Thelemail
thelemail.com
What it is
Thelemail provides private email hosting for individuals, families, and small teams, including people with custom domains. Mail between Thelemail accounts is encrypted on the sender’s device and decrypted on the recipient’s device; stored mailbox content is ciphertext protected by a random key the server does not hold. For outbound mail, it uses WKD/OpenPGP when the recipient publishes a compatible key, or standard SMTP with TLS where supported. Custom-domain setup verifies ownership and prepares SPF, DKIM, and DMARC before incoming mail is moved. Core mail processing and encrypted mailbox storage are hosted in the EU. The service includes TOTP and WebAuthn two-factor authentication. Its production browser and macOS clients, key transparency log, and local export tool are published under AGPL-3.0; the export tool decrypts mail locally into MBOX files. Apps are listed for Android and iOS. Free plans are available; paid plans start at €2 / month, billed annually. Standard IMAP/SMTP access and a local bridge are not currently available, and Thelemail has not completed an independent security audit or formal compliance certification.
Spec sheet
- Purpose
- Thelemail provides private email hosting for individuals, families and small teams, including people with their own domains.Read 30 Sep 2026 · thelemail.com
- Intended users
- The service is aimed at technical domain administrators, homelabbers, households and founder-run small teams.Read 30 Sep 2026 · thelemail.com
- Free plan
- YesRead 22 Sep 2026 · thelemail.com
- Headquarters
- Setúbal, PortugalRead 28 Sep 2026 · thelemail.com
- Audit status
- Thelemail has not completed an independent security audit or formal compliance certification.Read 30 Sep 2026 · thelemail.com
- Client limitation
- Standard IMAP/SMTP access for Apple Mail, Thunderbird and similar clients is not currently available, and there is no local bridge.Read 30 Sep 2026 · thelemail.com
- Data residency
- Core mail processing and encrypted mailbox storage are hosted in the EU.Read 30 Sep 2026 · thelemail.com
- Domain setup
- Custom-domain setup checks domain ownership and prepares SPF, DKIM and DMARC before incoming mail is moved.Read 30 Sep 2026 · thelemail.com
- End-to-end encryption
- Mail between Thelemail accounts is encrypted on the sender’s device and decrypted on the recipient’s device.Read 30 Sep 2026 · thelemail.com
- Export
- The public local export tool decrypts mail on the user’s computer and writes standard MBOX files.Read 30 Sep 2026 · thelemail.com
- External encryption
- Outbound mail is encrypted with WKD/OpenPGP when the recipient publishes a compatible key; otherwise standard SMTP with TLS where supported is used.Read 30 Sep 2026 · thelemail.com
- Open source
- The production browser client, macOS desktop client, key transparency log and local export tool are published under AGPL-3.0.Read 30 Sep 2026 · thelemail.com
- Two-factor authentication
- The service includes two-factor authentication using TOTP and WebAuthn.Read 30 Sep 2026 · thelemail.com
- Zero-access storage
- Stored mailbox content is ciphertext protected by a random account key that the server does not hold.Read 30 Sep 2026 · thelemail.com
Plans and prices
Strong points and limits
Strong points
- Mail between Thelemail accounts is end-to-end encrypted.
- Custom-domain setup prepares SPF, DKIM, and DMARC.
- Includes TOTP and WebAuthn two-factor authentication.
- Core processing and mailbox storage are hosted in the EU.
- Local export tool writes standard MBOX files.
Limits
- Standard IMAP/SMTP access is not available.
- There is no local bridge.
- No independent security audit is completed.
- Free plan does not include custom domains.
Who it suits
Thelemail is aimed at technical domain administrators, homelabbers, households, and founder-run small teams. Its plans cover individual mailboxes as well as family and team setups.
Verdict
Thelemail specifies encryption, domain setup, and storage location, with free and annual paid plans. Readers who rely on third-party IMAP/SMTP clients or require an independent security audit should weigh those limitations first.
Where Specifiction places it
- Personal Email Services#23 of 1158.6
- Private Email Services#17 of 297.9