# Fastmail privacy rating

Paid email service from Australia with custom domains and standard protocols.

## Summary

Fastmail scores 50 out of 100 (grade D) on the email providers criteria. It meets 9 of 19 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, open protocols, custom domains, IMAP support, POP3 support and ARC sealing. It partly meets security headers, encrypted mailbox storage, sign up without personal data, SMTP submission and Sender Rewriting Scheme. It does not meet open source, no trackers or telemetry, independent audit, end-to-end encryption and mail transport security. It is based in Australia: Five Eyes member; CLOUD Act data access agreement with the US. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://www.fastmail.com
- Jurisdiction: Australia. Five Eyes member. CLOUD Act data access agreement with the US.
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The marketing website uses third-party marketing cookies, including PartnerStack, to measure paid ads. Logged-in pages have no third-party analytics. | https://www.fastmail.com/policies/cookies-policy/ |
| No ads or data sales | Yes | Funded by paid plans. The privacy policy states that personal information is not sold. | https://www.fastmail.com/policies/privacy/ |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Yes | Publishes yearly counts of valid and actioned law enforcement requests by origin and data type. | https://www.fastmail.com/policies/transparency-report/ |
| Tells users about requests | Yes | Users are notified of legal requests for their data unless prohibited by law or notice would cause harm. | https://www.fastmail.help/hc/en-us/articles/1500000277902-Information-for-law-enforcement |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.fastmail.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.fastmail.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | No end-to-end encryption in Fastmail's own apps. PGP or S/MIME only works in third-party apps. | https://www.fastmail.com/features/security/ |
| Encrypted mailbox storage | Partial | Mail is stored on encrypted disks with keys Fastmail holds. | https://www.fastmail.com/features/security/ |
| Open protocols | Yes | IMAP, POP3, SMTP, CalDAV and CardDAV work with any client. | https://www.fastmail.help/hc/en-us/articles/1500000278342-Server-names-and-ports |
| Custom domains | Yes | Available on every plan above Basic. | https://www.fastmail.help/hc/en-us/articles/360058753394-Custom-domains-with-Fastmail |
| Sign up without personal data | Partial | No phone number is needed by default, but some trial accounts are asked to verify a mobile number by SMS. | https://www.fastmail.help/hc/en-us/articles/1500000277442-Trial-accounts |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | imap.fastmail.com:993 (implicit TLS). IMAP4rev2 advertised with IDLE. |  |
| POP3 support | Yes | pop.fastmail.com:995 (implicit TLS). CAPA: EXPIRE, LOGIN-DELAY, TOP, UIDL, PIPELINING, RESP-CODES, AUTH-RESP-CODE, USER, SASL. |  |
| SMTP submission | Partial | smtp.fastmail.com:465 (implicit TLS). Missing: SMTPUTF8. |  |
| Mail transport security | No | Passes: SPF, TLS-RPT. Missing: DMARC none, MTA-STS testing, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | Partial | SRS is available as an option for forwarding, but regular forwarding does not rewrite the sender. | https://www.fastmail.help/hc/en-us/articles/360058753434-Set-up-mail-forwarding |
| ARC sealing | Yes | Validates ARC chains on inbound mail and adds ARC headers. | https://www.fastmail.com/blog/what-is-arc/ |

Source: https://privacyratings.com/email-providers/fastmail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/fastmail.md