Hey everyone,
I know there are a lot of questions about best email providers, but they usually boil down to general questions about privacy and reliability. I have specific questions that I could not find answers to.
I’ve had a Proton Duo plan for my wife and me for about 2 years now. My wife has low tolerance for tech that is not user friendly and works easily. It took a while to migrate all our emails and passwords to Proton and a lot or accounts to passmail aliases, but now we are happy with how the service works.
We both also have our own domains for our main email, and I recently bought another domain to migrate our aliases to. The reason behind this is to ease future migrations if whatever service we use enshitifies. I know that privacy is reduced by using my own domain for aliases, but it’s a consequence I accept to avoid being tied to a single service and to make migration easier in the future.
For that reason, I’ve been burying my head in the sand about what has been happening at Proton. However, with recent news of Proton’s partnership with ETH Zurich and of Proton re-evaluating employee performance based on their AI usage, I can no longer look away.
So here is the ask. I want to migrate to one or more services to specifically replace the functionality I described above. Here are the features that are important to me:
- Services that support multi-user accounts, where I can be the admin and manage our domains.
- Ability to assign domains for specific user accounts.
- Ease of use for users to create aliases on the fly within the password manager.
- European hosted and privacy focused, with good encryption.
- Preferably open source clients.
My domains are hosted by Infomaniak, and I’ve considered them, Tuta and Mailbox.org for email providers. Not sure about the best alias generator, but I heard good things about addy.io
I already self-host a lot of services, so for password management, I was thinking about Vaultwarden with an integration to an alias generator. For the few services I host that are accessible outside my network, I use a reverse proxy (NPM), with Authentik for authentication. I am thinking about setting up NetBird as well.
Finally, I am ok paying a reasonable amount for the services.
If I am way off base, I am also happy to hear suggestions about better ways to set things up.
Thanks in advance
Migadu will probably fit all your requirements.
Migadu pricing only cares about storage space used and emails sent/received. You can have any number of domains or mailboxes or accounts otherwise, and there’s a lot of features and flexibility for the admin.
Not sure how exactly you mean this but it’s probably more flexible than you intend. You can create any number of mail accounts under any of the domains you add to it.
They have a thing called “pattern rewrites” that could be better called “wildcard aliases”. Basically you can have aliases with both variable and fixed parts. For example “shop-*@example.com” will receive email sent to “shop-amazon@” and “shop-walmart@” but not to “amazon@”. It’s a sort of catch-all’s, but mitigates some of the downsides of an actual catch-all because outsiders can’t guess what’s your fixed part of the alias.
They also have regular aliases, domain aliases, catch-all’s and some other stuff.
I typically use those wildcard things for all my needs.
They’re Swiss-based and committed to privacy.
Regarding encryption, if that’s a deal-breaker to you I’d urge you to reconsider. Encryption for email-at-rest is a gimmick. There’s only a handful of providers that even attempt it, because it’s nonsense, but if spinned right it appeals to the public. You will get away from Proton only to get locked down by Tuta or… actually I don’t remember if there was a 3rd.
You don’t want open source clients, you want standard protocols (IMAP and SMTP). You can use any standard mail client with those protocols, both open- and non-open-source clients.
The problem with “encrypted email” is that it doesn’t work without putting it through non-standard protocols, which lead directly to lock-in. So they’ve spinned it so that you need a “special client” to work with it. But whether Proton’s special client is open-source or not is irrelevant, because they can close down their non-standard protocol at any given moment and close source the client and your mailbox becomes their prisoner.
All you need is a provider with regular IMAP and SMTP, and when a provider starts acting up you can switch to another one with regular IMAP and SMTP as fast as your domain(s)’ DNS can propagate.
They seem really interesting. I’m curious about the pattern-rewrite part. I currently do a similar thing with filters on proton (i.e. anything not sent to prefix-* goes to spam), but the downside is that anytime I need to actually send an email from one of these, I have to add it to the limited list of addresses. This is the only part I’d want from one of these masking services, being able to send/respond without having to manually add each address.
Do you happen to know if this is possible with migadu? E.g. I set up the pattern for shop-*@… If I want to send an email from shop-bla@… Do I also need to add that specific one as an address? Similarly, if i get an email sent to shop-bla@…, can I respond if that’s not specifically added as an address or do I need to add it first?
No worries if you don’t know, just curious - thanks.
With Migadu you can send email as anything you want @yourdomain, as long as you use the correct credentials (user+password) for SMTP. You don’t have to set up anything in advance, you just modify your “From” in the mail client. The “From” addresses don’t have to bear any relation to any alias or pattern or existing mailbox, just have to be @ the domain associated with the SMTP login. It’s entirely your problem if the address doesn’t make sense and whether the recipient will be able to reply.
There are mail clients that know how to work with this and let you set up multiple sender “identities” that are basically bookmarked “From” addresses. Migadu’s webmail also has this feature (not sure what webmail app it is, HTML source code says “SnappyMail”). But as long as the email client lets you edit the “From” field you can always change this on the fly.
That’s awesome, thank you.
This is an excellent answer, and seem to cover all my needs. I’ll definitely check them out!
The pattern rewrites especially are interesting. I had ruled out catch alls not only because of the usual downsides but also becauseci could not direct aliases to specific mailboxes with a catch all. I assume with the pattern rewrites, ibcan direct different fixed parts to different mailboxes?
Yes, you can send each pattern to one mailbox or to multiple.