RELATED: What Is DuckDuckGo? Meet the Google Alternative for Privacy
What Is DuckDuckGo Email Protection?
DuckDuckGo Email Protection is a mail forwarding service with baked-in privacy features. You can sign up for an @duck.com forwarding address, which forwards to a standard mailbox of your choosing. Any email messages sent to your @duck.com address are stripped of known trackers before being forwarded to you.
The service also allows you to create random email aliases, just like Apple’s Hide My Email service. You can deactivate an alias at any time and stop receiving mail, which gives you greater protection and confidence when signing up for potentially spammy services.
DuckDuckGo states that the contents of email messages are not saved when using the service. Only your forwarding address and aliases are stored on DuckDuckGo’s services, with the search engine promising not to use personal information for anything other than running the service.
Email trackers are intrusive devices designed to see whether (and when) you open an email message. They often take the form of small images, known as tracking pixels. When the sender detects that the unique tracking pixel has been accessed, the email is marked as opened on their end.
While all known email trackers are stripped out, DuckDuckGo makes the point that “new trackers emerge all the time and blocking some may harm usability … while we can’t block them all, we work continuously to expand this email tracking blocking over time.”
You can use your @duck.com address purely for forwarding purposes or you can create random aliases that can be binned at any time. This is virtually identical to Apple’s Hide My Email service without the reliance on an iCloud+ subscription and an Apple device. Apple also happens to block trackers using its Mail apps for macOS and iOS, which puts both services on a fairly even footing.
Apple’s service is arguably better integrated into the ecosystem with tracker blocking built-in at a software level (without the need for a forwarding service), but DuckDuckGo Email Protection offers a solid alternative for those who don’t use (or want to use) Apple products to get a comparable level of protection.
How to Use DuckDuckGo Email Protection
To use DuckDuckGo Email Protection you’ll need to use the DuckDuckGo extension and a supported browser like Firefox, Chrome, Brave, or Edge. The service is also available using the DuckDuckGo for Mac, DuckDuckGo for iPhone, or DuckDuckGo for Android.
With the extension installed, visit DuckDuckGo’s Email Protection website in your chosen browser and hit “Get Started” to sign up. From here you’ll need to choose an address to use with the service. This will be a permanent forwarding address, so choose something that you’d be happy to give out.
You can head to duckduckgo.com/email/ at any time to update your forwarding address (under Account settings) and click “Generate Private Duck Address” to create a “burner” email. You can also click on the DuckDuckGo extension icon and click “Create new Duck Address” to copy a new alias to your clipboard.
We tested the forwarding service and noticed that messages sent to disposable aliases went straight to iCloud’s “Junk” folder, so be aware of that if you’re going to depend on the service. If you want to deactivate an alias, you can do so by clicking on the “More” link at the top of an incoming message.
Is DuckDuckGo Email Protection Secure?
DuckDuckGo is headquartered in Paoli, Pennsylvania, which means the company is subject to United States law and court requests. The search engine states in its Email Protection terms of agreement that it only discloses personal information when “legally forced to do so” and promises to go to court to fight disclosures. Individuals will be notified if requests are made by law enforcement.
DuckDuckGo goes on to state that it developed its own mail infrastructure, rather than using third-party services to send mail. The company promises to protect this infrastructure using “strict technical and organizational controls” which include an encrypted database in which personal information is stored and encrypted connections wherever possible
Be aware that some mail services don’t support encrypted connections, though most do at this stage. The company claims not to “log to disk” any IP addresses, including those of individuals found to be abusing the service. IP addresses are not linked to any personal information.
DuckDuckGo keeps 30 days’ worth of backup information (including your forwarding address and aliases), which means 30 days after requesting account deletion the should be gone forever. This is quite a long lead time compared to say a VPN, many of which don’t keep any logs at all.
Lastly, there’s the issue of ownership. DuckDuckGo states that it will not allow an ownerships change to “weaken” its policies. This is nice in theory, but ultimately there’s always a risk since no company can guarantee an outcome when losing its independent status.
There are a few indemnifying terms in the service agreement, like DuckDuckGo not guaranteeing the service always works as you expect. This is standard fare for most online services.
Should You Use DDG Email Protection?
DuckDuckGo Email Protection provides a useful service for those concerned about tracking pixels, who also value “burner” email addresses that can be switched off at any time.
The service takes a more privacy-conscious approach than most major email providers and allows you to give out disposable addresses without the worry of dealing with a torrent of spam or follow-up messages.
DuckDuckGo promises that the contents of your messages are never logged to disk and are instead processed in memory on servers, and quickly erased. Despite this, personal information like your forwarding address and aliases you have created could potentially be used to identify you. DuckDuckGo Email Protection is a good way to combat marketers and spammers, rather than a dependable security tool.
Just remember that online privacy is a cat-and-mouse game, and marketers may find increasingly sneaky ways to get tracking pixels (or other techniques) into their messages.
If you want a truly secure email provider, you’re better off signing up for a service that is built to be as secure as possible from the ground-up. We recommend something like ProtonMail or Tutanota.
