# AT&T Mail privacy rating

Free, ad-supported email service from AT&T for att.net and currently.com addresses and legacy sbcglobal.net, bellsouth.net and ameritech.net accounts. It runs on Yahoo Mail. A paid Yahoo Mail Plus plan removes ads.

## Summary

AT&T Mail scores 27 out of 100 (grade F) on the email providers criteria. It meets 5 of 19 criteria: transparency report, TLS configuration, open protocols, IMAP support and POP3 support. It partly meets SMTP submission. It does not meet open source, no trackers or telemetry, no ads or data sales, independent audit, tells users about requests, security headers, end-to-end encryption, encrypted mailbox storage, custom domains, sign up without personal data and mail transport security. Still needing evidence: Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade D+.

- Website: https://more.att.com/email/
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Android, iOS
- Home page trackers: Google Tag Manager
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: F (27/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The AT&T Mail page loads Google Tag Manager and Adobe tags, and the AT&T privacy notice allows cookies and advertising identifiers for tracking. | https://about.att.com/privacy/privacy-notice.html |
| No ads or data sales | No | The free service shows ads. Yahoo Mail Plus is described as the ad-free version of AT&T Mail. | https://www.att.com/support/article/email-support/KM1482119/ |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Yes | AT&T publishes counts of government demands and how they were answered. The report does not list email separately. | https://sustainability.att.com/reports/transparency-report |
| Tells users about requests | No | Neither the AT&T privacy notice nor the transparency report promises to notify users about data requests. |  |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=more.att.com&hideResults=on |
| Security headers | No | Grade D+ (40/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=more.att.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Not supported. |  |
| Encrypted mailbox storage | No | Encryption at rest for stored mail is not documented. |  |
| Open protocols | Yes | IMAP, POP3 and SMTP work with other apps. Apps without OAuth sign-in need a secure mail key instead of the password. | https://www.att.com/support/article/smb-email-support/KM1010523 |
| Custom domains | No | Not supported. New addresses use the att.net or currently.com domains. | https://more.att.com/email/ |
| Sign up without personal data | No | Sign-up requires a wireless number that receives a confirmation code by text, a ZIP code and security questions. | https://www.att.com/support/article/email-support/KM1232207/ |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | imap.mail.att.net:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | inbound.att.net:995 (implicit TLS). CAPA: IMPLEMENTATION, EXPIRE-NEVER, PIPELINING, RESP-CODES, TOP, UIDL, USER, SASL. |  |
| SMTP submission | Partial | smtp.mail.att.net:465 (implicit TLS). Missing: SMTPUTF8. |  |
| Mail transport security | No | Passes: SPF, DMARC quarantine. Missing: MTA-STS missing, TLS-RPT, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | Unknown |  |  |
| ARC sealing | Unknown |  |  |

AT&T Mail accounts are [Yahoo Mail accounts provided through AT&T](https://help.yahoo.com/kb/account/partner-support-article-sln25426.html), and the mobile app is the [Yahoo Mail app](https://more.att.com/attmail/att-yahoo-mail-app). AT&T and Yahoo each have a [privacy policy](https://legal.yahoo.com/us/en/att/privacy/index.html) that applies to the service.

Source: https://privacyratings.com/email-providers/at-t-mail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/at-t-mail.md