Email glossary

What the words on my pages mean, in plain English: from IMAP and SMTP to end-to-end encryption, aliases and DMARC.

Choosing a provider

Email provider: The company that stores your email and sends and receives it for you. Some also give you a calendar, contacts and file storage.
Your own domain: An address that ends in a name you own, like you@yourname.co.uk, instead of the provider's name, like you@gmail.com. You buy the domain from a registrar, then point it at your email provider. If you ever move provider, your address stays the same.
Storage: How much email and attachments your mailbox can hold, usually in gigabytes (GB). 15 GB is plenty for most people for years. Some providers share storage with their file and photo services.
Free plan: A plan that costs nothing. Free plans often have less storage, no own domain, and may be paid for by advertising or by nudging you to upgrade.
Free trial: A short time to try a paid plan before you're charged. Check whether you need to give card details up front, and set a reminder before it ends.
Renewal price: What you pay after the first term. Some providers, especially web hosts, show a low price for the first year and charge much more when it renews.
Minimum term: The shortest time you have to pay for, such as a month or a year. Cheaper prices often need you to pay for a year or more up front.
White label: A service a business can resell under its own name, so its customers see the reseller's brand rather than the provider's.
Jurisdiction: The country whose laws the company has to follow, usually where it's based. It decides who can demand your data, and how. A company can be based in one country and keep your data in another.
Where your data is kept: The country where the servers holding your mailbox are. Keeping it in the UK, the EU, the EEA or Switzerland means strong data protection laws apply to it.
GDPR and UK GDPR: The data protection laws in the EU and the UK. They give you the right to see, correct, export and delete the personal data a company holds about you, and limit what it can do with it.
Funded by advertising: The provider, or the company that owns it, makes money from advertising. That doesn't always mean your email is read for adverts, but it's worth knowing who pays for a free service.

Privacy and security

End-to-end encryption: Your email is locked on your device and can only be unlocked by you and the person you're writing to. The provider can't read it, even if asked to. It usually works fully only between people on the same service, or when both use PGP.
Zero-access encryption: Email is stored locked with a key only you hold, so the provider can't read what's in your mailbox. Messages arriving from other services are locked as soon as they arrive.
TLS (encryption in transit): Locks email while it travels between computers, like the padlock on a website. Almost every provider uses it. It stops people listening in on the way, but the provider can still read your email once it arrives.
PGP and OpenPGP: A long-standing way to encrypt email end to end between any providers. You and the person you write to each need a pair of keys. Some providers build it in, so it works without setting anything up.
Metadata: Details about an email rather than what it says: who sent it, who to, when, and the subject line. Even with end-to-end encryption, some metadata, often the subject, can't be hidden.
Two-step sign-in (2FA): Signing in with something extra as well as your password, such as a code from an app or a security key. It stops most break-ins that use a stolen password.
Passkeys: A way to sign in without a password, using your phone, computer or a security key, unlocked with your fingerprint, face or PIN. Passkeys can't be phished or reused on fake sites.
Open-source apps: The code for the apps is published, so anyone can check what they really do. It doesn't make a service private by itself, but it makes hidden tracking much harder.
Sign up without ID: You can create an account and pay without giving your name or a phone number, for example by paying in cash or with cryptocurrency.
Tor: Free software that hides where you're connecting from by sending your traffic through several volunteer computers. Some privacy providers have their own Tor address.

Addresses and sorting

Alias: An extra address that delivers to your main inbox. You can give each website its own alias, and switch one off when it starts getting spam.
Masked email: A random alias made for one website, so the site never sees your real address. Alias services and some providers make them for you as you sign up to things.
Catch-all: With your own domain, a catch-all delivers email sent to any address at it, like anything@yourname.co.uk, so you can make up addresses on the spot.
Forwarding: Sending email that arrives at one address on to another, automatically.
Filters and rules: Instructions that sort email as it arrives: move it to a folder, label it, forward it or delete it.
Sieve: A standard language for writing filters. Providers that support it let you write detailed rules and take them with you if you move.
Mailing list: One address that sends a message on to a group of people, or a newsletter you've signed up to. Good providers make it easy to unsubscribe from lists in one tap.
Spam filter: Checks every email as it arrives and moves junk and scams out of your inbox.

Apps and connections

Webmail: Reading and writing email in your web browser, with nothing to install.
IMAP: The standard way for a mail app to read email kept on the provider's servers. Everything stays in step: read an email on your phone and it shows as read on your laptop. If a provider supports IMAP and SMTP, it works in almost any mail app.
SMTP: The standard way email is sent, from your mail app to your provider, and from one provider to the next.
POP3: An older way for a mail app to download email to one device. Unlike IMAP, it doesn't keep your devices in step, so it's rarely the best choice today.
JMAP: A newer, faster standard for mail apps to talk to a provider, designed to replace IMAP. Fastmail helped create it, but few apps use it yet.
Bridge app: A small app some encrypted providers, such as Proton, ask you to run so ordinary mail apps can use IMAP and SMTP with an encrypted mailbox.
CalDAV and CardDAV: Standards for keeping your calendar (CalDAV) and contacts (CardDAV) in step across apps and devices, whoever made them.
Exchange and ActiveSync: Microsoft's way of syncing email, calendar and contacts, used by Outlook and many phones. It's common in business email.
Export: Downloading a copy of all your email, usually as .mbox or .eml files, so you can keep a backup or move to another provider.

Behind the scenes

DNS: The internet's address book. When you use your own domain, DNS records tell the world which provider handles its email.
MX record: The DNS record that says which servers receive email for a domain. Changing it is how you move your domain's email to a new provider.
SPF: A DNS record listing the servers allowed to send email for your domain. It helps stop others pretending to be you.
DKIM: A hidden signature added to every email you send, checked against a key in your DNS. It proves the email really came from your domain and wasn't changed on the way.
DMARC: A DNS record that tells other providers what to do with email that fails the SPF and DKIM checks, such as reject it, and sends you reports about who is sending as your domain.
BIMI: Lets your logo appear next to your emails in some inboxes, once your domain has a strict DMARC policy.
MTA-STS: Makes other providers use encryption (TLS) when they deliver email to your domain, instead of falling back to sending it unprotected.
DANE: A signed DNS record that tells other providers exactly which certificate a mail server uses, so email can't be quietly intercepted on the way. It needs DNSSEC to work.
IPv6: The newer kind of internet address. Servers that have one can be reached directly on modern networks, which some mobile and broadband networks prefer.
Data breach: When someone gets into a company's systems and takes data, such as email addresses and passwords. I list breaches of the provider's own systems that Have I Been Pwned has recorded.
Status page: A page where a provider reports outages and problems as they happen, and keeps a history of past incidents.
Blocklist: A public list of servers caught sending spam. Providers check them to decide whether to accept an email. A provider whose servers are listed may find its customers' email going to spam. I check each provider's mail servers against the main blocklists.
Uptime: How much of the time a service is working. 99.9% sounds high, but still allows nearly nine hours of downtime a year.
Deliverability: Whether the email you send reaches people's inboxes rather than their spam folders. SPF, DKIM, DMARC and a clean sending record all help.

Missing a word, or think I've got one wrong? Tell me. To see how these features count towards my stars, read how I score.