Is your email inbox truly private — and who really controls it?

You open your inbox every day. But who’s really looking over your shoulder? Most email providers treat your messages not as private conversation, but as data to be harvested, analyzed, and monetized—even if they promise “privacy.”

Even companies like Proton Mail and Fastmail claim to protect your data. But their underlying models differ in ways that matter: one is a non-profit built from public funding, the other a privately held company with a long-running business model. The real question isn’t just which is more private—it’s who can access your messages, when, and under what conditions.

Key takeaways

  • Proton Mail uses end-to-end encryption by default for all users, with data stored in Switzerland under strict legal protections.
  • Fastmail offers strong encryption at rest and in transit, but does not use end-to-end encryption by default—your messages are decrypted on Fastmail’s servers.
  • Ownership and transparency matter: Proton Mail is non-profit with a public mission, while Fastmail is privately owned and may prioritize profit over user control over time.

Proton Mail vs Fastmail: Which is better for real control over your data?

You should choose Proton Mail if you prioritize jurisdictional privacy and end-to-end encryption for messages sent between Proton users. Fastmail offers excellent speed and features but processes your messages on its servers, meaning it can comply with legal requests. For true control over your data, Proton’s Swiss-based model and E2EE-by-default for Proton-to-Proton mail provide stronger guarantees. But if you need a full workspace suite with global infrastructure, Fastmail’s performance may outweigh its legal exposure.

Swiss law vs. multi-jurisdictional exposure

Proton Mail stores your data in Switzerland, governed by strict privacy laws and a long tradition of banking secrecy. Swiss jurisdiction limits forced data access, and the company is legally required to resist government requests unless under exceptional conditions, per independent academic analysis of Swiss data protection frameworks. This makes Proton a strong choice for users concerned about geopolitical risks.

Fastmail, in contrast, operates servers across the US and UK—jurisdictions with broad government access powers. While Fastmail publishes transparency reports and claims to resist unwarranted requests, all your messages are decrypted on their servers. This means they can be accessed under court orders or lawful interception, as confirmed by EFF guidance on server-side encryption models.

Encryption: E2EE by default vs. server-side processing

Proton Mail claims end-to-end encryption (E2EE) by default, but it only applies when both sender and recipient use Proton. If you email someone outside Proton, the message is stored decrypted on Proton’s servers, meaning even Proton cannot access it during transit—only you, the recipient, and Proton can. Still, this is E2EE across the entire ecosystem for Proton users.

Fastmail uses server-side encryption only. Your messages are decrypted upon arrival and re-encrypted only for storage. This means Fastmail can read your messages at any time—whether for backups, search indexing, or legal compliance. This is not E2EE. As the RFC 6476 standard explains, true E2EE must prevent the server from reading content—Fastmail’s model doesn't meet this bar.

For users who want real control, this difference matters. If your data ever ends up on a server you can’t audit, it’s not truly under your control. Unifiedesk gives you the choice: self-host your data, or use our hosted platform where all messages and files are end-to-end encrypted, meaning we cannot read them—even if legally compelled.

How do SPF, DKIM, and DMARC work in practice for custom domains?

SPF, DKIM, and DMARC aren't magic—they're a trio of DNS records that stop spoofing, verify your messages, and enforce policies to protect your domain’s reputation. SPF lists your authorized mail servers, DKIM signs each email with a unique digital fingerprint, and DMARC tells receiving servers what to do when SPF or DKIM fails—like rejecting or quarantining the message. Together, they’re the backbone of email authenticity.

Setting up your domain’s email security: a step-by-step guide

  1. Add your sending mail server to SPF—for example, if you use Fastmail or Proton, include v=spf1 include:fastmail.com ~all or v=spf1 include:protonmail.com ~all in your domain’s DNS. This tells receiving servers: “Only these servers can send mail from my domain.” Without it, your emails risk being flagged as spam.
  2. Enable DKIM signing—both Proton and Fastmail generate DKIM keys for your custom domain, but you must publish the public key as a TXT record in your DNS. This adds a cryptographic signature to every outgoing message. Receiving servers verify it, proving the email truly came from your domain and wasn’t altered in transit.
  3. Set up DMARC to enforce your policy—create a DMARC record like v=DMARC1; p=quarantine; rua=mailto:[email protected] and publish it in DNS. This tells email providers what to do if SPF or DKIM fails, and sends you reports on sender activity. It’s your reputation shield.
  4. Test your configuration with tools—use MxToolbox or Spamhelp’s DMARC checker to verify your records are live and well-formed. A misconfigured DMARC can break delivery.
  5. Monitor and adjust—you’ll get aggregate reports from the email providers. Use them to detect unauthorized senders, identify misconfigurations, and refine your policy over time.

Why neither Proton nor Fastmail automates this for you

No major email provider—including Proton or Fastmail—automatically configures SPF, DKIM, or DMARC for new users with a custom domain. Why? Because you control the DNS, and only you know your sending infrastructure. Automating it would risk misconfiguration, which harms deliverability and reputation.

That said, Unifiedesk makes it easy. You can set up custom domains in minutes with fully generated, correct DNS records—SPF, DKIM, DMARC—provided in real time via your dashboard. Try it now—no manual DNS editing required.

Private email, calendar, or self-host your data with full control, end-to-end encryption, and built-in email security.

Can you trust the encryption claims of email providers?

Not all encryption is equal. Proton Mail and Fastmail both use strong encryption, but neither offers end-to-end encryption for every email you send — especially when messaging outside their networks. Your messages to Gmail or Outlook remain plaintext on their servers. True end-to-end encryption across all flows only exists with self-hosted solutions or tools like Unifiedesk that encrypt everything at rest and in transit with user-controlled keys.

Proton Mail: E2E only inside the network

Proton Mail encrypts email content only between its users — when you send a message to another Proton user, it’s E2E encrypted and never stored in plaintext. But if you email someone on Gmail or Outlook, Proton delivers the message in plaintext to the receiving server, meaning your message is stored unencrypted on Proton’s infrastructure. This is the same model used by most mainstream email providers, including Microsoft 365 and Google Workspace. The real security benefit only applies within their walled garden.

Fastmail: Encrypted at rest, not E2E

Fastmail stores emails encrypted at rest using AES-256, which is industry standard. But unlike self-hosted or E2E services, Fastmail holds the decryption keys. That means Fastmail can access your messages if they want to — even if they’re technically protected from hackers via encryption. This level of control doesn’t match the principle of “you, and only you, hold your keys.” It’s secure from external threats, but doesn’t guarantee privacy from the provider itself.

There’s a reason this matters: your email provider is the only entity that can access your message history by default. You’re not just trusting technology — you’re trusting the policies, access logs, and integrity of another company. As RFC 8314 outlines, encryption at rest doesn't solve legal or operational access risks unless keys are user-controlled.

Let’s be honest: no major hosted email service outside of niche or self-hosted tools gives you true end-to-end control across all email flows. Even if Fastmail or Proton claim “strong security,” those claims don’t extend to all your messages — especially those crossing their network boundaries.

If you want encryption that truly follows your data — wherever it goes — you need a system where your keys are never shared with a third party. That’s why self-hosted options like Unifiedesk exist. With Unifiedesk, every message and file is encrypted at rest using AES-256-GCM under your personal key, and your data never leaves your control. Even in hosted mode, the platform enforces end-to-end encryption across all communications — not just internal.

When choosing between Proton Mail and Fastmail in 2026, ask: do you trust the provider with your entire email history — including messages outside their ecosystem? If you want real privacy beyond marketing claims, the only answer is full user control. Which means: self-hosted, or a tool that actually gives you E2E encryption across every message.

What happens when you leave a hosted email service?

You can export your emails from Proton Mail and Fastmail using IMAP or their built-in tools, but not all data survives the move—read status, folder structures, and some metadata often vanish. Even with a paid plan, Proton’s IMAP access is limited, and Fastmail’s export tools don’t preserve every detail. Migration is never seamless: it demands planning, patience, and acceptance that some data is lost.

IMAP access isn’t always the safety net you think

Proton Mail lets you use IMAP, but only on paid plans—and even then, you’re restricted to syncable messages, not every email in your archive. Some flagged messages, drafts not fully saved, or encrypted notes may not appear at all. If you rely on IMAP for backup or migration, the incomplete sync can leave gaps. Fastmail supports IMAP more fully, but again, it’s not perfect: it won’t carry over custom metadata like read/unread flags or server-side filtering rules.

Export tools fall short—especially with metadata

Fastmail offers richer export options than Proton, including full message exports via their web interface. But even here, folder hierarchies don’t always migrate cleanly. You’ll get the raw content, but not the organizational logic you built over years. Proton’s export is even less capable: it doesn’t expose metadata at all, and the process is slow and manual. For example, read/unread states, star status, or custom labels will not transfer—something that matters if you’ve used tagging as your primary organization system.

It’s not just about email content. When you move out, you lose the ability to edit or access data in the original platform’s interface. If you’ve used shared folders, team features, or built-in tools like calendar syncs or notes tied to certain messages, those connections break. Even if the text survives, context often doesn’t.

Industry standards like RFC 3501 (IMAP) or RFC 5248 (message tagging) don’t require providers to preserve every metadata detail across systems. What you export depends on what the service chooses to expose—and both Proton and Fastmail limit this intentionally for security or performance reasons.

If you're serious about control, consider a self-hosted solution. With Unifiedesk, you own every backup, every folder, and every key. All messages and files are encrypted with AES-256-GCM under per-account keys—your data never leaves your control. You can export anything via standard protocols, and there’s no risk of hidden limitations. Self-hosting with Unifiedesk ensures you aren’t locked into a vendor’s export policy.

How does Unifiedesk compare when you want full control?

You don’t just choose Unifiedesk for privacy — you choose it because you own your keys, your data, and your server. Unlike Proton Mail or Fastmail, where encryption is applied at scale but access is still managed by their infrastructure, Unifiedesk gives you complete control: either through a fully managed hosted service with client-side end-to-end encryption, or by self-hosting the entire stack with AES-256-GCM encryption under per-account keys. No backdoors. No server-side access. Ever.

Hosted: End-to-end encryption by default

The hosted Unifiedesk platform is end-to-end encrypted across all features: mail, calendar, drives, documents, and even video meetings. This means your messages and files are encrypted on your device before they leave, and only you can decrypt them. The service never sees your data in plaintext — not during transit, not at rest, not even when syncing across devices. This approach aligns with the principles outlined in RFC 8314, which emphasizes encryption as a foundational requirement for privacy-respecting systems.

Self-hosted: Full sovereignty over your stack

If you want absolute control, self-hosting Unifiedesk is the ultimate option. You install it on your own server or infrastructure — no cloud vendor, no third-party logs. Every message and file is encrypted at rest using AES-256-GCM, with unique keys per account. Your private key never leaves your device, and no employee, vendor, or automated system can access your data — even in the event of a breach. This is how high-security organizations manage digital sovereignty.

Unlike Proton Mail or Fastmail, where you're relying on their infrastructure, Unifiedesk lets you choose who runs the server, where it’s located, and how it’s configured. You can even use custom domain names with full control over DNS records like MX, SPF, DKIM, and DMARC — all generated automatically via our custom domain setup tool. No manual edits. No guesswork.

You can use JMAP and IMAP/SMTP to connect to any standard email client — Apple Mail, Outlook, Thunderbird, or mobile apps — just like you would with Proton Mail or Fastmail. The protocol support is not a compromise; it’s a design choice: interoperability without sacrificing security. The same applies to calendar sync via CalDAV, file sharing with standard webDAV, and meetings with screen-sharing — all secured end-to-end.

For teams, admins can manage shared mailboxes, user access, and encryption keys via the self-hosted option. With open-source code, transparent architecture, and no telemetry, you’re not trusting a black-box provider — you’re running your own secure ecosystem. That’s not just privacy. It’s ownership.

Is a custom domain really yours when you use Proton Mail or Fastmail?

You can use a custom domain with both Proton Mail and Fastmail, but you're still locked into their infrastructure. If they shut down, change their terms, or stop supporting your domain, your email service vanishes — and there's no clean way out. You're not in control; you're just renting access to your own domain.

Infrastructure dependency isn't freedom

Both Proton Mail and Fastmail let you connect your custom domain, but you’re relying on their systems for mail delivery, storage, and security. Your inbox lives inside their data centers, governed by their policies and uptime. Even if you set up SPF, DKIM, and DMARC records, you’re not managing the actual mail server — just configuring DNS pointers.

If Proton Mail or Fastmail decides to deprecate custom domains, remove support, or shut down entirely, your domain doesn't become a self-hosted solution. It becomes a dead end. Migrating to another provider isn’t just about moving mail — it’s about reconfiguring DNS, retraining users, and rebuilding trust. This isn’t ownership; it’s a lease on identity.

True control starts with full ownership

With Unifiedesk, you can connect your custom domain and generate all necessary records — MX, SPF, DKIM, DMARC — in real time, without needing a third-party tool or waiting for DNS propagation. These records aren't just set up; they’re tested, validated, and live instantly.

That’s not just convenience — it’s sovereignty. You’re not signing up for another cloud service. You’re running your own email stack, with full control over how and where your data lives. If you host Unifiedesk yourself, your domain is yours, forever. Even on the hosted platform, your account data is encrypted end-to-end, and you retain full authority over your identity.

For real control, think less about “what’s convenient” and more about “what’s yours.” The SMTP standard defines how email flows, but not who owns it. If you're serious about control, that ownership should sit with you — not Proton or Fastmail. If you’re ready to run your own domain without vendor lock-in, get started in minutes.

Which email service supports your full workspace needs?

You don’t need to juggle five separate apps when Unifiedesk bundles email, calendar, video meetings, Drive, Docs, contacts, and an AI assistant into one private, self-hostable workspace. Proton Mail offers only email. Fastmail adds calendar and contacts but lacks built-in document collaboration and meetings. Unifiedesk does it all — and keeps your data private by default.

What’s missing from Proton and Fastmail?

  • Proton Mail: No native calendar, document editing, or video meetings. You’ll need third-party tools like Google Calendar or Zoom for essentials.
  • Fastmail: Includes email, calendar, and contacts — but no built-in document collaboration (e.g., real-time editing) or video meeting system.
  • Neither service integrates video meetings, shared drives, or collaborative editing in a single interface. Switching between apps breaks workflow continuity.

Unifiedesk: One platform, all tools.

  • Email, calendar, and contacts — all in one interface. No syncing headaches between different providers.
  • Drive with per-account encryption and expiring share links. Files stay private, even when shared.
  • Docs handle .docx, .xlsx, .pptx, and ODF files directly in the browser — no need to download or use external tools.
  • Meet: Video meetings with screen sharing and recording — all within the Unifiedesk platform.
  • AI assistant: Works with any OpenAI-compatible endpoint, including self-hosted models. Your data never trains third-party models.
  • The entire suite runs on a single, self-hostable engine. You control your data, your infrastructure, and your privacy.

When you need more than email, you’ll spend less time switching apps and more time working — with better security and ownership. The industry standard for secure collaboration has been RFC 5322 for email, but modern workflows need more than that. Real-world adoption of unified tools like those from Fastmail and Proton has shown gaps in workspace integration — a fact noted in Gartner’s forecast on digital worker productivity.

With Unifiedesk, you’re not compromising on features or privacy. You’re choosing full control. Email is just the start.

What does self-hosting really cost — and what’s the trade-off?

You can’t self-host Proton Mail or Fastmail—they’re closed, proprietary services with no public code or infrastructure access. Self-hosting your email means full control over data, security, and uptime, but it also means managing updates, backups, monitoring, firewalls, and encryption yourself. If you’re not technical, the overhead may outweigh the benefits. For teams requiring strict compliance or wanting to avoid vendor lock-in, a self-hosted platform like Unifiedesk gives you the flexibility to run your own server on any hardware—anywhere you choose—while keeping your data under your control. RFC 5322 defines email standards, but implementation choices (open vs. closed) are where privacy and control differ.

Proton Mail and Fastmail are not self-hostable

Let’s be clear: neither Proton Mail nor Fastmail allow you to run your own instance. They control all encryption keys, servers, and infrastructure. While they offer strong defaults—end-to-end encryption for Proton Mail, privacy-first design for Fastmail—you have no visibility into their actual deployment. This means you trust them completely, which is fine for many users, but not ideal if you need auditable, sovereign control.

Unifiedesk: open-source, self-hostable, built for control

Unlike Proton Mail or Fastmail, Unifiedesk runs on open-source software. You can deploy it on your own server—whether a Raspberry Pi, a VPS, or an on-premise machine. The open code means you can audit how encryption, access, and data flow work. The trade-off? You're responsible for everything: patching systems, managing domain records like SPF, DKIM, and DMARC, setting up TLS, and backing up your data.

For individuals, the hosted Unifiedesk offering is far simpler—just sign up, get your mail, calendar, Drive, and AI assistant, all under your control and with no vendor lock-in. Teams managing sensitive data, complying with GDPR or industry policies, or running private infrastructures will find self-hosting invaluable. Deploy your own Unifiedesk server, and keep every file, contact, email, and message encrypted and stored where you decide.

Self-hosting isn’t about avoiding the cloud—it’s about keeping data ownership where it belongs. Whether you choose the hosted plan or deploy your own, Unifiedesk ensures privacy by design, with real control behind every feature.

Can you ever be truly free from vendor lock-in?

Not if you rely on closed file formats and proprietary APIs. Even the best email services lock you in with custom data structures and limited export tools — your data lives in their silo. But with open standards, your data stays yours, no matter where you go.

Why most email services still trap you

Proton Mail and Fastmail, while privacy-focused, still use internal formats for advanced features. Your calendar events or document edits might not export cleanly. Even when export tools exist, they’re often delayed, incomplete, or locked behind a paid tier.

And most vendors don’t expose full access to your data via standard protocols. You depend on their apps and APIs. If they change or shut down access, you might lose functionality — not just data, but years of workflows.

Open standards mean real control

Unifiedesk uses JMAP, IMAP, SMTP, and common file formats like .docx, .xlsx, and ODF. These aren’t just buzzwords — they’re RFCs (like RFC 8621 for JMAP) that ensure compatibility across clients.

That means your attachments, calendar invites, and documents work the same everywhere: in Apple Mail, Thunderbird, or a custom dashboard. You’re not locked to one interface — you own your data, not the platform.

Need to move? Exporting your entire mail, drive, contacts, and calendar is always possible — no vendor approval or tech debt delays. You can switch clients, hosts, or providers at any time, and your data remains usable.

And if you ever want control beyond the cloud, Unifiedesk’s self-hosted option gives you full ownership of every file, key, and server — no compromises, no backdoors.

Freedom is a feature, not an afterthought

True portability isn’t about having a “download” button. It’s about being able to use your data anywhere, anytime, without vendor interference.

So when you ask whether you can ever be free from vendor lock-in — yes, if you choose a service built on open standards from the start. With Unifiedesk, you’re not just protected. You’re in control.

The verdict: Who should choose Proton Mail, Fastmail, or Unifiedesk?

If you value strict privacy above all and trust Swiss neutrality, Proton Mail offers a strong foundation. It's built for confidentiality, but comes with trade-offs in features and extensibility.

Fastmail excels in reliability, performance, and a polished interface. It’s a solid choice for users who want a well-maintained inbox with minimal friction — though your data remains encrypted on the server.

Unifiedesk delivers a balanced alternative: full end-to-end encryption, complete control over your domain, and seamless integration of email, calendar, drive, meetings, and documents — all under your control, whether hosted or self-hosted. It’s built for people who want privacy without compromise.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Is Proton Mail really private?

Proton Mail encrypts messages within its network, but messages to external domains are not end-to-end encrypted. Your data is also subject to Swiss law and potential legal requests.

Can I self-host Fastmail?

No — Fastmail does not provide self-hosting options. It is a hosted-only service with no open-source engine.

Does Fastmail support end-to-end encryption?

No — Fastmail encrypts data at rest using AES-256, but the keys are held by Fastmail. It does not offer end-to-end encryption.

Can I use my own domain with Unifiedesk?

Yes — Unifiedesk supports custom domains with automatically generated MX, SPF, DKIM, and DMARC records, live in minutes.

Is Unifiedesk open source?

Yes — Unifiedesk is built on an open-source engine, giving you full transparency and the option to self-host.

How does Unifiedesk handle data privacy?

The hosted platform is end-to-end encrypted. Self-hosted deployments encrypt all data at rest with per-account keys using AES-256-GCM. TLS protects all data in transit.

Does Unifiedesk have video meetings?

Yes — Unifiedesk includes Meet with screen sharing and recording features, integrated with email, calendar, and Drive.

Can I export my data from Unifiedesk?

Yes — Unifiedesk supports IMAP and JMAP for full data access. You can export email, calendar events, files, and contacts at any time.

Is Unifiedesk suitable for teams?

Yes — Unifiedesk offers admin controls, shared mailboxes, custom domains, and collaboration features for teams on managed or self-hosted setups.

Does Unifiedesk work with standard email clients?

Yes — Unifiedesk supports IMAP, SMTP, and JMAP, so it works with any modern email client like Thunderbird, Outlook, or Apple Mail.