# DuckDuckGo Email Protection privacy rating

Free email alias service from DuckDuckGo that gives out @duck.com addresses and forwards mail to an existing inbox after removing email trackers.

## Summary

DuckDuckGo Email Protection scores 34 out of 100 (grade F) on the email forwarding and aliases criteria. It meets 3 of 16 criteria: no trackers or telemetry, TLS configuration and no stored mail. It partly meets open source, no ads or data sales and security headers. It does not meet independent audit, transparency report, tells users about requests, end-to-end encryption, open protocols, custom domains, sign up without personal data, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://duckduckgo.com/email/
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: none found
- Category: [Email forwarding and aliases](https://privacyratings.com/email-forwarding/)
- Also rated: [DuckDuckGo Browser](https://privacyratings.com/browsers/duckduckgo-browser/) (Browsers), [Privacy Essentials](https://privacyratings.com/browser-extensions/privacy-essentials/) (Browser extensions), [DuckDuckGo](https://privacyratings.com/search-engines/duckduckgo/) (Search engines)
- Grade: F (34/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The DuckDuckGo browser extension that creates Duck Addresses is Apache-2.0, but the forwarding service is closed source. | https://github.com/duckduckgo/duckduckgo-privacy-extension/blob/main/LICENSE.md |
| No trackers or telemetry | Yes | The privacy policy states that DuckDuckGo does not track users, and the website loads no third-party trackers. | https://duckduckgo.com/privacy |
| No ads or data sales | Partial | Email Protection is free and shows no ads. DuckDuckGo is funded by search ads based on the search query rather than user profiles. | https://duckduckgo.com/duckduckgo-help-pages/company/how-duckduckgo-makes-money |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=duckduckgo.com&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=duckduckgo.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Not supported. Forwarded mail is not encrypted end to end. |  |
| No stored mail | Yes | Mail is processed in memory to remove trackers and forwarded without being written to disk. | https://duckduckgo.com/email/privacy |
| Open protocols | No | No IMAP or SMTP access. Mail is forwarded to an existing inbox and replies go through the Duck Address. |  |
| Custom domains | No | Not supported. Addresses are on duck.com. |  |
| Sign up without personal data | No | An existing email address is required to receive forwarded mail. | https://duckduckgo.com/email/privacy |
| Email security standards | Not tested yet | Not tested yet. |  |
| Mail transport security | No | Passes: SPF, DMARC quarantine, TLS-RPT. Missing: MTA-STS missing, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-forwarding/duckduckgo-email-protection/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-forwarding/duckduckgo-email-protection.md