Email Service Recommendations (Forward Email RFI x Re-evaluation of Existing Services)

For statistical credibility, here’s the growth change versus January 2024, which still shows we are the leader in custom domains when compared to current recommended email services:

Provider Domain Names
(2024 via SecurityTrails)
Domain Names
(2025 via ViewDNS)
Percentage Change MX Record
Forward Email 418,477 506,653 +21.1% mx1.forwardemail.net
Proton Mail 253,977 334,909 +31.9% mail.protonmail.ch
Fastmail 168,433 192,075 +14% in1-smtp.messagingengine.com
Mailbox 38,659 43,337 +12.1% mxext1.mailbox.org
Tuta 18,781 21,720 +15.6% mail.tutanota.de
Skiff (defunct) 7,504 3,361 -55.2% inbound-smtp.skiff.com
2 Likes

Your posts here seem more PR than genuine engagement. As does much of your website.

For instance on your website here: Frequently Asked Questions you state that Netflix uses your services. Without any qualifiers. But a simple MX lookup shows the following https://ibb.co/jP4M8Qf6

Your homepage states “We’re the world’s first and only email service to use quantum-resistant and individually encrypted SQLite mailboxes”. Which carefully ignores the fact that other providers have quantum-resistant encryption. Just not implemented in the same way as yours.

You need to drop the superlatives and stop trying to compare yourselves to everyone else in an underhand manner. Then perhaps you might gain trust.

Hi there - we’ll look at adding another column for MX verification.

dig games.netflix.com mx +short
10 mx1.forwardemail.net.
10 mx2.forwardemail.net.

Ref: https://mxtoolbox.com/SuperTool.aspx?action=mx%3Agames.netflix.com&run=toolpage

These and other statements made are simply not true and not verifiable. Other services do not use ChaCha20-Poly1305, nor do they share the source code for independent auditing. Additionally, individually encrypted and sandboxed mailboxes have vast security advantages. If you can share a link to the source code and/or independent 3rd party audit of other providers that prove your statements, please do.

Thanks for that. So you only supply services to a subset of their operations?

I also took the time to go through the rest of the table for you.

Entity Main domain First Mx Record
U.S. Naval Academy usna.edu aspmx.l.google.com
Canonical canonical.com mx.canonical.com
Netflix netflix.com aspmx.l.google.com
The Linux Foundation linuxfoundation.org aspmx.l.google.com
The PHP Foundation thephp.foundation mx1.forwardemail.net
Fox News Radio radio.foxnews.com No Mx records foxnews.com mxa-00195501.gslb.pphosted.com
Disney Ad Sales disneyadvertising.com mx1.forwardemail.net
jQuery jquery.com mx1.forwardemail.net
LineageOS lineageos.org mx1.forwardemail.net
Ubuntu ubuntu.com mx.ubuntu.com
Kubuntu kubuntu.org mx.ubuntu.com
Lubuntu lubuntu.me mx.ubuntu.com
The University of Cambridge cam.ac.uk mx.cam.ac.uk
The University of Maryland umd.edu mx1.umd.iphmx.com
The University of Washington washington.edu mxa-00641c01.gslb.pphosted.com
Tufts University tufts.edu ppagent-prod-01.uit.tufts.edu
Swarthmore College swarthmore.edu aspmx.l.google.com
Government of South Australia sa.gov.au sa-gov-au.mail.protection.outlook.com
Government of Dominican Republic gob.do No Mx records
Fly.io Fly.io aspmx.l.google.com
RCD Hotels rcdhotels.com aspmx.l.google.com
International Correspondence Chess Federation iccf.com inbound-smtp.eu-west-1.amazonaws.com
Isaac Z. Schlueter (npm) izs.me mx1.forwardemail.net
David Heinemeier Hansson (Ruby on Rails) dhh.dk mx1.forwardemail.net

I may have missed something on the other threads. But can you also share a link to a 3rd party audit of your quantum encryption please? EDIT: As if you demand it of others you need to show it yourself.

And here are some details of Tuta’s post quantum encryption. Tuta Launches Post Quantum Cryptography For Email | Tuta . And yes, I know that their server side code is not open-source. But the encryption process can take place in the open-source apps.

  • US Naval Academy uses us for navalacademyclub.com and usnavalacademyclub.com
  • Linux Foundation uses on linux.com and 275+ others (e.g. jquery.org).
  • Canonical uses us for their domains ubuntu.com, kubuntu.org, lubuntu.me, edubuntu.org, and ubuntu.net. Instead of doing a MX lookup on those domains, use a TXT lookup, as they have advanced Postfix routing to “relay” to our servers. You can see they have the forward-email-site-verification=xxx record in their TXT records. Also see Ubuntu discussion at https://discourse.ubuntu.com/t/ubuntu-member-email-perk-update/61174.
  • Fly.io uses us for customer.fly.io
  • Swarthmore, UMD, Tufts, and Cambridge all use us for alumni-related domains (e.g. terpalum.umd.edu, alum.swarthmore.edu, alumni.tufts.edu, cl.cam.ac.uk, cst.cam.ac.uk).
  • Carnegie Mellon academy.cs.cmu.edu
  • University of Washington email.msimonline.ischool.uw.edu
  • Government of South Australia expiations.sa.gov.au
  • RCD Hotels uses us for their hotel bookings and to hide customer info (private domain)
  • We’re removing ICFF and and Gov DR is redacted for now
  • Fox News Radio domain used is foxnewsradio.com
2 Likes

Thank you for the clarification. I should have thought to do a TXT lookup as well for those ones!

It does show how exaggerated some of your claims/marketing is when you state that an entire entity uses your services but it turns out to only be a small subset of it.

That’s usually how it is done if you visited any website that have “trusted by” section, will just show company/entity name not exactly what service or product they use it for.

3 Likes

@forwardemail do you guys think your product also qualifies to be added to Self-Hosted Email - Privacy Guides too?

Unfortunately, this page lacks a criteria.

1 Like

Yes 100%! We have an interactive CLI installer, Docker image (auto-published based off SemVer GitHub releases), and several guides:

Thanks for sharing that.

2 Likes

Quick question - Am I understanding correctly that to use the service you are required to bring your own domain name? Also, that there is no web interface?

@CarefulMouse - Thanks for asking these questions. I think this was the reason why I passed on Forwardmail when looking for a secure email service. I wanted to blend in instead of having a custom domain that’s more traceable.