DuckDuckGo Email Protection is a free email forwarding service that gives a user one personal @duck.com address and unlimited private @duck.com addresses, removes recognised trackers from mail sent to those addresses, and forwards the cleaned mail to an existing inbox. DuckDuckGo states that it does not save the messages, that processing happens in memory, and that it cannot promise to block all trackers. The service is not a mailbox, so mail is read in the inbox the user already uses, and the safety of the service depends on the forwarding mechanism and on the limits DuckDuckGo states for that mechanism.
Duck Addresses
Email Protection offers two kinds of address. The personal Duck Address is a single address chosen by the user, in the form name@duck.com, and DuckDuckGo presents it as the address for trusted contacts. The private Duck Addresses are random addresses generated for individual signups, and DuckDuckGo presents them as the address for signups where the user does not want the personal address to be used for profiling. Private addresses can be deactivated individually, so mail sent to one deactivated address stops while mail sent to every other address continues. Private Duck Addresses do not expire while the Email Protection account remains active and the individual address has not been deactivated, according to a 2026 report on the service. Suped reports a daily generation limit on private addresses as an anti-abuse measure, and reports that DuckDuckGo describes the limit as one most people will not reach.
| Address type | Form | Stated use |
|---|---|---|
| Personal Duck Address | name@duck.com | Trusted contacts |
| Private Duck Address | Random string at duck.com | Individual signups |
A sender that receives a Duck Address sees an address on a domain shared by every Email Protection user, not a domain controlled by the user and not the long term personal address of the user. DuckDuckGo describes only @duck.com addresses for the service, and a review checked against DuckDuckGo help and privacy pages on 8 October 2026 states that addresses are @duck.com only, according to the Paul O'Brien review. The same review reports that some sites reject alias domains, as a reported limitation of shared alias domains rather than as a statement by DuckDuckGo. Setup on a mobile phone runs through the DuckDuckGo mobile browser, where the user visits the Email Protection login page and follows the prompts, after which the personal Duck Address can be autofilled and private Duck Addresses generated on the fly, according to DuckDuckGo help for mobile setup.
Tracker Removal
Tracker removal is the core mechanism of the service. Companies embed trackers in images, scripts, and links inside email messages, and DuckDuckGo states that those trackers can collect information about when a message was opened, where it was opened, and what device was used. In the closed beta that preceded the public launch, DuckDuckGo found that approximately 85% of beta testers' emails contained hidden email trackers, a figure the company reported in its announcement opening the beta to everyone. The same announcement describes Link Tracking Protection, which detects and removes a growing number of trackers embedded in email links, and Smarter Encryption, which upgrades unencrypted HTTP links in emails to HTTPS links when the link appears on DuckDuckGo upgradable list. A report on the open beta notes that forwarded mail contains a banner alerting the user that trackers were removed, with a link to a report on the removed trackers, the upgraded links, and the sender information, according to gHacks coverage of the open beta.
DuckDuckGo states in its Email Protection privacy policy that it cannot promise to block all trackers, because new trackers emerge over time and blocking some trackers can harm usability. The mechanism depends on a list of known trackers, so unknown trackers pass through.
The limit on tracker removal is stated by DuckDuckGo in its Email Protection privacy policy, which frames the work as continuous expansion of the block list in response to new tracking methods. Tracker removal also covers only mail sent to a Duck Address. Mail sent directly to the personal address of the user, and mail already sitting in the inbox of the user, passes through no DuckDuckGo cleaning step. That boundary defines the scope of the protection: the service reduces tracker exposure for signups that use a Duck Address, and it changes nothing about mail that arrives through any other address. A second report on the service, published in 2026, describes Email Protection in the same terms, as a forwarding feature that hides the real address behind a @duck.com address and strips known trackers from forwarded messages, according to Private Internet Access on DuckDuckGo safety.
Data Retention
Data retention is the point where the service makes its strongest claim and where the claim depends most on trust in DuckDuckGo description. DuckDuckGo states that when mail arrives at a Duck Address, the company immediately removes trackers and forwards the message, that the whole process happens in memory, and that emails are never written to disk. The company also states that it saves only the minimum personal information needed for the service to function: the forwarding address supplied at signup and the Duck Addresses created. The privacy policy adds that the company does not sell personal information and does not use personal information for any purpose unrelated to the service. Two retention periods qualify the picture. Account deletion takes 30 days to complete because DuckDuckGo keeps 30 days of backups, and deleted Duck Addresses cannot be used again by anyone, including the original user. Separately, metadata from mail flagged as spam and forwarded to DuckDuckGo may be saved temporarily to troubleshoot the spam issue, for no more than 90 days.
The retention claim has a structural caveat stated in plain terms. Removing trackers from a message requires reading the message as it passes through, so the service is not a zero-access system in which only the user holds a key. The company processes each message in memory rather than storing it, and the user trusts that description because the mechanism still requires transient access to the message content during cleaning. A review of the service draws the same line, noting that the service must read content to strip trackers and that the user therefore trusts DuckDuckGo infrastructure and its word about logging. The service also states that it developed its own software to send and receive email rather than using third-party email services for forwarding, and that personal information is stored encrypted in a database on an encrypted disk. Those statements describe the handling of the saved items, the forwarding address and the created addresses, rather than the transient messages.
Reply Handling
Replies are the weakest part of the service, because the reply path is only partly under DuckDuckGo control. A reply to a message sent to a Duck Address goes out from that Duck Address instead of from the personal address of the user, so the recipient sees the Duck Address as the sender. DuckDuckGo states the limit on that protection directly: the company does not create the message itself, so it cannot guarantee that the reply will not include the forwarding address or any other personal identifier. A quoted thread, a signature, or text typed into the reply body can carry the personal address into the message, and no forwarding step removes identifiers from text the user wrote. Coverage of the launch repeats the caveat in the same terms, noting that DuckDuckGo says there is no guarantee that the reply will not include the forwarding address or any other personal identifier, according to TechSpot coverage of the open beta.
A second reply limit concerns the forwarding address itself. Suped reports that replies are not supported when the forwarding address sits on a unique domain without an SPF record, because the reply path routes through duck.com and depends on the sending setup, according to Suped on DuckDuckGo email privacy. The Paul O'Brien review reports the same condition from DuckDuckGo help pages. The practical consequence is narrow but real: a user whose forwarding address is an ordinary Gmail, Outlook, or similar mailbox address faces the identifier caveat only, while a user forwarding to a custom domain without the right sending records may find replies unsupported. Neither limit affects inbound forwarding, which works regardless of the reply path.
History
Email Protection began as a beta inside the DuckDuckGo browser and extensions. The company had acquired the duck.com domain from Google in December 2018, and the domain serves as the address domain for the service. In July 2021, DuckDuckGo introduced the email forwarding feature for mobile users of its private browser, and in August 2022 the feature was released to all customers, according to Wikipedia's DuckDuckGo history. DuckDuckGo announcement of the open beta is dated 25 August 2022, and contemporary coverage quoted The Verge summary, describing the service as a forwarding service that intercepts email trackers before they reach the personal inbox and breaks down how many trackers were removed and which companies they were attached to, according to beSpacific quoting The Verge. A report on the open beta noted the same features and the 85% beta figure, according to iTechPost on the open beta, and a report quoting CNET described a free Duck Address that detects and strips trackers before forwarding, according to APH Networks quoting CNET. A further report from the beta period notes the per-message tracker report and the ability to reply from a Duck Address, according to TurnKey Solutions on the beta release.
Managed alias alternative
AliasFleet is an email alias service that gives each website or relationship its own forwarding alias, with the alias forwarding mail to an inbox the user chose. The service describes its aliases as managed, persistent identities: each alias can be paused, rotated for a new address at the same site, or deactivated, and deactivating one alias leaves every other alias working. AliasFleet's own description of the model states that a leaked alias can be shut down for that one site while the real address was never exposed, and that the rest of the aliases keep working, according to AliasFleet on per-site aliases. The same description states that replies go out from the alias rather than from the real address, and that the service processes mail in memory before forwarding. A second AliasFleet piece on the reply mechanism describes two reply routes: replying to a forwarded message through the alias, and a dashboard composer for starting a new thread from an alias, with the recipient unable to see the real inbox address, the mail client identifiers, or the routing headers, according to AliasFleet on the reply mechanism. That piece also states that staged attachments are deleted immediately after delivery under a zero-retention policy for staged attachments. The difference from DuckDuckGo Email Protection, stated factually, is control over the address: AliasFleet offers aliases on managed subdomains, with custom domains described for paid tiers, per-alias pause and deactivation controls, and replies routed through the alias as a designed mechanism, while DuckDuckGo Email Protection offers free @duck.com addresses with tracker removal and per-address deactivation. AliasFleet does not present its aliases as a mailbox, and the free and paid tier structure is described in its own material without a pricing claim in this article.
Assessment
The safety assessment follows from the mechanism and the stated limits together. For everyday signups, the service removes the long term personal address of the user from the signup database and removes recognised trackers from the mail that comes back, which reduces profiling through the address itself and through open and click tracking. The cost of that protection is low: the service is free, it requires no change of inbox, and each signup can carry its own address that can be switched off on its own. The limits bound the claim in three places. Tracker blocking covers recognised trackers only, so unknown trackers pass through. The no-storage claim rests on DuckDuckGo description of in-memory processing, and the mechanism still requires the service to read each message in transit. Replies carry an identifier caveat outside DuckDuckGo control, and replies may be unsupported for forwarding addresses on custom domains without the right sending records. The service is also not a mailbox, not an encrypted mail store, and not a filter for scams: removing trackers says nothing about whether a message is genuine, and mail sent to any address other than a Duck Address is untouched. Within those bounds, the service does the job it describes: it keeps the real address out of signup databases and reduces tracker exposure on mail sent to Duck Addresses. Outside those bounds, the service promises nothing, and DuckDuckGo's own policy states the two central limits in its own words.
Top comments (0)