{
  "slug": "zoho-mail",
  "category": "email-providers",
  "name": "Zoho Mail",
  "description": "Email service from Zoho for businesses and individuals, with custom domains, calendar and contacts, and an ad-free free plan.",
  "website": "https://www.zoho.com/mail/",
  "license": null,
  "platforms": [],
  "jurisdiction": {
    "code": "IN",
    "name": "India",
    "eyes": null,
    "eu": false,
    "gdpr": false,
    "cloud_act": null
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "D",
  "score": 45,
  "coverage": 100,
  "summary": "Zoho Mail scores 45 out of 100 (grade D) on the email providers criteria. It meets 7 of 19 criteria: no ads or data sales, TLS configuration, security headers, open protocols, custom domains, IMAP support and POP3 support. It partly meets no trackers or telemetry, end-to-end encryption, encrypted mailbox storage and SMTP submission. It does not meet open source, independent audit, transparency report, tells users about requests, sign up without personal data, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in India: Not in the Five, Nine or Fourteen Eyes. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.",
  "url": "https://privacyratings.com/email-providers/zoho-mail/",
  "markdown": "https://privacyratings.com/email-providers/zoho-mail/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "partial",
      "evidence": "https://www.zoho.com/privacy.html",
      "note": "Zoho states it blocks non-essential third-party cookies on its sites and mostly uses first-party cookies for analytics."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.zoho.com/privacy.html",
      "note": "Funded by paid plans. Zoho states that it never shows ads or sells data, including on free plans."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No independent audit is published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No transparency report or government request policy is published."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=mail.zoho.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "yes",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=mail.zoho.com",
      "note": "Grade A+ (110/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    },
    "e2ee": {
      "title": "End-to-end encryption",
      "weight": 3,
      "answer": "partial",
      "evidence": "https://www.zoho.com/mail/secure-email.html",
      "note": "S/MIME and OpenPGP encryption are available but not on by default."
    },
    "encrypted_storage": {
      "title": "Encrypted mailbox storage",
      "weight": 3,
      "answer": "partial",
      "evidence": "https://www.zoho.com/mail/secure-email.html",
      "note": "Mail is encrypted at rest with keys Zoho holds."
    },
    "open_protocols": {
      "title": "Open protocols",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.zoho.com/mail/help/imap-access.html",
      "note": "IMAP, POP3 and SMTP work on paid plans. New free accounts have no IMAP or POP3."
    },
    "custom_domains": {
      "title": "Custom domains",
      "weight": 1,
      "answer": "yes",
      "evidence": "https://www.zoho.com/mail/zohomail-pricing.html",
      "note": "Available on every plan, including the free one."
    },
    "anonymous_signup": {
      "title": "Sign up without personal data",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.zoho.com/privacy.html",
      "note": "Sign-up asks for a name, contact number and email address."
    },
    "mail_standards": {
      "title": "Email security standards",
      "weight": 2,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    },
    "imap_standards": {
      "title": "IMAP support",
      "weight": 2,
      "answer": "yes",
      "evidence": null,
      "note": "imap.zoho.com:993 (implicit TLS). IMAP4rev1 advertised with IDLE."
    },
    "pop3_standards": {
      "title": "POP3 support",
      "weight": 1,
      "answer": "yes",
      "evidence": null,
      "note": "pop.zoho.com:995 (implicit TLS). CAPA: USER, TOP, UIDL, SASL."
    },
    "smtp_standards": {
      "title": "SMTP submission",
      "weight": 2,
      "answer": "partial",
      "evidence": null,
      "note": "smtp.zoho.com:465 (implicit TLS). Missing: SMTPUTF8, 8BITMIME, PIPELINING."
    },
    "transport_security": {
      "title": "Mail transport security",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Passes: SPF, DMARC reject, TLS-RPT. Missing: MTA-STS missing, DNSSEC, DANE none."
    },
    "srs": {
      "title": "Sender Rewriting Scheme",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published documentation on SRS for forwarded mail."
    },
    "arc": {
      "title": "ARC sealing",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published documentation on ARC signing or validation."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "A+",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [],
    "tested_at": "2026-10-01T11:00:22.988Z"
  },
  "last_modified": "2026-10-01T11:14:42Z"
}