Email forwarding and aliases
ImprovMX privacy rating
Email forwarding service for custom domains, with aliases, catch-all addresses, forwarding rules and SMTP sending on paid plans.
Summary
ImprovMX scores 34 out of 100 (grade F) on the email forwarding and aliases criteria. It meets 4 of 15 criteria: no ads or data sales, TLS configuration, custom domains and Sender Rewriting Scheme. It partly meets no stored mail, open protocols and ARC sealing. It does not meet open source, no trackers or telemetry, independent audit, transparency report, tells users about requests, security headers, end-to-end encryption and sign up without personal data. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade D-.
Score 34 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The website loads the Intercom chat widget, and the privacy policy describes receiving data from advertising networks such as Google and LinkedIn.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans. The privacy policy states that personal information is not sold.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published. Annual penetration tests are described, but no report is public.
-
No
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
No transparency report or government request policy is published.
-
No
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
No published policy on notifying users about data requests.
-
No
End-to-end encryption Weight 2 of 3
Can mail be end-to-end encrypted so that the provider cannot read message contents?
Not supported. Forwarded mail is not encrypted end to end.
-
Partial
No stored mail Weight 3 of 3
Is forwarded mail passed through without being written to disk?
Mail is stored temporarily for delivery and then deleted. Undelivered mail is kept when the full log level is chosen.
-
Partial
Open protocols Weight 2 of 3
Can any standard app connect over IMAP, POP3, SMTP, CalDAV or CardDAV, without extra software?
SMTP sending is included on paid plans. There is no IMAP or POP3 because mail is forwarded to another mailbox.
-
Yes
Custom domains Weight 1 of 3
Can mail be sent and received with your own domain?
Works with custom domains on every plan, including the free one.
-
No
Sign up without personal data Weight 2 of 3
Can an account be created without a phone number or another email address?
An existing email address is required to create an account and receive forwarded mail.
-
Yes
Sender Rewriting Scheme Weight 2 of 3
Is the envelope sender rewritten with SRS when mail is forwarded, so forwarded mail keeps passing SPF?
The envelope sender of forwarded mail is rewritten to a domain ImprovMX controls.
-
Partial
ARC sealing Weight 1 of 3
Does the provider validate and add ARC (RFC 8617) signatures, so authentication results survive forwarding?
Forwarded mail is ARC signed, but inbound ARC chains are not validated.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A
-
No
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade D- (25/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.
-
Not tested yet
Mail transport security Weight 3 of 3
Does the mail domain enforce encrypted, authenticated delivery with MTA-STS, DANE, DNSSEC, TLS-RPT and an enforced DMARC policy?
Not tested yet.