Posteo vs mailbox.org for Private Email: Two German Approaches

Posteo vs mailbox.org for private email is a narrower comparison than it looks. Both are long-running German providers, both take standards seriously, both let you sign up without giving a name, and both accept cash. Neither is an encrypted walled garden in the Proton or Tuta sense — they are ordinary IMAP mailboxes with unusually strong privacy defaults.

So the interesting axis is not "which one is more private". It is what each one refuses to do. Posteo refuses to host your own domain, and says why. mailbox.org refuses to stay small, and ships an office suite around the mailbox. Everything else in this comparison follows from those two refusals.

The verdict up front#

If you want email at your own domain, the comparison is over before it starts: choose mailbox.org. Posteo does not support custom domains and is not planning to. Its FAQ states the position plainly — "We are an email provider with a particular, privacy-oriented model – and this is not compatible with incorporating own domains" — because registering a domain requires a name and an address, and storing the domain-to-account mapping would create exactly the user record Posteo is built not to hold.

If you want the smallest possible footprint and are content with an address on the provider's domain, choose Posteo. Its crypto mail storage encrypts content, attachments and metadata behind a key protected by your password, which is a wider blast radius than the incoming-mail PGP encryption mailbox.org offers through Guard.

If you want a mailbox plus calendar, contacts, tasks, cloud storage, documents and video calls under one German provider — or you need to administer accounts for a small team — mailbox.org is the only one of the two that competes for that job. Posteo ships a calendar and an address book and stops there, deliberately.

Posteo vs mailbox.org at a glance#

Where Posteo wins#

Posteo's advantage is that there is less of it. The signup form does not ask for a name or an address, so there is no identity record to leak, subpoena or mis-handle later. Posteo states that it answers authority requests for customer names and addresses in the negative, because it does not have them.

The second win is the scope of its at-rest encryption. Posteo's crypto mail storage "encrypts all email data (content, attachments and metadata)" using RSA for the key and AES with HMAC for the data, with the key protected by your password. Metadata is the part most providers leave in the clear, and it is often the part that says the most about you.

Posteo also does the unglamorous transport work. It has supported DANE/TLSA since 2014, sends over TLS with forward secrecy, and offers a TLS-sending guarantee setting that refuses to hand mail to a receiving server that cannot take an encrypted connection. That last option is a deliberate deliverability trade — mail you would rather bounce than send in the clear.

Finally, Posteo is one product with one plan. Storage and aliases are metered add-ons rather than tiers, so you are never buying a bundle to reach one feature. If you find plan matrices exhausting, that simplicity is itself a feature.

Where mailbox.org wins#

Custom domains are the headline, and they are not a small thing. Your own domain is the only portable email identity there is: it means a future move between providers costs you a DNS change instead of telling three hundred contacts a new address. mailbox.org supports domains you own and gives you aliases on them, with the alias allowance rising at higher tiers.

The second win is everything around the mailbox. mailbox.org ships calendar, address book, tasks, Drive cloud storage, Office documents and Meet video calls, plus an Admin module for central management of all accounts. If the reason you are leaving a large provider is that you want one European supplier for the whole bundle, Posteo cannot answer that brief and mailbox.org can.

On encryption, mailbox.org is stronger on interoperability rather than on coverage. It runs its own HKPS key server so correspondents can automatically retrieve its users' verified public keys, lets you drop a valid S/MIME certificate into Guard to sign and encrypt automatically, and offers "PGP in the webmail client, without the need for additional software". Posteo's webmail encryption depends on browser add-ons instead.

It also publishes third-party assurance. mailbox.org states ISO 27001 certification and BSI C5 attestation, which matters if you have to justify the choice to someone else — a client, a works council, a compliance reviewer. Posteo's argument is its architecture; mailbox.org's argument is its architecture plus an auditor.

The custom domain question, which decides most cases#

Most "which private email provider" arguments turn out to be this one question wearing a disguise. If your address has to be [email protected], Posteo is out — and it is out on principle, not on roadmap, so waiting will not help.

It is worth understanding Posteo's reasoning rather than reading it as a missing feature. Its FAQ explains that even if only your MX record pointed at Posteo, it would have to store the assignment of that domain to your account as user information, and hand it over when an authority asked. The absence is the product.

The practical cost of that absence is lock-in. An address on a provider's own domain is a rented identity; if you ever leave, every service, contact and account recovery path tied to it has to be updated by hand. That is not a reason to reject Posteo, but it is a cost to price in before you spend three years accumulating correspondence there.

How each one is packaged#

We do not print competitor prices, because both providers revise them and a stale number in a blog post is worse than no number. Read the current figures on posteo.de and mailbox.org directly. What is stable enough to describe is the shape.

Posteo sells one plan and meters the extras: a base mailbox with a modest storage allowance, extra gigabytes charged per gigabyte per month, and extra aliases charged per alias per month. Nothing is gated behind a tier — you pay for the quantity you use and every feature is in the box.

mailbox.org sells tiers, for private and business customers, with mail storage, Drive storage and alias allowances all stepping up as you move through them. The entry tier is a mailbox; the higher tiers are a small office suite. Custom domain support and the Admin module belong to that tiered logic, so check which tier includes the thing you are actually buying for.

On the "cheapest private email provider in Europe" question: both of these sit at the inexpensive end of the market, and which is cheaper for you depends entirely on how much storage and how many aliases you need. A single lightly used mailbox and a 50 GB mailbox with a domain and twenty aliases are different purchases, and they rank differently.

IMAP, clients, and how easily you can leave#

Both providers support IMAP, POP3 and SMTP, so you are not confined to their webmail. That is the quiet thing they have in common and the thing that separates them from end-to-end encrypted providers that require a bridge application to speak to a normal mail client.

It means you can use Apple Mail, Thunderbird, Outlook, a mobile client or anything else that speaks the protocol, and it means your mail can be pulled down and moved somewhere else without a proprietary export. Posteo also offers a migration service that pulls in up to three external accounts with their folder structures when you arrive.

The caveat is encryption. Once mail is encrypted at rest to a key the server cannot use, what a client can do with it changes — search and server-side filtering are the usual casualties. If IMAP-client freedom and full mailbox encryption are both non-negotiable for you, test that combination on a trial account before you migrate ten years of archive.

Who each is genuinely for#

Choose Posteo if you are one person, you want an address that is not tied to your legal identity, you want at-rest encryption that covers metadata, and you are comfortable on a posteo.de or posteo.net address. It is the better answer for the journalist, the activist and the privacy-first individual who wants the provider to know as little as possible.

Choose mailbox.org if you want your own domain, if you want calendar, files, documents and video under one roof, if you administer a handful of accounts for a small business or family, or if someone will ask you for a certification you can point at. It is the better answer for a small organisation and for anyone building a long-term identity they can take with them.

If neither constraint binds — no domain requirement, no suite requirement — the honest answer is that both are good and the decision is low stakes. Pick the one whose webmail you prefer after a week of use.

A third option, honestly#

Neither of these is a mail client, and that is the gap we sit in. We build AI Emaily, an AI-native email client — it does not host mailboxes, does not sell you an address and does not give you a domain, so it is not a replacement for either provider on this page. It connects to the mailbox you already chose, over IMAP, and does the reading-and-triage work on top of it.

That matters here for one specific reason: both Posteo and mailbox.org are deliberately thin above the protocol. You get a solid mailbox and a plain webmail, and whatever triage discipline you bring yourself. If you have picked a privacy-first German provider and then find yourself hand-sorting a few hundred messages a week, the missing piece is a client, not a different provider.

AI Emaily reads your connected accounts, sorts what arrived, drafts replies and closes loops, with approve-before-send as the default and an audit trail behind every action. Voice matching comes from a Personal Context brain you set yourself plus per-client profiles — not from mining your sent mail. We do not train models on your mail. Pricing is on our pricing page; there is no permanent free tier, just a 7-day free trial on Pro and Autopilot with a card required and nothing charged if you cancel before day seven.

The trade-off deserves stating plainly, because this audience will spot it anyway. If you turned on Posteo's crypto mail storage or mailbox.org's Guard specifically so that no server can read your mail, then adding any AI client — ours included — reverses part of that decision, because a model has to see message content to act on it. That is a real cost and only you can price it. If your threat model is commercial surveillance and ad profiling rather than zero-knowledge storage, the combination works; if it is the latter, stay with the plain webmail and we would rather say so.