Purelymail: 10 months in

Personal email, as a feature of our technological landscape is both incredibly important—you can't have basically any online account without an address—and completely worthless except as a method of verification and looser, less urgent notification. It's also one of the deepest set hooks Google has into the lives of its users. Changing addresses is perceived as a pain and if you're like me, you have decades of archived mail weighing you down to the platform.

How did we get here? #Permalink to this heading

Email started around the same time that computers did, and its growth mirrored that of computers themselves, from un-networked computers in the 60s where messages were just being left for future users to read to the ARPANET where the @ symbol was introduced, allowing users to not only send messages to another user, but to another user on another computer over the network. As computer adoption accelerated in the 1990s, so too did email, as a way for users to not only communicate over the booming internet, but also for companies to keep in touch with their users and keep users distinct from each other. Email became a standard inclusion with internet connections, each ISP would give users an email address when they activated their service. Additional users would be allowed to make accounts later.

In 2004, Google announced (on April fools' day, no less) that they were launching an email service. The search company would allow users to have a whole gigabyte of online storage for their messages, a figure tens or hundreds of times larger than other free email providers at the time. Over time, the free storage expanded, eventually landing at the 15GB that every free Google account enjoys today. This large free storage bucket was one of the big factors that led the archive option to be so useful in Gmail. Messages were small. Filling up 1GB takes a long time, let alone 15.

It's difficult to express just how rapidly Gmail grew. At the time, people loved to be early adopters and the invite-only beta was a pretty unique thing. Even before the beta became open, there were millions of active gmail users. By the time it closed down in June of 2005, barely a year after Gmail's closed beta launched, the user-made Gmail Invitation Spooler had given out over 1.2 million Gmail addresses. The tool worked by accepting invites from folks who had extras and sending them to other users who requested them. Once Google truly opened the floodgates in 2007, Gmail addresses became completely ubiquitous. Even folks who were still using their ISP address were using Gmail to manage their messages via IMAP.

What's wrong with Gmail? #Permalink to this heading

Honestly, you could do a lot of work to make gmail work more like one of the private email providers out there, but there is always going to be some stuff that just simply can't be turned off, or that we can't trust has been fully disabled even when the features aren't being surfaced. There's just no way to fully audit the service.

By far, my biggest issue with gmail is privacy. Because email is by default unencrypted, Google can have their AI crawl and categorize every single message that passes through my inbox. Regardless of if I have anything incriminating coming to me or not, this is a massive breach of my privacy as a person and I don't like it. This is somewhat fixable for addresses you correspond with by adding a browser extension to enable PGP management and encryption on your messages, but that requires the person you're corresponding with to also have encryption set up. Now, keep in mind that this concern exists for literally every email provider in existence. As I said, email is not encrypted by default, so your provider will always have access to your messages unless you manually decide to enable encryption and ensure your recipients have your key. So, the biggest solution is to pay for a provider that you trust to not go snooping because they have no reason to and have committed not to via their terms of use and privacy policies

Secondary concerns with Gmail for me include the storage of information. Law enforcement agencies requesting email records only need a warrant for records that are from the past 90 days. Any amount of time before that, law enforcement does not require a warrant in order to seize information. This is why many organizations have a mandatory email retention policy of 90 days. Again, regardless of if there is any incriminating information in my email or not, the data requests sent by law enforcement agencies are often exceptionally broad and vague, which means my private email may be included when a law enforcement agent requests email related to a crime even though I may not be related to that crime whatsoever. Again, this is an issue with other providers too, but gmail routinely works with law enforcement and keeps the encryption keys to the data on their servers, meaning they can decrypt and provide your mail anytime they want. Again, the solution here is to pay for a provider that has policies that protect your data by design.

Finally, I have a lot of distaste for gmail thanks to Google's insistence that AI is the future. I do not want AI reading my mail to make summaries. I do not want AI trying to help me write my mail. I don't want AI anywhere close to my data. I don't want AI to be trained on my mail. Again, the solution is obvious. Pay for a service that doesn't use AI and maintains sane defaults for the storage and handling of data.

What are the options? #Permalink to this heading

In my research I found a few options. Here's the gist on each.

ProtonMail - Free - $4/mo - $10/mo #Permalink to this heading

One of the more popular options out there. The free tier is kind of limited in that you only get 1GB of space for your mail, but it's hosted in Switzerland. This means that, although they do work with law enforcement, the requirements for them to provide user data are very high and user data is encrypted with the user's keys, which means they are just providing an encrypted blob anyway. The $4/mo tier includes 15GB, a custom email domain, and 9 extra addresses all routed to the same inbox. The $10/mo tier includes all of their services, like online office software, VPN and a password manager, extra storage space (500GB) and more extra addresses, still all routed to one user.

While the feature set and pricing feel more or less fair, I felt that it wasn't really worth it for me. Nearly $50 a year is still just too much for me for email unless there are a lot of features I would actually use. Extra addresses are nice, but unless they are their own inboxes, it's less interesting to me.

Fastmail - $5/mo - $8/mo - $11/mo #Permalink to this heading

Another common recommendation. This one is better structured for families. The base tier is for one account, the mid-tier is for two, and the top tier is for 6. Not a terrible value if you're going to be sharing the service with family. The storage space is bigger too, but they don't pair it with other services, so it's just a big inbox. The big negative here for me is that it isn't zero access. Fastmail holds the keys to your encrypted data, so if they have a rogue employee or a government request, your data isn't completely safe.

The security part of it is a problem for me and the price is still pretty steep at $60/yr. They do support custom domains and extra addresses, but again, it's all routed to a single user.

Purelymail - $10/yr - Usage Based Pricing #Permalink to this heading

Purelymail is way stripped back compared to the other two. They aren't interested in rapid growth. They just want to provide email in a very simple way to people. One paid account gets you administrator access over as many users as you need. Each user has their own address and inbox. All data is encrypted with the user passwords, which are only stored as salted hashes, so even if data is requested by an outside party, Purelymail can't decrypt it for them. There's also no hard caps on data storage or sent/received mail, only that if you exceed the cost of the simple pricing $10/yr plan, you may need to be switched to a usage based plan where you pay additionally based on how much you are using the service.

There's problems here too. The service's staff is very small, so new features aren't developed very quickly. They've been working on an inhouse webmail setup for a while (the service currently uses Roundcube for webmail) but it's not ready yet. The small team also means that there's not much in the way of slack in case something bad should happen to the folks running things. IN the end, this is where I landed. The personal touch and extremely good pricing, with a focus on running the business rather than marketing or growth is much more in line with my ideal of a sustainable internet, so I'd like to put my money where my mouth is.

Using Purelymail #Permalink to this heading

So, I did the research and decided on a provider. How was the experience? Well, in a word... boring. Yeah I know, you're looking for a whole review of this thing and my experiences trying it out, but email is boring. It's supposed to be boring. Well, in the ways I use it anyway.

Let's start where I started. I started with the free trial, which is just a real account. They just give you a trial credit that lasts about a month with regular usage. There's no requirement to attach a credit card or other payment to the account either. I made my administrator account address, set up a password and a phone number for account recovery, just in case, and was dropped into the account administration section of the website. Nice and easy.

This is where most users will be faced with a decision. Use the admin account as your email account, or create a separate user to handle your email? By default, your admin account will use one of Purelymail's domains. After setup, if you want to add a custom domain, you can. In my case, I wanted to leave my admin account alone and have a separate non-privileged user account. This is a good security practice because if I use my non-admin user account and it gets compromised somehow, my admin is still safe. I can reset the user account's password using the admin account and regain control quickly without needing to go through support.

Because I wanted to use a custom domain, my first stop was the domain section. The onboarding process is very simple. Just copy and paste the DNS records that Purelymail provides into the DNS section of your domain registrar. There's a fair number of them, but they tell you which are optional and what each one does. A notable addition here since I set up my domain is the Service records for Mozilla and Microsoft. These allow Thunderbird and Outlook to properly import your email server settings automatically, which is really nice. After hitting the test button and confirming the records were set right, my domain was all set up.

After adding my domain, it was time to provision a user. I flipped over to the users tab. The setup was also simple here. I set up a new address on the domain I'd added earlier, set the password, added a timed one time password provider and security key as 2FA methods, ensured my indexing and password reset options were set, and tested it by logging into the webmail portal. All good.

Next, I just needed to add my new account to Thunderbird on my desktop and phone and log in. When I started using the service, I needed to manually enter all of the server settings, but now the service records should handle it. One non-standard thing I had to do was generate an app password for the account because Thunderbird can't log me in with 2FA, so I had to go back in to the user management page, generate one, and paste it in to THunderbird.

I immediately did some testing, making sure I could send and receive mail from my old gmail address to the new one. After confirming everything was working, I set up an email forward in gmail. Everything that gets sent to my old address is forwarded to the new one. I used this fact and my password manager to start changing addresses on accounts. This was the biggest slog. Since no one really emails me much personally, I didn't bother updating my contacts, simply replacing the gmail address with the purelymail address on my own contact card instead.

As I was starting to move accounts around, I realized that I had a huge security benefit now. I could spin up as many addresses as I wanted and selectively forward mail to my main account. I created a few new addresses that all forward to my main one. Those other addresses are (variably) set up to only access single important accounts or as dumping grounds for throwaway accounts. All the mail eventually makes it to my main inbox, but if they're ever hacked or somehow leaked in a breach, any attacker would have a limited surface to hit me from and if I needed to I could just nuke the inbox entirely. It also means I can get throwaway accounts linked to my real domain or other known domains so that they have reputation enough to sign up for websites. If it's sketchy, I now have a secure way to receive the message and delete the mailbox that account is hooked up to. This same benefit allowed me to make a couple of addresses with automatic reply rules because they were set up to real inboxes and use those for my game jam game this past August. If you played PS Bazooka, then you probably emailed one of these accounts!

After using this setup for a few weeks, I happily signed up for the simple plan. $10/yr. No sweat. $0.82-0.85 (it modulates to come out as an even $10/yr) per month for email is pretty darn good, right? Well, it gets better. Purelymail says on their advanced pricing calculator, "In most cases it's cheaper than simple pricing." and sure enough, when I checked my usage, which Purelymail still quotes the advanced pricing cost for even if you're on the simple pricing plan, I would have been charged at most $0.38 for one month's worth of usage. Even if I used that much email every single months, I would only be paying $4.56 a year for mail. So I took this opportunity to swap to the advanced pricing model.

In the end, I'm very happy with purelymail and highly recommend making the switch to it. The one warning I'll give is that, while you absolutely can give user accounts to whomever you wish, they should absolutely be made aware that you can reset their password at any time and read their mail. They need to be able to trust you. I just use it for myself, so it's a non-issue, but that's a disclosure thing I would absolutely tell any friends that I was giving access to.