GMX Mail is a free email service run by 1&1 Mail & Media in Germany. It holds Gold status in the BSI Hall of Fame of Email Security and offers free two-factor authentication and optional PGP encryption. Mail that is not encrypted with PGP is stored readable on GMX servers, and advertising pays for the free service.
What GMX Mail is
GMX Mail launched in 1997. It is a subsidiary of United Internet, the German internet group behind 1&1 and mail.com, and Wikipedia lists about 11 million active users. Accounts use the domains gmx.com, gmx.net and gmx.de, and are available in a limited list of countries that includes the United Kingdom, Germany, the United States and Canada.
The free account includes 65 GB of email storage, attachments up to 50 MB, up to 10 alias addresses, a spam filter and an antivirus checker. Mail is stored in European data centres, and the service operates under German data protection law and the GDPR. A paid ProMail tier exists. Signup asks for personal information, so the account is not anonymous from the start.
Transport security
The BSI Hall of Fame lists GMX under GOLD status. The BSI defines Gold as a commitment to implement two technical guidelines: TR-03108 on secure email transport and TR-03182 on email authentication. GMX, WEB.DE and mail.com entered the Hall of Fame in the second round in September 2026, after a first round in 2025 that listed around 150 organisations.
The BSI public E-Mail-Checker scores gmx.de 7 out of 7 across SPF, DKIM, DMARC, DNSSEC, DANE, TLS 1.2 and TLS 1.3. Three unweighted extras are marked unmet: MTA-STS, TLS reporting, and switching off TLS versions below 1.2. The Hall of Fame listing covers transport security and authentication only. It is not a privacy certification, and it says nothing about how GMX handles the contents of a mailbox.
Encryption in GMX Mail
GMX offers end-to-end encryption free of charge, built on OpenPGP and delivered through the Mailvelope browser extension. The setup wizard creates a public and private key pair in three steps. The private key stays in the browser extension, not on GMX servers. GMX states that encryption takes place in the browser, so neither GMX nor Mailvelope nor government agencies have access to encrypted message content. GMX also states that the procedure is audited by external security experts, but no audit report is linked from the encryption page.
Attachments are encrypted with message bodies. Both sender and recipient need encryption set up before an encrypted message can be exchanged, and GMX automates the key exchange through a personal invitation process or through its key directory of GMX users who have already set it up. Encrypted communication can only be set up for the default GMX address, not for the extra alias addresses, and it cannot currently be set up inside the webmailer itself. The mobile apps support it through a QR code or recovery code from the setup document. Encryption is off by default, so it does not change the privacy position of ordinary unencrypted mail.
Two-factor authentication
GMX offers two-factor authentication free of charge on gmx.com and gmx.net accounts. After setup, login needs the account password plus a 6-digit code from an authentication app on a smartphone. GMX uses time-based one-time passwords (TOTP), and each code expires after 30 seconds. GMX states that even if an attacker obtains the password, the attacker cannot access the mailbox without the second factor.
Setup runs through My Account, then Security Options, then two-factor authentication, and includes verification of a mobile phone number by SMS. External mail programs such as Outlook or Thunderbird need an app-specific password instead of the normal password when two-factor authentication is on, because those programs cannot prompt for the one-time code. Setup also produces a secret key as a PDF recovery document, which restores access if the phone or the authentication app is lost. Entering the secret key deactivates two-factor authentication, so it has to be set up again afterwards. Two-factor authentication is opt-in, so an account that never enables it relies on the password alone.
Spam and virus protection
GMX includes a spam filter with adjustable criteria and an antivirus checker on incoming mail and attachments. The signup page lists both as standard parts of the free account. GMX also offers a Mail Collector for gathering mail from other accounts and a MailCheck browser add-on that gives one-click access and new-mail notifications.
Third-party mail help pages report that POP3 and IMAP access is switched off by default and switched off again after a long period without use, and that GMX requires TLS 1.2 or 1.3 for mail client connections. That report comes from a third-party help site rather than a GMX page, so it is stated here as reported rather than confirmed. Two-factor authentication and PGP encryption are off by default.
Advertising and data use
Advertising pays for the free service, and GMX says so directly on its advertising page: revenue from the advertisements on the GMX portal and homepage allows GMX to offer free services. Interest-based advertising uses the information given at signup, such as name and date of birth, plus visitor usage data and user group structure. GMX works with named advertising partners that include Google, Amazon, Criteo, Taboola, Xandr and PubMatic, and data is saved anonymously and confidentially on European servers.
Interest-based advertising can be switched off in the mailbox under My Account, or through the partner opt-out pages GMX lists. The advertising page does not state that message bodies are scanned to target ads, and this article does not claim that they are. The free mailbox is funded by advertising built on account and usage data. GMX also shows popup ads at login, including for premium users, according to Wikipedia.
The privacy policy states that GMX servers are hosted internally at 1&1 with no transfer of data abroad in the website analytics context, and that customer care data is documented until the account is deleted. The policy gives GDPR as the legal basis for processing and lists opt-out routes for analysis and interest-based advertising.
Breach record
No public breach of GMX Mail itself was found in the research for this article. That is absence of a public record, not proof that no breach has ever happened, and readers can check their own address on Have I Been Pwned. GMX publishes no transparency report on government data requests that was found in this research, and no independent audit report was found in this research.
The widely reported July 2025 exploit in which about $42 million was taken from a GMX liquidity pool hit GMX the decentralised crypto exchange, a different company that shares the name. It has nothing to do with GMX Mail, and no reporting connects the two.
AliasFleet and GMX Mail
AliasFleet aliases forward to the GMX mailbox, so the GMX address is not shared with websites or services. AliasFleet creates managed, persistent email aliases that forward to the GMX mailbox, so each website or service gets its own alias and the GMX address stays private. If one alias starts receiving spam or appears in a breach, that alias can be paused or closed without touching the GMX account or any other alias.
The same pattern is described in the companion trust pieces on Gmail, Outlook, iCloud Mail, Yahoo Mail and Zoho Mail. GMX already offers up to 10 alias addresses inside one account, but those are tied to the GMX account and the GMX domain, while AliasFleet aliases sit in front of the mailbox and can be managed independently of it. The AliasFleet documentation explains how aliases forward and how replies are routed, and pricing is on the AliasFleet pricing page.
GMX Mail holds BSI Gold recognition for transport security and offers a free PGP option. Unencrypted mail is readable by GMX, the service is funded by advertising built on account and usage data, and two-factor authentication and PGP encryption are opt-in features that stay off unless the user enables them.
Top comments (0)