What email providers do you recommend for personal and for business?

Despite all the FUD, you can’t beat running your own server. I’ve been doing it trouble-free for about 20 years, and I would not want to give up the power and flexibility it affords me.

However, I’ve been wondering this myself: how to advise someone who, say, is leaving an institution and needs to replace its email service, but who can’t or doesn’t want to run a server. I know what not to use: gmail, protonmail (as you point out), hotmail, aol (!), ... but I would love to know of a service that I can recommend with confidence.

Personal: Fastmail.

- Pro: Easy to set up many domains and aliases. Reliable. Handles DKIM signing for all your domains for you. Mobile application maintained by Fastmail. Web and mobile UX is good.

- Con: HQ under AU jurisdiction and at potential risk of dystopian regulations.

- Con Mitigating Controls: Use Thunderbird to pull all your emails off the server. Thunderbird makes GPG encryption very easy. Teach your circle of friends and colleagues how to use GPG. Export your Thunderbird data to a set of encrypted USB drives, maybe one for each week of the month as USB drives can fail. People will provide anecdotes saying GPG is too hard but I have a dissenting view as I have taught a myriad of non-technical people to do this.

Corporate: Microsoft 365

- Pro: Designed for businesses. Highly customizable global rules, legal controls, retention policies. Integration with many corporate services, AD, 3rd party applications, etc... Better CapEx/OpEx numbers than self hosting once your company has grown beyond a certain size, varies by industry.

- Con: Expensive... Being abused more these days by spammers that assume approve-list trust of O365 endpoints. Your IT people will need to spend some time on tuning rules or front-end O365 with something like ProofPoint also expensive

______________

If I were starting a small business and wanted to host my own email servers, I would have Postfix relays in every datacenter/VM location that relay to a CommuniGate Pro cluster but that is a whole topic in and of itself. The Postfix entry-points would eliminate some riff-raff using simple regex rules S25R methodology. The Postfix relays would also have TLS mapping to enforce TLS certificate depth for specific domains. I would expect to deprecate this system once my company is medium-large unless I am willing to spend the OpEx/CapEx on managing this. For financial institutions it may be worth the OpEx/CapEx to comply with the myriad of regulations such as data vaulting and listing who specifically has access to the data. Audits, compliance, governance and all that fun