# Email providers privacy ratings

Hosted email services. Where mail is stored, and who can read it.

**Our pick:** [Forward Email](https://privacyratings.com/email-providers/forward-email/): The whole service is published on GitHub, server code included. Each mailbox is a separately encrypted SQLite file, IMAP, POP3, SMTP, CalDAV and CardDAV work with any app, and custom domains are included on low-cost plans.

| Name | Grade | Jurisdiction | Description |
| --- | --- | --- | --- |
| [Forward Email](https://privacyratings.com/email-providers/forward-email/) (our pick) | A (93/100) | United States (Five Eyes) | Open-source email service with encrypted mailboxes, custom domains, and IMAP, POP3, SMTP, CalDAV and CardDAV on every paid plan. |
| [mailbox.org](https://privacyratings.com/email-providers/mailbox-org/) | C (70/100) | Germany (Fourteen Eyes) | Paid email, calendar and office service from Berlin, Germany, with built-in PGP encryption and support for custom domains. |
| [StartMail](https://privacyratings.com/email-providers/startmail/) | C (66/100) | Netherlands (Nine Eyes) | Paid email service from the Netherlands with built-in PGP encryption, unlimited aliases and custom domains. |
| [Kolab Now](https://privacyratings.com/email-providers/kolab-now/) | C (64/100) | Switzerland | Paid email and groupware service from Apheleia IT in Switzerland, built on the open-source Kolab platform, with calendars, contacts, files and video calls. |
| [Proton Mail](https://privacyratings.com/email-providers/protonmail/) | C (64/100) | Switzerland | End-to-end encrypted email service from Switzerland, with apps for web, Android, iOS and desktop. |
| [CounterMail](https://privacyratings.com/email-providers/countermail/) | C (62/100) | Sweden (Fourteen Eyes) | Paid email service in Sweden that encrypts mail with OpenPGP and stores it encrypted. New registrations are closed. |
| [Posteo](https://privacyratings.com/email-providers/posteo/) | C (62/100) | Germany (Fourteen Eyes) | Paid, ad-free email service from Germany that runs without collecting names or addresses and accepts anonymous payment. |
| [Tuta](https://privacyratings.com/email-providers/tuta/) | C (61/100) | Germany (Fourteen Eyes) | End-to-end encrypted email and calendar service from Germany, with open-source apps for web, desktop and mobile. |
| [Disroot](https://privacyratings.com/email-providers/disroot/) | D (59/100) | Netherlands (Nine Eyes) | Volunteer-run platform from the Netherlands offering email and other open services. |
| [Riseup](https://privacyratings.com/email-providers/riseup/) | D (59/100) | United States (Five Eyes) | Email, mailing list and VPN service run by an autonomous tech collective in Seattle for activists and social movements. Accounts need an invite, and the service is funded by donations. |
| [Purelymail](https://privacyratings.com/email-providers/purelymail/) | D (55/100) | United States (Five Eyes) | Low-cost email hosting from the United States with custom domains, standard protocols and mail stored encrypted with the user's password. |
| [Mailfence](https://privacyratings.com/email-providers/mailfence/) | D (54/100) | Belgium (Fourteen Eyes) | Email service from Belgium with built-in OpenPGP encryption and signing, plus calendar, contacts and document storage. |
| [Infomaniak Mail](https://privacyratings.com/email-providers/infomaniak-mail/) | D (53/100) | Switzerland | Email service from Swiss company Infomaniak, with free ik.me addresses and paid hosting for custom domains, plus web and mobile apps. |
| [Fastmail](https://privacyratings.com/email-providers/fastmail/) | D (50/100) | Australia (Five Eyes) | Paid email service from Australia with custom domains and standard protocols. |
| [Runbox](https://privacyratings.com/email-providers/runbox/) | D (49/100) | Norway (Nine Eyes) | Paid email service from Norway with custom domain hosting, standard protocols and an open-source webmail app. |
| [iCloud Mail](https://privacyratings.com/email-providers/icloud-mail/) | D (47/100) | United States (Five Eyes) | Email service included with every Apple Account, with @icloud.com addresses and custom domains for iCloud+ subscribers. |
| [Zoho Mail](https://privacyratings.com/email-providers/zoho-mail/) | D (45/100) | India | Email service from Zoho for businesses and individuals, with custom domains, calendar and contacts, and an ad-free free plan. |
| [Gmail](https://privacyratings.com/email-providers/gmail/) | D (41/100) | United States (Five Eyes) | Google's free email service. Mail is stored and processed on Google's servers, and Google Workspace offers it for business domains. |
| [GoDaddy Email](https://privacyratings.com/email-providers/godaddy-email/) | F (39/100) | United States (Five Eyes) | Business email for custom domains sold by GoDaddy. It runs on Microsoft 365 (Exchange Online), with Outlook webmail and apps. |
| [Migadu](https://privacyratings.com/email-providers/migadu/) | F (38/100) | Switzerland | Swiss email hosting service for custom domains, priced by usage rather than per mailbox, with standard IMAP, POP3 and SMTP access. |
| [Namecheap Private Email](https://privacyratings.com/email-providers/namecheap-private-email/) | F (36/100) | United States (Five Eyes) | Paid email hosting from Namecheap for custom domains, with webmail, calendar and standard protocol access. |
| [Outlook.com](https://privacyratings.com/email-providers/outlook-com/) | F (36/100) | United States (Five Eyes) | Microsoft's free email service, also used for Hotmail and Live addresses. |
| [GandiMail](https://privacyratings.com/email-providers/gandi-mail/) | F (34/100) | France (Nine Eyes) | Paid email hosting for custom domains from Gandi, a French domain registrar, with SOGo and Roundcube webmail and standard protocol access. |
| [HEY](https://privacyratings.com/email-providers/hey/) | F (32/100) | United States (Five Eyes) | Paid email service from 37signals with a screening-based inbox and its own apps. Works only through the HEY apps, without IMAP or POP3. |
| [GMX](https://privacyratings.com/email-providers/gmx/) | F (31/100) | Germany (Fourteen Eyes) | Free, ad-supported email service from 1&1 Mail & Media in Germany, with webmail, mobile apps, calendar and cloud storage. |
| [Titan](https://privacyratings.com/email-providers/titan/) | F (31/100) | Cayman Islands | Business email service for custom domains, sold through hosting and domain providers rather than directly. Includes webmail, mobile apps and a free plan with fewer features. |
| [Yahoo Mail](https://privacyratings.com/email-providers/yahoo-mail/) | F (30/100) | United States (Five Eyes) | Free, ad-supported email service from Yahoo with webmail and mobile apps. A paid Yahoo Mail Plus plan removes ads. |
| [123 Reg Email Hosting](https://privacyratings.com/email-providers/123-reg-email/) | F (27/100) | United Kingdom (Five Eyes) | Business email hosting for custom domains from 123 Reg, a UK domain and hosting company owned by GoDaddy. Mailboxes run on GoDaddy mail servers, with webmail and mobile apps. |
| [Mail.com](https://privacyratings.com/email-providers/mail-com/) | F (27/100) | United States (Five Eyes) | Free, ad-supported email service from 1&1 Mail & Media, part of United Internet, offering addresses on many domains such as mail.com and email.com. A paid Premium plan adds IMAP, POP3 and phone support. |
| [Yandex Mail](https://privacyratings.com/email-providers/yandex-mail/) | F (26/100) | Russia | Free, ad-supported email service from Yandex in Russia, part of Yandex 360 with calendar and cloud storage. Custom domains are available through Yandex 360 for Business. |
| [AOL Mail](https://privacyratings.com/email-providers/aol-mail/) | F (22/100) | United States (Five Eyes) | Free, ad-supported email service from AOL, owned by Bending Spoons, with webmail and mobile apps. A paid subscription removes ads. |

## Criteria

- **Open source** (weight 3): Is all the source code needed to run the product public?
- **No trackers or telemetry** (weight 3): Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
- **No ads or data sales** (weight 2): Is the product funded without advertising, ad targeting or selling user data?
- **Independent audit** (weight 2): Has an independent security or privacy audit been published within the last three years?
- **Transparency report** (weight 2): Does the provider regularly publish how many government and legal requests it receives and how it responds?
- **Tells users about requests** (weight 1): Does the provider promise to tell users about requests for their data, unless a court forbids it?
- **TLS configuration** (weight 2, automated): Does the website pass the Qualys SSL Labs test with a grade of A or better?
- **Security headers** (weight 1, automated): Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
- **Modern web standards** (weight 1, automated): Does the website score 90% or higher on the Internet.nl website test?
- **End-to-end encryption** (weight 3): Can mail be end-to-end encrypted so that the provider cannot read message contents?
- **Encrypted mailbox storage** (weight 3): Is stored mail encrypted with a key the provider does not hold?
- **Open protocols** (weight 2): Can any standard app connect over IMAP, POP3, SMTP, CalDAV or CardDAV, without extra software?
- **Custom domains** (weight 1): Can mail be sent and received with your own domain?
- **Sign up without personal data** (weight 2): Can an account be created without a phone number or another email address?
- **Email security standards** (weight 2, automated): Does the mail domain score 90% or higher on the Internet.nl email test?
- **IMAP support** (weight 2, automated): Does the IMAP server accept connections over implicit TLS on port 993 and advertise IMAP4rev1 or IMAP4rev2 with IDLE push?
- **POP3 support** (weight 1, automated): Does the POP3 server accept connections over implicit TLS on port 995 and answer CAPA with UIDL?
- **SMTP submission** (weight 2, automated): Does mail submission work over implicit TLS on port 465 with SMTPUTF8, 8BITMIME, PIPELINING and AUTH?
- **Mail transport security** (weight 3, automated): Does the mail domain enforce encrypted, authenticated delivery with MTA-STS, DANE, DNSSEC, TLS-RPT and an enforced DMARC policy?
- **Sender Rewriting Scheme** (weight 1): Is the envelope sender rewritten with SRS when mail is forwarded, so forwarded mail keeps passing SPF?
- **ARC sealing** (weight 1): Does the provider validate and add ARC (RFC 8617) signatures, so authentication results survive forwarding?

Source: https://privacyratings.com/email-providers/