Private and open-source alternatives to Outlook.com
15 email providers rated against the same public privacy criteria as Outlook.com, with our picks first.
Why look for an alternative?
- Open source: no. Closed source.
- No trackers or telemetry: no. Microsoft collects usage and diagnostic data and uses data about users for personalized advertising.
- No ads or data sales: no. The free service shows ads.
- Independent audit: no. No independent audit of Outlook.com is published.
- Security headers: partial. Grade B+ (80/100+)
- End-to-end encryption: no. No end-to-end encryption. The Encrypt option for Microsoft 365 subscribers uses keys Microsoft holds.
- Encrypted mailbox storage: partial. Data is encrypted at rest with keys Microsoft holds.
- Custom domains: partial. Custom domains are supported through Microsoft 365 business plans, not free Outlook.com accounts.
- Sign up without personal data: no. Creating a Microsoft account asks for personal data such as a birthdate, and a phone number may be requested for verification.
- SMTP submission: partial. smtp-mail.outlook.com:587 (STARTTLS). SMTPUTF8, 8BITMIME, PIPELINING and AUTH advertised.
- Mail transport security: no. Passes: SPF, MTA-STS enforce, TLS-RPT, DNSSEC. Missing: DMARC none, DANE none.
- Sender Rewriting Scheme: no. Microsoft documents SRS for Microsoft 365 business mail, not for Outlook.com.
- ARC sealing: no. No published documentation on ARC for Outlook.com. Microsoft's ARC documentation covers Microsoft 365 business mail.
See the full Outlook.com rating.
The alternatives
Forward Email Grade A Our pick
Open-source email service with encrypted mailboxes, custom domains, and IMAP, POP3, SMTP, CalDAV and CardDAV on every paid plan.
Why it is our pick: The whole service is published on GitHub, server code included. Each mailbox is a separately encrypted SQLite file, IMAP, POP3, SMTP, CalDAV and CardDAV work with any app, and custom domains are included on low-cost plans.
Based in the United States (Five Eyes). Forward Email scores 93 out of 100 (grade A) on the email providers criteria. It meets 17 of 19 criteria: open source, no ads or data sales, independent audit, tells users about requests, TLS configuration, security headers, end-to-end encryption, encrypted mailbox storage, open protocols, custom domains, sign up without personal data, IMAP support, POP3 support, SMTP submission, mail transport security, Sender Rewriting Scheme and ARC sealing.
mailbox.org Grade C
Paid email, calendar and office service from Berlin, Germany, with built-in PGP encryption and support for custom domains.
Based in Germany (Fourteen Eyes). mailbox.org scores 70 out of 100 (grade C) on the email providers criteria. It meets 11 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, security headers, open protocols, custom domains, sign up without personal data, IMAP support, POP3 support and mail transport security.
StartMail Grade C
Paid email service from the Netherlands with built-in PGP encryption, unlimited aliases and custom domains.
Based in the Netherlands (Nine Eyes). StartMail scores 66 out of 100 (grade C) on the email providers criteria. It meets 10 of 19 criteria: no ads or data sales, transparency report, TLS configuration, encrypted mailbox storage, open protocols, custom domains, sign up without personal data, IMAP support, SMTP submission and mail transport security.
Kolab Now Grade C
Paid email and groupware service from Apheleia IT in Switzerland, built on the open-source Kolab platform, with calendars, contacts, files and video calls.
Based in Switzerland. Kolab Now scores 64 out of 100 (grade C) on the email providers criteria. It meets 10 of 19 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support, POP3 support, SMTP submission and mail transport security.
Proton Mail Grade C
End-to-end encrypted email service from Switzerland, with apps for web, Android, iOS and desktop.
Based in Switzerland. Proton Mail scores 64 out of 100 (grade C) on the email providers criteria. It meets 8 of 19 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, end-to-end encryption, encrypted mailbox storage, custom domains and mail transport security.
CounterMail Grade C
Paid email service in Sweden that encrypts mail with OpenPGP and stores it encrypted. New registrations are closed.
Based in Sweden (Fourteen Eyes). CounterMail scores 62 out of 100 (grade C) on the email providers criteria. It meets 9 of 19 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, end-to-end encryption, encrypted mailbox storage, open protocols, custom domains, sign up without personal data and IMAP support.
Posteo Grade C
Paid, ad-free email service from Germany that runs without collecting names or addresses and accepts anonymous payment.
Based in Germany (Fourteen Eyes). Posteo scores 62 out of 100 (grade C) on the email providers criteria. It meets 9 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, encrypted mailbox storage, open protocols, sign up without personal data, IMAP support and POP3 support.
Tuta Grade C
End-to-end encrypted email and calendar service from Germany, with open-source apps for web, desktop and mobile.
Based in Germany (Fourteen Eyes). Tuta scores 61 out of 100 (grade C) on the email providers criteria. It meets 9 of 18 criteria: no trackers or telemetry, no ads or data sales, transparency report, security headers, end-to-end encryption, encrypted mailbox storage, custom domains, sign up without personal data and mail transport security.
Disroot Grade D
Volunteer-run platform from the Netherlands offering email and other open services.
Based in the Netherlands (Nine Eyes). Disroot scores 59 out of 100 (grade D) on the email providers criteria. It meets 9 of 19 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support, POP3 support and mail transport security.
Riseup Grade D
Email, mailing list and VPN service run by an autonomous tech collective in Seattle for activists and social movements. Accounts need an invite, and the service is funded by donations.
Based in the United States (Five Eyes). Riseup scores 59 out of 100 (grade D) on the email providers criteria. It meets 9 of 19 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, encrypted mailbox storage, open protocols, sign up without personal data, IMAP support, POP3 support and SMTP submission.
Purelymail Grade D
Low-cost email hosting from the United States with custom domains, standard protocols and mail stored encrypted with the user's password.
Based in the United States (Five Eyes). Purelymail scores 55 out of 100 (grade D) on the email providers criteria. It meets 8 of 19 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, encrypted mailbox storage, open protocols, custom domains, sign up without personal data and IMAP support.
Mailfence Grade D
Email service from Belgium with built-in OpenPGP encryption and signing, plus calendar, contacts and document storage.
Based in Belgium (Fourteen Eyes). Mailfence scores 54 out of 100 (grade D) on the email providers criteria. It meets 8 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, custom domains, IMAP support, POP3 support and mail transport security.
Infomaniak Mail Grade D
Email service from Swiss company Infomaniak, with free ik.me addresses and paid hosting for custom domains, plus web and mobile apps.
Based in Switzerland. Infomaniak Mail scores 53 out of 100 (grade D) on the email providers criteria. It meets 6 of 19 criteria: no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support and POP3 support.
Fastmail Grade D
Paid email service from Australia with custom domains and standard protocols.
Based in Australia (Five Eyes). Fastmail scores 50 out of 100 (grade D) on the email providers criteria. It meets 9 of 19 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, open protocols, custom domains, IMAP support, POP3 support and ARC sealing.
Runbox Grade D
Paid email service from Norway with custom domain hosting, standard protocols and an open-source webmail app.
Based in Norway (Nine Eyes). Runbox scores 49 out of 100 (grade D) on the email providers criteria. It meets 7 of 18 criteria: no trackers or telemetry, no ads or data sales, transparency report, open protocols, custom domains, IMAP support and POP3 support.