How I score email providers

Overall

Privacy counts for half, price for a quarter and features for a quarter. Alias services, which forward mail rather than store it, are scored on privacy (65%) and price (35%). Nothing gets an overall score until I've confirmed its price. Self-hosted software isn't rated.

Privacy, out of 5

• End-to-end encrypted storage built in: 1.5 (optional encryption: 0.75)
• Company based in the UK, the EU, the EEA or Switzerland: 1 (Australia: 0.5)
• Your data kept in the UK, the EU, the EEA or Switzerland: 1
• Not funded by advertising, and no advertising parent company: 0.5
• Open-source apps: 0.5
• You can sign up and pay without giving your identity: 0.5

Price, out of 5

From the cheapest plan's monthly price in pounds: up to £1 scores 5, up to £2 scores 4.5, up to £3 scores 4, up to £4 scores 3.5, up to £5 scores 3, up to £6 scores 2.5, and anything more scores 2. Prices in dollars or euros are converted at a rough rate, so check the provider's own price before you buy.

Features, out of 5

• Your own domain: 1
• 15 GB or more storage: 1 (5 GB or more: 0.5)
• Calendar and contacts: 1
• Works in any mail app (IMAP and SMTP): 1 (through a bridge app: 0.5)
• Aliases: 1

Trust score, out of 5

The stars above reward things a provider can't always change, such as where it's based or whether its business includes end-to-end encryption. The Trust score is separate. It counts only things a provider controls, so any provider can work towards a better score. It never changes the stars or the order of results.

• Reliability, 1 point: website uptime over 30 days from my hourly checks. 99% or more scores 1, 98% scores 0.75, 97% scores 0.5 and 95% scores 0.25.
• Abuse and reputation, 0.75: mail servers kept off the free blocklists for 30 days (0.5), and a published way to report abuse (0.25).
• Email security on its own domain, 1: DMARC set to reject (0.4, or 0.2 for quarantine), MTA-STS (0.2), DNSSEC (0.2), and its website on HTTPS with HSTS (0.2).
• Account security, 0.5: two-step sign-in (0.25) and passkeys (0.25).
• Transparency, 0.75: a security contact (0.25), a transparency report or published policy on government requests (0.25), and a published security audit or bug bounty (0.25).
• Fair dealing, 0.5: you can export all your mail (0.25) and cancel online (0.25).
• Support, 0.5: a way to reach a person listed on its website (0.25) and a public status page (0.25).

I check its website, not its mail service, so uptime is read generously. A failed check is tried again before it counts, and if lots of providers fail in the same hour I assume the problem was mine and don't count that hour for anyone. A blocklist only counts if I see the listing on two separate days. Uptime and blocklists need a week of my checks before they count.

Anything I haven't confirmed yet scores nothing and shows as "Not checked yet", never as a fail. Members can send me a link to the provider's own page to fill a gap, using Suggest an edit on any provider's page, and I check it.

How I keep it up to date

I watch each provider's pricing and plan pages and recheck their mail settings automatically. When something changes, I check it, update the page and add the change to the price history. Every page shows the date it was last checked.

Commission

Some providers pay me a commission when you buy through a link marked Offer. It never changes a star, the order of results or which providers I list, and most of them pay me nothing. More on my disclaimer.