Pricing
Firstly, Posteo is cheap - coming in at just one Euro ($1.13) per month. The fact that it is a paid service, crucially means that it can exist without relying on advertising and tracking as a source of income. The result is that Posteo requires very little information from users at the subscription stage. In fact, one of the nicest things about Posteo is its business ethics and data reduction policies, which involve keeping as little data about subscribers as possible, in order to eliminate the risk of data mishandling and hacking.
Subscribers can choose to pay via cash through the post, PayPal, bank transfer, credit card, or using a voucher. Posteo also offers a 14-day money-back guarantee. So even though you can’t try the email service for free - you can change your mind and get a refund if you don’t like it. I asked Posteo why it doesn't accept Bitcoin. The firm told me: "We are a sustainable enterprise which can not be said of Bitcoin. We are skeptical about the blockchain's energy requirements as well as the unclear origin of the energy used. Our bank transactions are more ecological and are documented for us as being sustainable. The currency's volatility is also problematic. This does not constitute economic sustainability." Which is fair enough.
Features
For a Euro a month, users get access to the following primary features:
- Two alias addresses (sadly no .com addresses available)
- 2 GB email storage account (can be upgraded to 20 GB at a cost of 0.25 EUR per month for each additional GB)
- Email attachments up to 50 MB in size
- Upload multiple files
- Cross-device compatibility thanks to IMAP/POP3. subscribers can synchronize their email on their smartphones, tablets, or PCs
- E2E email encryption with PGP
- and OpenPGP header compatibility
- Spam and Virus filter (with the ability to whitelist)
- Customizable filters - for sorting emails automatically as they arrive
- Unlimited filter addresses for keeping your inbox tidy
- Users can securely migrate up to three external email accounts over to
- List or conversation view
- Signatures
- Auto Reply (for when you are away on holiday, for example)
- Forwarding
- Fast search
- HTML emails
- Calendar
Privacy
Posteo does not require users to provide a name, address, or a backup email to open an account. As part of its data reduction policy, Posteo promises not to collect any user data - or to retain any traffic data (such as IP addresses) in connection with an account. Posteo anonymizes all subscription payments. It also ensures that payment details are never held alongside details of the email account itself.
This means that users are safe to pay with a credit card or PayPal. The only thing that authorities could ever find out about you, is that your PayPal account (or credit card) opened a Posteo account on a particular day. It is worth noting that tax laws do compel to retain payment information for 10 years.
Security
Posteo implements strong AES encryption on all its email servers to protect against hackers and other unwanted intrusions. Fundamental access to servers is encrypted (TLS with Perfect Forward Secrecy [PFS] for IMAP, POP3, webmail, CardDAV, and CalDAV). Posteo also implements IP stripping. This guarantees that neither your local nor public IP address is ever attached to an outgoing email.
Email metadata is protected during transmission using TLS with Perfect Forward Secrecy (PFS) - as long as the recipient’s email also supports it. A TLS delivery notification feature ensures that emails are not sent if the recipient’s account does not support TLS (users are notified and given the option to send the email without encryption).
PGP E2E email encryption is also available in the webmail client but will require you to install an addon called MailVelope. Users can also choose to encrypt their inbox, though this will have some repercussions in terms of functionality (email searching ceases to work). Incoming emails can be encrypted using your private S/MIME or OpenPGP key.
This means that you don’t have to trust Posteo’s inbox encryption if you don’t want to. For the most security-conscious, holding your own keys is definitely the way to go. Finally, Two Factor Authentication (2FA) is available for all accounts. Users can select to use TOTP apps like Google Authenticator, but Posteo recommends FreeOTP by Fedora because it is open source. Users with a YubiKey can use that for 2FA if they prefer.
The Process
Opening an account with Posteo is extremely easy and doesn't take longer than a minute or two.
The only data necessary is:
- A username (this can be an anonymous pseudonym)
- A Password
- A payment method (Cash, Paypal, bank transfer, credit card, or with a voucher)
One thing I was slightly disappointed by was the lack in availability of .com addresses. A .com address is an advantage to any business or individual who relies on people being able to remember their email address. As long as you are happy with an email address ending in .net, .org, .de, .co.uk, .af, .jp - or one of many others, Posteo could be for you.
The Posteo Roundcube client
The Posteo webmail client is based on Roundcube, an open source client. However, Posteo’s implementation of Roundcube comes with a lot of extra features when compared to the standard Roundcube client. In the top right-hand side, you get a menu with the following tabs: Email; Address Book, Calendar, Notes, Settings, Help, and Logout.
As you can see from the image above, Posteo has an appealing and clean looking interface. You will also find Posteo easy to use - whether you intend to do techy things like encrypting emails - or simply want to use it as a bog standard email client to get away from the grasp of Gmail. If you prefer not to use the Roundcube client you do have the option to use Thunderbird, Android email, or whatever client you prefer.
One feature that I did find to be slightly cumbersome was Posteo’s threaded conversation view. Although it is a nice addition, it is not as well implemented as on Gmail. This is because it doesn’t include your responses - it only gives you the threads from emails sent to you. In addition, it does sometimes exclude contacts from a cc list - meaning that conversations can fall apart into multiple threads.
Another disappointment is the fact that the web client is not mobile browser friendly. This means anybody who prefers to log into their email via their mobile browser (to keep personal data off their mobile for data security reasons) isn’t going to enjoy their Posteo experience. I tried to use it on Chrome on my tablet but found I was forever having to zoom in and out because the text was the wrong size.
PGP Encryption
In order to use PGP encryption, I did first need to install the MailVelope add-on. Chrome users can get it in the Chrome Webstore and Firefox users can download it from the Mailvelope website. The good news is that MailVelope is pre-configured in the Posteo client, and, as soon as you install it a new button that says “Compose and encrypt” appears in the webmail interface.
To check it is working, click on it and if you see a MailVelope lock symbol in the text field the installation was successful. One problem with MailVelope (as opposed to client-native end-to-end encryption) is that it is not compatible with every popular email client.
Another thing to remember is that your private key for MailVelope is extremely sensitive. When you set up OpenPGP encrypted emails your private key is encrypted to a passphrase. It is essential that you choose a strong passphrase and that you take care never, ever to reveal it to anyone.
Your private key is used by you only to decrypt messages sent to you from people who have your public key. If someone gains access to your private key they will be able to read your encrypted messages and sign messages so that they seem to be from you.
Anybody who prefers to use Enigmail on Thunderbird can do so, and Posteo provides excellent guides for this and just about anything else you can think of.
Migration
In order to test migrating on Posteo, I imported a Gmail account. I used the walkthrough on the help section of the website and had no trouble whatsoever. Anybody wanting to import from AOL, Gmail, GMX, Hotmail, iCloud, Office 365, Outlook.com, or Yahoo! should find it easy because you can transfer your address book to Posteo by clicking just one button.
DANE fingerprint authentication
DANE is an outstanding DNS-based authentication method that checks the digital certificate fingerprints of other email providers. This allows Posteo to detect fraudulent certificates replaced by cybercriminals or state-sponsored actors. This is a superb feature, but it is only compatible with other email clients that support it such as Tutanota and ProtonMail.
If you do use DANE, a small green checkbox appears above your intended recipient's address to let you know whether the server you are communicating with is DANE-friendly.
No spam folder
Perhaps the most annoying thing about Posteo is that it has an automated spam response system without a spam box. This means that you will not be able to check whether an email you are expecting has accidentally been filtered away as spam. Although you can whitelist contacts to ensure they never get deleted as spam, you can’t whitelist emails from contacts you don't know - and weren’t expecting to get emails from.
Although this is a drawback, the good news is that the sender of an email that is rejected as spam is notified about why it was categorized as spam, giving them the opportunity to try again. In time, it is possible some might even decide this is an advantage of the service.
The website and customer service
Personally, I found the Posteo website to be absolutely fantastic. I enjoyed it both visually and because it provides a lot of valuable information about the service. There is literally nothing you can’t learn about the service on the website and its setup guides and walkthroughs are extremely well put together.
As far as customer service goes, I found the agents to be extremely helpful. Though admittedly their job is made easy by the abundant availability of content on the website for them to direct users to. One slight drawback is that doesn't have a ticket based system. This means you will be left wondering whether your question is being answered. That said, I did not have to wait longer than 24 hours to receive a response. I would recommend exerting a little patience if you do require some one-on-one time.
Conclusion
Posteo is easily comparable to popular private email services like Tutanota and ProtonMail. Although ProtonMail is regarded as the king of private email by some, in reality, there is nothing much that ProtonMail can do that Posteo can’t. In fact, Posteo has the option to encrypt all metadata - something that ProtonMail doesn’t actually do. What’s more ProtonMail costs in the region of five times more (you do get a bigger inbox allowance - but you can always pay for more with Posteo if you really need it).
With ProtonMail, you don’t require a separate extension to handle end to end encryption in the webmail client. It is also true that some email clients aren’t compatible with Posteo’s MailVelope implementation. This means if you intend to use the Roundcube Posteo client - you may have trouble sending and receiving e2e encrypted emails to some of your contacts. You could, of course, simply use Posteo with a different client such as Thunderbird to get around this problem.
Like Posteo, Tutanota is based in Germany. Tutanota is in the same price range as Posteo, and although Tutanota does have a few extra features (such as having the ability to send links to password protected messages) they are very, very similar. In addition, Posteo does come with the advantage of being more established than Tutanota.
To conclude, Posteo is a great email service well worth a look for anybody wanting to get away from more invasive email providers such as Google and Hotmail.
Pros:
- Costs just 1 EUR per month
- POP3 or IMAP for use on any client on OS X, iOS, Android, Windows, or Linux
- Emphasis on privacy, data reduction, zero tracking, green energy, sustainability, social justice
- Fully featured: Server-side email encryption, calendar and contacts, E2E with other clients/users if required, cross-client compatibility
- Email metadata can also be encrypted
Cons:
- Probably have to spell out '@posteo' to anyone who asks you your email address verbally
- Can't use your own domain
- No .com addresses available
- Located in a '14 Eyes' country
Shady