# Email forwarding and aliases privacy ratings

Services that hide a real address behind aliases or forward mail to another inbox.

| Name | Grade | Jurisdiction | Description |
| --- | --- | --- | --- |
| [Forward Email](https://privacyratings.com/email-forwarding/forward-email/) | B (86/100) | United States (Five Eyes) | Email forwarding and alias service for custom domains. Mail is forwarded in memory to existing mailboxes or webhooks, with optional OpenPGP encryption, and paid plans add SMTP sending and encrypted IMAP mailboxes. |
| [Addy](https://privacyratings.com/email-forwarding/addy/) | D (58/100) | United Kingdom (Five Eyes) | Open-source email alias service that forwards mail from unlimited aliases to real mailboxes, with optional OpenPGP encryption. Has a free plan and can be self-hosted. |
| [SimpleLogin](https://privacyratings.com/email-forwarding/simplelogin/) | D (58/100) | Switzerland | Open-source email alias service run by Proton. Creates aliases that forward to real mailboxes and lets replies go out from the alias. Can also be self-hosted. |
| [Cloudflare Email Routing](https://privacyratings.com/email-forwarding/cloudflare-email-routing/) | D (48/100) | United States (Five Eyes) | Free Cloudflare service that forwards mail sent to addresses on a custom domain to existing inboxes or to Cloudflare Workers. |
| [Hide My Email](https://privacyratings.com/email-forwarding/hide-my-email/) | D (44/100) | United States (Five Eyes) | Apple iCloud+ feature that creates random email addresses which forward to a personal inbox. Also used by Sign in with Apple. |
| [DuckDuckGo Email Protection](https://privacyratings.com/email-forwarding/duckduckgo-email-protection/) | F (34/100) | United States (Five Eyes) | Free email alias service from DuckDuckGo that gives out @duck.com addresses and forwards mail to an existing inbox after removing email trackers. |
| [ImprovMX](https://privacyratings.com/email-forwarding/improvmx/) | F (34/100) | United States (Five Eyes) | Email forwarding service for custom domains, with aliases, catch-all addresses, forwarding rules and SMTP sending on paid plans. |
| [Firefox Private Relay](https://privacyratings.com/email-forwarding/firefox-private-relay/) | F (33/100) | United States (Five Eyes) | Email masking service from Mozilla that creates aliases and forwards mail to a real inbox. Works on the web and through a Firefox add-on. |
| [33mail](https://privacyratings.com/email-forwarding/33mail/) | F (9/100) | Ireland | Email alias service that creates addresses on a personal 33mail.com subdomain or a custom domain and forwards mail to an existing inbox, with anonymous replies. |

## Criteria

- **Open source** (weight 3): Is all the source code needed to run the product public?
- **No trackers or telemetry** (weight 3): Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
- **No ads or data sales** (weight 2): Is the product funded without advertising, ad targeting or selling user data?
- **Independent audit** (weight 2): Has an independent security or privacy audit been published within the last three years?
- **Transparency report** (weight 2): Does the provider regularly publish how many government and legal requests it receives and how it responds?
- **Tells users about requests** (weight 1): Does the provider promise to tell users about requests for their data, unless a court forbids it?
- **TLS configuration** (weight 2, automated): Does the website pass the Qualys SSL Labs test with a grade of A or better?
- **Security headers** (weight 1, automated): Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
- **Modern web standards** (weight 1, automated): Does the website score 90% or higher on the Internet.nl website test?
- **End-to-end encryption** (weight 2): Can mail be end-to-end encrypted so that the provider cannot read message contents?
- **No stored mail** (weight 3): Is forwarded mail passed through without being written to disk?
- **Open protocols** (weight 2): Can any standard app connect over IMAP, POP3, SMTP, CalDAV or CardDAV, without extra software?
- **Custom domains** (weight 1): Can mail be sent and received with your own domain?
- **Sign up without personal data** (weight 2): Can an account be created without a phone number or another email address?
- **Email security standards** (weight 2, automated): Does the mail domain score 90% or higher on the Internet.nl email test?
- **Mail transport security** (weight 3, automated): Does the mail domain enforce encrypted, authenticated delivery with MTA-STS, DANE, DNSSEC, TLS-RPT and an enforced DMARC policy?
- **Sender Rewriting Scheme** (weight 2): Is the envelope sender rewritten with SRS when mail is forwarded, so forwarded mail keeps passing SPF?
- **ARC sealing** (weight 1): Does the provider validate and add ARC (RFC 8617) signatures, so authentication results survive forwarding?

Source: https://privacyratings.com/email-forwarding/