# GoDaddy Email privacy rating

Business email for custom domains sold by GoDaddy. It runs on Microsoft 365 (Exchange Online), with Outlook webmail and apps.

## Summary

GoDaddy Email scores 39 out of 100 (grade F) on the email providers criteria. It meets 6 of 19 criteria: TLS configuration, open protocols, custom domains, IMAP support, POP3 support and Sender Rewriting Scheme. It partly meets no ads or data sales, transparency report, tells users about requests, encrypted mailbox storage, SMTP submission and ARC sealing. It does not meet open source, no trackers or telemetry, independent audit, security headers, end-to-end encryption, sign up without personal data and mail transport security. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade F.

- Website: https://www.godaddy.com/email/professional-business-email
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Also rated: [GoDaddy](https://privacyratings.com/domain-registrars/godaddy/) (Domain registrars)
- Grade: F (39/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The privacy policy lists Google Analytics and third-party cookies, web beacons and scripts. | https://www.godaddy.com/legal/agreements/privacy-policy |
| No ads or data sales | Partial | Funded by paid plans and personal data is not sold, but it is disclosed to marketers and advertisers for personalized advertising. | https://www.godaddy.com/legal/agreements/privacy-policy |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Partial | Publishes a subpoena policy for legal requests, but no request counts. | https://www.godaddy.com/legal/agreements/subpoena-policy |
| Tells users about requests | Partial | Customers are notified of valid civil subpoenas. No notice policy is published for criminal requests. | https://www.godaddy.com/legal/agreements/subpoena-policy |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.godaddy.com&hideResults=on |
| Security headers | No | Grade F (10/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.godaddy.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | No end-to-end encryption. Mail is handled by Microsoft 365 with keys Microsoft holds. |  |
| Encrypted mailbox storage | Partial | Microsoft 365 encrypts data at rest with keys Microsoft holds. | https://learn.microsoft.com/en-us/purview/encryption |
| Open protocols | Yes | IMAP, POP3 and SMTP work through Microsoft 365 servers. SMTP authentication must be turned on per user in the GoDaddy dashboard. | https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/pop3-and-imap4/pop3-and-imap4 |
| Custom domains | Yes | The service is built for custom domains on every plan. | https://www.godaddy.com/email/professional-business-email |
| Sign up without personal data | No | A GoDaddy account and purchase require contact details such as an email address and payment information. | https://www.godaddy.com/legal/agreements/privacy-policy |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | outlook.office365.com:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | outlook.office365.com:995 (implicit TLS). CAPA: TOP, UIDL, SASL. |  |
| SMTP submission | Partial | smtp.office365.com:587 (STARTTLS). SMTPUTF8, 8BITMIME, PIPELINING and AUTH advertised. |  |
| Mail transport security | No | Passes: SPF, DMARC reject. Missing: MTA-STS missing, TLS-RPT, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | Yes | Microsoft 365 rewrites the envelope sender with SRS on forwarded mail. | https://learn.microsoft.com/en-us/exchange/reference/sender-rewriting-scheme |
| ARC sealing | Partial | Microsoft 365 validates ARC chains on inbound mail. ARC sealing of forwarded mail is not documented. | https://learn.microsoft.com/en-us/defender-office-365/email-authentication-arc-configure |

Source: https://privacyratings.com/email-providers/godaddy-email/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/godaddy-email.md