# GandiMail privacy rating

Paid email hosting for custom domains from Gandi, a French domain registrar, with SOGo and Roundcube webmail and standard protocol access.

## Summary

GandiMail scores 34 out of 100 (grade F) on the email providers criteria. It meets 6 of 19 criteria: no ads or data sales, transparency report, open protocols, custom domains, IMAP support and POP3 support. It partly meets TLS configuration, security headers and SMTP submission. It does not meet open source, no trackers or telemetry, independent audit, tells users about requests, end-to-end encryption, encrypted mailbox storage, sign up without personal data, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in France: Nine Eyes member; EU member (GDPR). Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade B.

- Website: https://www.gandi.net/en/domain/email
- Jurisdiction: France. Nine Eyes member. EU member (GDPR).
- Home page trackers: Trustpilot (not scored)
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Also rated: [Gandi](https://privacyratings.com/domain-registrars/gandi/) (Domain registrars)
- Grade: F (34/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The privacy policy lists AT Internet audience-measurement cookies, which can be opted out of. | https://www.gandi.net/en/contracts/privacy-policy |
| No ads or data sales | Yes | Funded by paid mailbox plans. No ads. | https://www.gandi.net/en/domain/email |
| Independent audit | No | No independent audit is published. Gandi states ISO 27001 certification, but no report is public. |  |
| Transparency report | Yes | Yearly reports with counts of information requests from authorities and content notices. | https://www.gandi.net/en/digital-service-act-transparency-report |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=webmail.gandi.net&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=webmail.gandi.net |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Not supported. |  |
| Encrypted mailbox storage | No | Encryption at rest for stored mail is not documented. |  |
| Open protocols | Yes | IMAP, POP3 and SMTP work with any client on every plan. | https://docs.gandi.net/en/gandimail/standard_email_settings/index.html |
| Custom domains | Yes | Every mailbox uses your own domain, registered with Gandi or elsewhere. | https://www.gandi.net/en/domain/email |
| Sign up without personal data | No | Creating a Gandi account requires an existing email address, and purchases require contact and payment details. | https://account.gandi.net/en/create_account |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | mail.gandi.net:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | mail.gandi.net:995 (implicit TLS). CAPA: CAPA, TOP, UIDL, RESP-CODES, PIPELINING, AUTH-RESP-CODE, USER, SASL. |  |
| SMTP submission | Partial | mail.gandi.net:465 (implicit TLS). Missing: SMTPUTF8. |  |
| Mail transport security | No | Passes: SPF. Missing: DMARC none, MTA-STS missing, TLS-RPT, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | The forwarding documentation warns that forwarded mail may fail SPF checks, and no SRS is documented. | https://docs.gandi.net/en/gandimail/forwarding_and_aliases/index.html |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/gandi-mail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/gandi-mail.md