, or a plugin for OpenClaw or Hermes. Prices are in euros.
Not sure? Ask what your agent does with an email it did not expect. If the answer is “reads it and acts”, you want the mail checked first. That is what MachineMail is built around, on every plan.

Side by side

	MachineMail	OpenMail
When inbound mail is checked	A trust report is computed for every inbound message before it is stored and before any event fires. On every plan.	Sender rules are evaluated “server-side, before delivery”: mail from a blocked or non-allowlisted address is dropped and never stored. Mail that passes is delivered as received. No content check is documented. Source
Suspicious mail	Gets the `QUARANTINE` label instead of `INBOX` and a `message.received.quarantined` event. Lists leave it out unless you ask with `include_quarantine`, search never returns it, and a person reviews it in the dashboard.	There is no quarantine: denied mail is dropped with “no bounce or notification” and “there is no quarantine view”. Mail from an allowed address is not screened for phishing or injected instructions. Source
Sender rules	Allow and block lists at the organization, pod and inbox level feed the trust report, so a listed sender raises or lowers the level instead of silently vanishing. Blocked mail is still recorded.	Allow and block rules at account, pod and inbox level, address-based only: “no wildcards or regular expressions” and “no filtering on subject, body content, or attachment type”. An agent “cannot change the rules that apply to it, and cannot see them either”. Append-only audit log. Source
Text for the model	`trust.content.text` holds only the sender’s new words. Quoted history, signatures, disclaimers, text hidden from human readers and invisible Unicode are removed. The raw `text` and `html` are kept as received.	The message has `bodyText` and `bodyHtml` as received. No cleaned or trust-annotated text field is documented. OpenMail’s own advice is to “treat everything inside the email as data, not instructions”. Source
Sender authentication	SPF, DKIM and DMARC alignment are part of every trust report, with the reasons listed, so an agent can require `verified` for a sign-in link.	Per-message authentication results are not in the documented message fields. The raw RFC 822 message is available for download. Source
Attachments	Every attachment gets a `risk` of low, medium or high with reasons. `extracted_text` is filled for text, CSV, Markdown, calendar, JSON and HTML files. PDF and Office extraction is not yet available. Attachments	Each inbound attachment carries `parsedText`: PDFs, scanned documents and photos through OCR, Word, Excel, PowerPoint, CSV and text, up to 50,000 characters, files over 10 MB skipped. Source
Hosted MCP server	16 tools at `https://mcp.machinemail.dev/mcp`, built for mail an agent did not ask for: read tools return the agent-safe text inside an untrusted-content notice and leave quarantined mail out. Tools	19 tools at `https://mcp.openmail.sh/mcp`, with OAuth consent per scope, read-only and single-inbox variants, and a listing in the ChatGPT plugin directory. `list_unread_threads` filters out “spam, marketing, bounces, and machine-generated mail”. Source
Waiting for mail in MCP	`wait_for_message` blocks for up to 60 seconds until new mail arrives: sign-up codes, magic links, confirmations. Quarantined and spam mail never wake it.	No wait tool. The Claude Code skill polls: “Inbound mail does not wake Claude Code on its own.” Source
Realtime delivery	Signed webhooks with retries over five days, a delivery log, replay and test sends. A WebSocket at `/v0/ws`. Server-Sent Events at `/v0/events/stream` that resume from `Last-Event-ID`. MCP Events for received, delivered and bounced.	WebSocket at `wss://api.openmail.sh/v1/ws`, “the recommended delivery method for agents”, with up to 100 events replayed from `last_event_id` and a fallback to the webhook when the socket is down. Webhooks are HMAC-signed and retried 5 times over about 7 minutes. No SSE. Source, webhooks
Agent self sign-up	An agent follows auth.md and gets a sandbox inbox on machinemail.dev right away, with a 24-hour TTL and 10 messages a day. A person claims it with a six-digit code.	“There is no agent self-signup yet.” A developer creates the key in the console. Source
Free addresses	Unlimited inboxes on every plan, free, on machinemail.dev (up to 1,000 per organization) or your own domain.	Addresses on `omail.sh`. Free plan: 3 inboxes, a hard cap. Pro: 10 included, then €1 an inbox a month. Source
Custom domains	One custom domain on the Free plan, 10 on Pro, 50 on Team, 250 on Scale. Pricing	None on Free: “Custom domains require Pro or above”. Source
Short-lived inboxes	Per-inbox `ttl_seconds`. New mail extends the deadline. On expiry the inbox and its mail are deleted and `inbox.expired` fires. Inboxes	Not in the docs we checked. Inboxes persist until deleted; trashed mail is removed after 30 days. Source
Catch-all domains	Opt in per verified domain with `catch_all`. Mail to an unknown address on it creates the inbox, with `catch_all_ttl_seconds` if you want it to expire. Domains	Not in the docs we checked. Source
API and SDKs	Serves AgentMail’s `/v0` paths and field names, so the AgentMail TypeScript SDK works with a different `baseUrl`. No SDK of its own. A CLI. Labels, search, drafts, threads and forwarding in the API.	Its own REST API with 47 operations, no published SDK (“REST + CLI, no SDK yet”), and a CLI. Drafts, labels and search are not in the docs we checked. Source, API
Scoped API keys	Keys scoped to an organization, a pod or a single inbox; out-of-scope resources answer 404. API keys	Keys scoped to the account, a pod or an inbox, up to 20 a scope. An inbox key “cannot read or change the inbox’s sender rules”. Source
Data region and compliance	Data is stored in the US. No certifications.	“All plans are hosted in the EU.” SOC 2 “in progress”. Source, SOC 2
Published pricing	Free at $0 with 3,000 messages a month, then $9, $49 and $199 a month. Inboxes are free on every plan and Free includes a custom domain. Pricing	Free at €0 with 3 inboxes and 3,000 emails a month, Pro at €9 a month plus usage (10 inboxes, 10,000 emails, then €0.001 an email) with a spend cap, Enterprise on request. Source

What MachineMail does differently

A trust report before delivery

Every inbound message gets a trust report before it is stored, before any webhook or event fires, and before an agent can read it. The report gives one of five levels: verified, known, unknown, suspicious or quarantined. It combines SPF, DKIM and DMARC alignment, prior correspondence, your allow and block lists, link and attachment checks, hidden-text detection and a classifier for spam, phishing and instructions aimed at the agent, and it lists every reason it used. OpenMail’s sender rules decide who may write to an inbox. They do not look at what was written. See the trust report.

Quarantine instead of a silent drop

OpenMail drops denied mail and keeps no record an agent can see. MachineMail keeps the message, labels it QUARANTINE, fires message.received.quarantined, and keeps it out of lists, search, MCP reads, wait_for_message and MCP Events. A person reviews it in the dashboard. Mail from an address you never listed is still checked, which is where phishing and injected instructions come from.

Agent-safe text

trust.content.text is what the model should read: the sender’s new words, without quoted history, signatures, footers, text hidden from human readers or invisible Unicode. The raw text and html stay exactly as received. OpenMail gives the agent bodyText as received and advises treating it as data. See content analysis and using trust in agents.

wait_for_message long-polls for up to 60 seconds, so an agent that just requested a one-time code gets it in the same tool call, and a quarantined message never wakes it. Agents can also register themselves through auth.md and work in a sandbox inbox until a person claims them. OpenMail has no wait tool and no agent self-signup yet.

Inboxes that come and go, on your domain

Give an inbox a ttl_seconds and it deletes itself, mail and all, when nothing new arrives. Turn on catch_all for one of your verified domains and any address on it works, with the inbox created on first delivery. The Free plan includes one custom domain, so none of this waits for a paid plan.

Where OpenMail is ahead

These are real gaps. If one of them is a requirement for you, OpenMail is the better choice today.

EU data residency on every plan. OpenMail runs its API, database and attachment storage in the EU and says so for the Free plan too. MachineMail stores data in the US. Source, privacy
Attachment text in the event. Inbound attachments arrive with parsedText pulled from PDFs, Office files, CSVs and images through OCR. MachineMail extracts text from text-like files only, and not yet from PDFs or Office documents. Source
WebSocket replay with webhook fallback. An agent reconnects with last_event_id and gets up to 100 missed events; when the socket is down, events go to the webhook. MachineMail’s WebSocket does not replay, though its SSE stream and MCP Events do. Source
Spend management. Pro usage has a spend cap with alerts at 80 and 100 percent of it and an optional auto-pause. MachineMail has no spend cap setting. Source
Chat-agent plugins. First-party channel plugins for OpenClaw and Hermes, a skill for Claude Code, Cursor and Codex, and documented LangChain, Vercel AI SDK, n8n and Make setups. Source, integrations
Outbound guard rails. Per-inbox cold-outreach caps that warm up over time, a reputation state per inbox, and a CLI that refuses a second --to “so an agent can’t spray”. MachineMail has no cold-outreach warm-up. Source, CLI
More MCP tools and a ChatGPT listing. 19 tools, read-only and per-inbox server variants, and a place in the ChatGPT plugin directory. MachineMail’s 16 tools cover mail only. Source
A startup program. €500 in usage credit and six months of Pro for early-stage startups. Source

Switching from OpenMail

The two APIs are not compatible, so this is a small rewrite of your client rather than a base URL change. Threads and history do not transfer.

Get an API key. Sign up at machinemail.dev/signup and copy the key the dashboard shows. Keys start with mm_live_. An agent can also register itself through auth.md.
Create inboxes. POST /v0/inboxes with a username and, if you like, a ttl_seconds. Addresses on machinemail.dev are free and need no DNS. To keep your omail.sh-style setup on your own domain, add the domain under Domains; the Free plan includes one.
Map the calls. OpenMail’s POST /v1/inboxes, GET /v1/inboxes/{id}/threads and POST /v1/messages become POST /v0/inboxes, GET /v0/inboxes/{id}/threads and POST /v0/inboxes/{id}/messages/send. Replies are POST /v0/inboxes/{id}/messages/{id}/reply. The API reference lists every endpoint, and the AgentMail TypeScript SDK works against it if you prefer a client library.
Move sender rules to allow and block lists. MachineMail’s lists live at the organization, pod and inbox level too. A listed sender changes the trust level rather than dropping the message, so keep the lists and add a rule in your agent: act on verified and known, read unknown, leave suspicious and quarantined to a person.
Rewire events. Point your handler at message.received, verify X-MachineMail-Signature: t=<unix>,v1=<hex> (HMAC-SHA256 of <t>.<raw body> with the webhook’s secret), and read trust.content.text. If you were on OpenMail’s WebSocket, connect to /v0/ws or /v0/events/stream. See realtime events and Verify webhook signatures.
Change error handling. Error bodies are {"error": {"type", "message", "param"}}, not OpenMail’s {"error": "code", "message"}. Read error.type, for example not_found, validation or rate_limited. See Errors.
Read trust before acting. Have your agent act on trust.level and read trust.content.text. See using trust in agents.

Sources

OpenMail pages, all checked on 4 November 2026:

MachineMail facts come from the MachineMail docs and were checked against the code the same day.