25
votes
What email provider do you use?
I’m currently using ProtonMail, I’ve been with them since Indiegogo. I know calendar’s supposed to come out in beta this month, but I’m honestly fed up with the speed of their development and the quality of apps, and I think it’s too expensive.
I need custom domain support, and calendar. Nothing fancy.
Self-hosting email is out of the question in 2019.
What are you guys using for email these days?
Another +1 for Fastmail here. I've been so happy with the email, contacts, and calendar services. I'm also using the file storage as an image host for my website.
My favorite thing about Fastmail is how standards compliant they are, which may seem silly until you think about Gmail's mess.
Can you expand on this, I've read it a few times and this sentence doesn't make sense.
I believe Australia's laws on encryption are being referred to, here.
It's a really common misconception, but those laws are irrelevant for Fastmail. As this blog post explains, they don't need to add a backdoor to be able to decrypt your data—they've always been able to decrypt your data because that's how Fastmail works. It's not an encrypted email service and never has been.
If you're worried about your email provider being able to access your data, Fastmail has never been an option that you'd want to choose, and that hasn't changed.
(@cwagner)
Yes, there has been a lot of FUD. And frankly...you're helping contribute to it.
I'm a Fastmail customer. My emails are stored on Fastmail's servers. They're encrypted, but Fastmail has the encryption keys. If Fastmail receives what they consider a lawful search warrant for my data, they'll decrypt my email and turn it over. That was true before the stupid new Australian law, and it's true afterwards. I'm fine with that, because my threat model for my personal email does not require protection from nation-state actors.
The Australian law is targeted more at services like Protonmail. With Protonmail (or similar end-to-end encrypted services like Signal) I hold the encryption keys. Protonmail stores encrypted blobs of data that they cannot decrypt, even if compelled to. If a hypothetical Protonmail-clone-hosted-in-Australia receives a search warrant, then before the stupid new Australian law was passed, all they could do is hand over to the police the encrypted blobs, which are useless without the key that I alone possess. With the stupid new law in place, the hypothetical Protonmail clone can be compelled to change their service so they also store a copy of the encryption keys, which means when they get a search warrant they can decrypt the data and then hand it over.
Same here. I try not to email on mobile (for disctraction/stress prevention purposes) but when I do, my experience with the web-app (in safari on iOs) is a good one. Lives up to the name. On the iPad I have it set up in the native mail app. Works smoothly.
I have all my contacts there as well, synced with my iPhone.
So I mostly use it in the browser on desktop. Also very snappy. Clean interface. Everything doable with keyboard shortcuts. Very happy with it.
I'm on the standard plan. I pay $90,- for a subscription length of 2 years.
I hear you. Fastmail is one of the few sites that do not where I don't notice I use an ancient iPhone 5 (not S). I tried the twitter web version yesterday, which is borderline unusable. It's really nice some products prioritize performance properly. One of the reasons I don't mind paying them more than I do on any other software product at the moment.
Fastmail is my no. 1 option at the moment. I would really love it if would they allow multiple users for the standard plan :(
I disagree. It just takes a bit more work than it used to.
SPF, DKIM, DMARC, PTR records get you where you need to be once the server itself is running.
Maybe the work in running it is more than you are able to put in, but I guess that comes with self-hosted anything these days.
I've been meaning to do this but have been shrugging it off. Feel free to answer these two questions if you'd like :)
My main worry is having my own email being misidentified as spam since I would not be able to self-host it off my residential connection and would need to rely on something like AWS.
The second, being security, would a self-hosted mail server be secure from any intrusion? I'm not referring to attacks on the machine that could be prevented with like fail2ban and simple ssh keypair authentication, but would it be a game of cat and mouse to prevent exploitative breaches into my mailbox?
Happy to give my perspective on your points :-)
First, spam management is definitely something to consider. As you correctly mentioned, the walls are pretty high these days. The four things I mentioned in my post [SPF, DKIM, DMARC, PTR] are the main things which you should get in order. If you have those, it's a pretty good sign you're not a spammer. DMARC is the big new one which, if configured well, will get you through most places even with spammy sounding emails. PTR is one I mention as Google uses it in it's identification protocols. It's quite easy to set up, though.
The thing is, I really evangelize for self-hosting as I don't like seeing email falling primarily into the hands of the big guys. It really makes it tough to get past as even if you have checked all the boxes, all it takes is google saying "yeah, 99.99% of email comes from gmail, outlook and yahoo, we're just gonna send everything else to spam" and our open protocol is no longer open.
Regarding IP blacklisting, this one is the one you want to try to get right from the beginning. If any IP has been on any sort of dynamic ISP allocation throughout it's life, it's likely to be on a blacklist. I've been lucky that most reputable providers have clean IP allocations. But try and check first. You also need to make sure your hosting provider lets you change your PTR records. Search around, there are ISPs which offer static ipv4/6 with these options if you are lucky enough to have choice of ISP.
Security of the system is another one where there are several factors which will come into play. There are the security protocols which will keep people out as you state. fail2ban with strong passwords on your email accounts should suffice.
Another factor though is the profile of the target. For a home self-hosted setup, you're unlikely to be targeted by most people as the payoff just isn't high enough. Unless someone is out to get you personally or you are doing something incredibly high profile [in which case, don't self-host] it isn't likely to be a big issue.
There are the usual automated systems scanning for breaches, but again it's all about effort. If fail2ban boots them or they exhaust a list of short passwords, they aren't going to waste time and bandwidth on you.
There's also diligence in maintaining the system. Check the logs, if it looks like someone is being really persistent, then block the IP or subnet.
Well, don't use AWS for it, unless you plan on paying for the s2s service, for email delivery. Otherwise, it will be marked as spam.
As far as how secure from intrusion, it's not an easy answer. As long as you keep the software up to date, don't use passwords to log into the shell, and utilize fail2ban, it should be pretty secure.
My biggest gripe with a setup like this is that I can't offer the service availability that an email provider can. If power goes out at my house, I'm not able to send or receive email.
I guess that kinda goes away if you use AWS or similar services. But it does add a whole lot of complexity.
If you have the time for this, sure, why not?
One caution about self-hosting at home is that many ISPs block port 25, so you may not even be allowed to self-host email from home. Check with your ISP first before wasting time.
And a couple thoughts about spam:
I have the full SPF, DKIM, DMARC, setup and don’t get flagged as spam ...most of the time. But there are a few big email providers like Microsoft that send you to the spam bucket simply because you’re small. I don’t know any way to get around that, unfortunately.
And, the other problem with self-hosting and spam is that you may end up as the recipient of a lot of spam. Tools like rspamd and spamassasin can help defend your inbox, but they’re one more thing to configure.
All in all, I would recommend that you DO self host. Grab a cheap VPS and put some time into setting up a good email host environment. There are some great tutorials out there for common OSes like Ubuntu, Fedora or Arch. In the end, even if you decide that self hosting isn’t for you, you will have learned a lot about how email really works.
(Also, I really like what edenist said about evangelizing self-hosting. Good point.)
Service availability is a concern, but it's important to scale the importance of availability with the number of users on the service. If it's just you and perhaps some family and friends, does it matter if you don't have 99.9999% uptime?
It's also good to keep in mind that email is a very robust protocol, and is not a real-time communication protocol like XMPP or any IM service. A properly configured mail server will hold on to outgoing mail for at least a day before bouncing it back as unsent if the server is down, and similarly clients will hold and retry in the outbox for a similar period.
All that is to say, you can have the power be out for a day at least without any real issues with lost mail. The power at my place is usually pretty solid [knock on wood ;-) ], but power outages lasting more than a day are thankfully pretty rare in most developed countries. If you live somewhere frequented by hurricanes then perhaps it's a different story....
Even then, I still ask myself these exact same questions regularly. Even if everything goes completely pear shaped at home, I've got a VPS in a DC I use for a few things. I've got a fallback mailserver on it I can switch to with a DNS change. It won't have all the bells and whistles of my main service [a full HA/DR plan for home use is just not worth my time], but it will make sure my emails aren't lost in a total emergency.
I use... a fair few for different purposes. I have an email on Disroot (which is a great set of services), like two on cock.li and also a Proton Mail. I have a Gmail for school as well.
Yeah, most are pretty awful. Some are fine though, like the default cock.li domain and airmail/firemail.cc. Wouldn't use any professionally though.
I'm using purelymail with my own domains. Very simple pricing structure based on disk space used, good support from them, mainly focused on offerint IMAP/SMTP access, the web one is a RoundCube installation that I'm trying to avoid. They also provide everything required to set up your domain's DKIM and DMARC DNS settings with your provider. Overall I don't have any complaints.
That looks really interesting. Do they support caldav, cardav?
EDIT: Just found out that it's an american company and it's run by 1 guy only. nah thanks.
To be honest I'm not using purelymail for my life depending correspondence, but I do have a number of domains that could use a low traffic email setup, and it is it.
Purelymail looks really good if all you need is mail. Unfortunately, calendar support is something of a must for me.
Sorry, OP, I got locked on the topic and didn't read your post fully to see you want calendar too.
But, just to be pedantic, emails and calendar support are two very different requirements.
If I would have your needs I would combine purelymail for mailing with a nextcloud self hosted machine for calendaring and documents.
TBH I think it's a great solution, but right now I just don't have the bandwidth in my life to self-host essential services and worry about integration.
You could take a look at tutanota. Its usually recommended along protonmail for the more privacy oriented crowd.
Tutanota is cool. Sadly, a few things missing, such as:
And not being able to use caldav/cardav/imap clients bugs me a little bit..
This looks great. It's secure, private, cheap, and has calendar. Thanks!
Posteo is another usual privacy-focused recommendation, although it is based in Germany. It's 1 euro a month.
Also using Protonmail. There's definitely some missing functionality in the email client (both web and app) but overall, for me personally, it works well. I can't see any need to look elsewhere.
Too expensive though? It's 5€ a month. A coffee and a slice of cake a month. Is that really too expensive?
Too expensive considering it doesn't have calendar, and I can't use any mobile client that I want, and their own client lacks basic functionality like snoozing and has weird notification bugs.
I'm with you on this one. I have about a year of credit left, and I'll be leaving if they don't have the calendar and a new mobile app out by then
I get that calendar should be out soon; way too late to the market IMO, but whatever.
But the mobile app is really what bugs me. It's very frustrating to use compared to iOS mail or Outlook.
It's a good service, but it doesn't meet my needs of a good mobile UX.
I have my own domain(s) and currently use Migadu to host them. It's somewhat unusual as they only support bringing your own domain, but they also give you limitless mailboxes and domains for a flat fee. The only limit is for outgoing mail per day, and for personal mail I will never hit it.
I lead a simpler life, I guess. No phone. For casual stuff, I use G-Mail. But for personal and important things, Tutanota seems to work. I just like the fact that it is uncluttered, seems not as susceptible to spam. Because I limit what I use it for, and limit who has access to it, it simplifies things.
I use those same services for those same reasons.
Do you though?
I find custom domains to be a royal pain in the arse when it comes to people being able to functionally use your email address.
How so? I have had a custom domain email for a few years now. It had bumped around quite a few different providers and I have never had an issue. Are you sure you setup all the optional dns entries?
I don't mean from a technical perspective, I mean telling people what your email address is. As soon as they hear the @ symbol they're waiting to be told a domain they know like gmail.com and it's a struggle if they don't know yours.
I have never had an issue with my firstname@firstnamelastname.com email. Also something like @tutanota.com or @protonmail.com are going to be just as unknown for most people.
Yes, I definitely do. It's not for everyone, but it's essential for me.
It makes switching email provider much simpler. Just change what your domain is connected to. Essential for me as well.
I use gmail.
I spend $100 a year on shared web hosting, and I use it to route all relevant emails to gmail. You can also configure gmail to send a reply from that email address, but it looks like they made that a little more tricky now.
I use Gmail, for historical reasons; SDF.org, for a lot of things related to tech projects; and I self-host on a Linux VPS running postfix for SMTP and dovecot for IMAP.
It's always depended on my threat model. I'm currently keeping a half-dozen or more accounts in use on various platforms:
I've run a personal Roundcube server, and may start up something similar just to keep my hand in, now that I've got the time again.
KolabKopano looks nice.still with fastmail until the end of the year, then I'll probably migrate over to mailbox.org. They're pro-privacy, start at 1 EUR per month and do support custom domains.
GSuite personal. Can't say I recommend it. Google has been slowly killing services for GSuite users. A couple weeks ago they broke the Google Home reminders function for us. Can't leave reviews on Android apps. Can't redeem gift cards.
I have two email providers -- both with custom domains
Zoho is pretty great, especially for the price. It just works.
The only reason I have such a goofy setup is because I share a lot of documents around the internet and don't want these documents connected to my main email address. Its silly, but Google has yet to give us the option to own a document while still remaining completely anonymous. And for a buck a month, Zoho offers a lot and the setup is a breeze.
Zoho's calendar is alright, too, but I'm still living out of my GSuite one. I don't do a lot with invites etc, so this isn't an issue for me.
I highly recommend the catch-all setup for junkmail / sites. I'd been thinking of doing this since the late 90s and never got around to giving it a proper shot until now, which is crazy. If you do go down this method, you'll find that there are a few incoming addresses to immediately blacklist like contact, info, and some other generic words. But you'll see those within the first week or two.
For my personnal email addresses: Gmail. For my domain email addresses: https://postale.io.
I tried Zoho Mail but they have POP and IMAP disabled for the free plan, which sucks. That forbids the use of the domain email addresses in anything other than their webmail, and I like to group all my email addresses under my Gmail.
Currently using my personal domain for professional-related email, running on my own hosted email server, along with a carddav and caldav server.
For everything else, using thunix's mail services, but we're exploring adding other features like caldav and carddav via Nextcloud to users, just not there yet.
Does anyone know https://soverin.net/? They seem interesting.
I have my own domain, my own in-home exchange server. I use godaddy for domain registration and dns management.
It's gotten too expensive though. I'm quite annoyed they have recently done what cell/cable providers do, that is screw long-time members out of lower subscription pricing.
Gmail, but I keep it a different account from my regular Google/Android login.
Gmail. I don't send any particularly important communications via email.
Just got set up with Purelymail, loving it so far, highly recommended.