Serverlist

	MECSA CONFIDENTIAL DELIVERY ^[1]	MECSA PHISHING AND IDENTITY THEFT ^[1]	MECSA INTEGRITY OF MESSAGES ^[1]	IMAPS ^[3]	POP3S ^[3]	SMTPS ^[3]	SMTP ^[3]	DANE	STARTTLS Everywhere ^[5]	MTA-STS^[6]	DMARC	SPF	DKIM	MFA^[10]	Mozilla Observatory	SSL Labs	htbridge	Crypt Check	security headers	HSTS preload list	CAA	Referrers leaked	Cookies	Third-party requests	Third-parties contacted	GeoIP (mx)	Comments
mailbox.org	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	A+	A+	A	A	Yes	Yes	Testing	Disabled	Softfail	Yes	Yes	A+	A+	A+	A+	A	Yes	Yes	Partially	3	0	0	Germany	google captcha
posteo.de	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	A+	A+	A+	A	Yes	Queued	No	Disabled	Softfail	Yes	Yes	B+	A+	A+	A+	A	Yes	Yes	No	1	0	0	Germany
dismail.de	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	A+	X	A+	A+	Yes	Yes	Yes^[6]	Reject	Reject	Yes	Yes	A+	A+	A+	A+	A+	Yes	Yes	No	0	0	0	Germany
mail.de	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	B	B	B	B	Yes	Yes	Yes	Report only	Softfail	Yes	Yes	B	A+	A+	B	A	Yes	Yes	No	4	6	5	Germany	Punkt 2 in der Datenschutzerklärung beachten; google captcha
systemli.org	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	B	B	B	B	Yes	Yes	Yes	Report only	Softfail	Yes	No	A+	A+	A+	A	A	Yes	Yes	No	0	0	0	ToDo
tutanota.com	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	X	X	X	B	Yes	Yes	No	Disabled	Reject	Yes	Yes	B	A+	A+	B	B	Yes	No	Leaked	2	0	0	Germany
disroot.org	4.5 / 5.0	5.0 / 5.0	5.0 / 5.0	A	A	X	Timeout	No	Queued	No	Report only	Reject	Yes	No	B	A+	A+	A+	A	Yes	No	No	1	0	0	Netherlands	google captcha
protonmail.com	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	X	X	X	X	No	Yes	No	Quarantine	Softfail	Yes	Yes	B	A+	A+	A	B	Yes	No	Leaked	2	4	2	Switzerland
riseup.net	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	A	A	Timeout	Timeout	No	Queued	Testing	Disabled	Reject	Yes	No	A+	A+	A+	A	A	Yes	Yes	Leaked	0	0	0	United States
gmail.com	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	C	C	C	C	No	Yes	Testing	Report only	Softfail	Yes	Yes	A-	A	A+	C	A	Yes	No	Leaked	2	5	3	United States
mailfence.com	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	A	A	A	A	No	No	No	Quarantine	Reject	Yes	Yes	D+	A+	A+	A+	F	Yes	No	Leaked	3	0	0	France
kolabnow.com	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	Timeout	X	X	A	Yes	No	No	Quarantine	Reject	Yes	ToDo	B+	A+	A+	A+	A	No	Yes	No	3	1	1	Switzerland
lavabit.com	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	B	B	B	Timeout	Yes	Queued	No	Reject	Reject	Yes	ToDo	F	A	A	C	F	No	No	Leaked	0	0	0	United States
mailjunky.de	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	X	X	X	Timeout	No	Queued	No	Report only	Softfail	Yes	ToDo	F	B	A+	C	C	No	No	Leaked	4	13	7	Germany
directbox.com	5.0 / 5.0	5.0 / 5.0	5.0 / 5.0	C	C	F	F	Yes	No	No	Report only	Reject	Yes	ToDo	B+	A	A+	A	A	No	No	Leaked	1	0	0	Germany
netcologne.de	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	A	A	X	A	No	No	No	Quarantine	Softfail	Yes	ToDo	C	A	A+	C	B	No	No	Leaked	36	80	37	Germany
fastmail.com	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	C	C	C	Timeout	No	No	No	Report only	Softfail	Yes	Yes	A+	A+	A	C	A	Yes	No	Leaked	4	4	2	United States	google captcha
aol.com	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	C	C	X	F	No	Yes	No	Reject	Softfail	Yes	Yes	D	A-	A	C	A	No	No	Partially	136	346	103	United States
5x2.de	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	C	C	C	F	No	No	No	Quarantine	Reject	Yes	ToDo	F	A-	A	B	F	No	Yes	Leaked	8	4	2	Russian Federation
icloud.com	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	C	X	X	ToDo	No	Yes	No	Quarantine	Softfail	Yes	ToDo	C+	A-	A+	B	B	No	No	Leaked	3	50	4	United States
outlook.com	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	C	C	X	M	No	Yes	No	Report only	Reject	Yes	Yes	D	A	A+	C	C	No	No	Leaked	3	42	5	United States
mail.yandex.ru	4.0 / 5.0	4.5 / 5.0	5.0 / 5.0	F	F	F	Timeout	No	Yes	No	Report only	Softfail	Yes	Yes	B-	A	A+	F	B	No	Yes	Leaked	9	45	2	Russian Federation
hushmail.com	4.0 / 5.0	3.5 / 5.0	3.5 / 5.0	B	B	B	Timeout	No	No	No	Quarantine	Reject	Yes	Yes	D	A	A+	B	B	No	No	Leaked	2	0	0	United States
autistici.org	3.5 / 5.0	4.5 / 5.0	3.5 / 5.0	X	B	B	B	No	No	No	No	Reject	Yes	ToDo	C	A	A	B	B	No	No	Leaked	0	0	0	France
runbox.com	4.0 / 5.0	3.5 / 5.0	3.5 / 5.0	C	C	C	C	No	Queued	No	Report only	Reject	Yes	Yes	B	A+	A+	C	A	No	No	Leaked	1	0	0	Norway
cock.li	4.0 / 5.0	3.5 / 5.0	3.5 / 5.0	B	B	F	F	No	No	No	No	Reject	Yes	ToDo	D	A+	A+	B	D	Yes	No	Leaked	2	0	0	Romania
startmail.com	4.0 / 5.0	3.5 / 5.0	3.5 / 5.0	F	X	X	C	No	No	No	No	Softfail	Yes	Yes	F	A+	A+	B	F	No	No	Leaked	1	0	0	Netherlands
danwin1210.me	0.0 / 5.0	4.0 / 5.0	3.5 / 5.0	B	B	B	Timeout	No	No	No	Quarantine	Reject	Yes	ToDo	D-	A+	A+	B	A	Yes	No	Partially	1	0	0	France
gmx.de	5.0 / 5.0	3.5 / 5.0	2.0 / 5.0	C	C	C	C	Yes	No	No	No	Reject	No	No	F	A+	A+	C	B	Yes	No	Partially	60	227	61	Germany
web.de	5.0 / 5.0	3.5 / 5.0	2.0 / 5.0	C	C	X	C	Yes	Queued	Testing	No	Reject	No	No	F	A+	A+	C	B	Yes	No	Partially	55	210	57	Germany
systemausfall.org	4.0 / 5.0	3.5 / 5.0	3.5 / 5.0	A	A	X	?	No	Yes	No	No	Softfail	Yes	ToDo	B	A+	A+	A+	A	No	Yes	No	1	0	0	Germany
schokokeks.org	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	ToDo	ToDo	ToDo	B	No	Queued	short max_age	No	Reject	No	ToDo	B+	A+	A+	B	A	Yes	Yes	Leaked	1	0	0	Germany
arcor.de	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	F	X	X	Timeout	No	No	No	No	Reject	No	ToDo	F	A-	A-	C	D	No	No	Leaked	79	296	91	Netherlands
skymail.de	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	ToDo	ToDo	ToDo	ToDo	No	No	No	No	Reject	No	ToDo	F	A	A+	B	F	No	No	Leaked	0	3	2	Germany
ok.de	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	F	F	B	B	No	No	No	No	Reject	No	ToDo	F	B	B	C	F	No	No	Leaked	37	208	49	Germany
firemail.de	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	ToDo	ToDo	ToDo	ToDo	No	No	No	No	Softfail	No	ToDo	F	F	B	B	F	No	No	Leaked	4	13	8	United States	Advertising
netcourrier.com	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	B	B	B	F	No	No	No	No	Reject	No	ToDo	D	B	D	F	D	No	No	Leaked	1	19	1	France
gandi.net	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	C	C	C	B	No	No	No	No	Reject	No	ToDo	B-	A	A	C	B	No	No	Leaked	2	0	0	France
eclipso.de	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	B	B	B	Timeout	No	No	No	No	Reject	No	ToDo	C+	A+	A	C	B	No	No	Leaked	2	0	0	Germany	google captcha, Advertising
freenet.de	5.0 / 5.0	0.0 / 5.0	2.0 / 5.0	B	B	B	Timeout	No	No	No	No	Softfail	No	No	C	A+	A+	C	A+	No	Yes	No	134	543	149	Germany
ownbay.net	4.0 / 5.0	0.0 / 5.0	3.0 / 5.0	A	A	A	A	No	No	No	No	Softfail	No	ToDo	B	A+	A+	A	A	No	No	Partially	2	5	5	Germany	google captcha
t-online.de	4.0 / 5.0	0.0 / 5.0	2.0 / 5.0	C	C	M	C	No	No	No	No	No	No	No	F	A	A-	C	F	No	No	Leaked	116	238	91	Germany
emailn.de	4.0 / 5.0	0.0 / 5.0	2.0 / 5.0	X	X	X	F	No	No	No	No	Reject	No	ToDo	D	A	A	C	D	No	No	Leaked	5	35	12	Germany	google captcha, Advertising
online.de	4.0 / 5.0	0.0 / 5.0	2.0 / 5.0	C	C	C	C	No	No	No	No	No	No	ToDo	F	A	A	B	F	No	No	Leaked	105	130	63	Germany	1und1.de
so36.net	ToDo	ToDo	ToDo	X	A	A	A	Yes	No	No	No	No	ToDo	ToDo	D+	A+	A+	A	D	No	No	Leaked	0	0	0	Germany
boum.org	ToDo	ToDo	ToDo	A	A	A	Timeout	No	No	No	No	No	ToDo	ToDo	D+	A+	A	Timeout	D	No	No	Leaked	0	0	0	United States
immerda.ch	ToDo	ToDo	ToDo	A	A	F	Timeout	No	No	No	No	Softfail	ToDo	ToDo	B+	A	A+	A	A	No	No	Leaked	0	0	0	Switzerland
tchncs.de	ToDo	ToDo	ToDo	A	M	Timeout	No TLS	No	No	No	Report only	Neutral	ToDo	ToDo	B	A+	A+	A+	A	No	No	Partially	3	0	0	Germany
hosted.mailcow.de	ToDo	ToDo	ToDo	B	B	B	C	Yes	No	No	No	Neutral	ToDo	ToDo	B	A+	A	C	B	No	No	No	1	0	0	Germany
tuffmail.com	ToDo	ToDo	ToDo	B	B	B	Timeout	No	No	No	No	Softfail	ToDo	ToDo	D	A+	A+	B	D	No	No	Leaked	0	0	0	United States
zoho.eu	ToDo	ToDo	ToDo	F	F	F	F	No	No	No	Quarantine	Reject	ToDo	ToDo	F	A+	A+	B	D	No	No	Leaked	13	22	11	Switzerland
zoho.com	4.0 / 5.0	3.0 / 5.0	2.0 / 5.0	F	F	F	F	No	No	No	Reject	Reject	No	ToDo	F	A+	A+	C	D	No	No	Leaked	18	42	15	United States
mail.com	ToDo	ToDo	ToDo	C	C	C	Timeout	No	No	Testing	No	Reject	ToDo	No	D-	A+	A+	C	D	Yes	No	Leaked	51	113	31	United States
mail.lilo.org	ToDo	ToDo	ToDo	F	X	X	C	No	No	No	Report only	Neutral	ToDo	ToDo	D+	A+	A	C	D	No	No	Leaked	2	4	0	France
aikq.de	ToDo	ToDo	ToDo	B	B	B	B	No	No	No	No	Softfail	ToDo	ToDo	D	A+	A+	C	D	No	No	Leaked	1	7	3	Germany
virginmedia.com	ToDo	ToDo	ToDo	C	C	C	F	No	No	No	Quarantine	Softfail	ToDo	ToDo	F	A	B	B	D	No	No	Leaked	33	64	32	Netherlands
pobox.com	ToDo	ToDo	ToDo	B	B	B	Timeout	No	No	No	Report only	Neutral	ToDo	Yes	B+	A	A+	B	A	No	No	Leaked	4	3	2	United States
strato.de	ToDo	ToDo	ToDo	C	C	C	F	No	No	No	No	No	ToDo	ToDo	F	A+	A+	C	F	No	No	Leaked	14	15	10	Germany
mail.ru	ToDo	ToDo	ToDo	Timeout	F	F	Timeout	No	No	No	Reject	Softfail	ToDo	Yes	C+	A+	A	C	A	No	No	Leaked	38	98	39	Russian Federation
countermail.com	ToDo	ToDo	ToDo	F	X	F	B	No	No	No	No	Softfail	ToDo	ToDo	C+	C	B	B	D	Yes	No	Leaked	0	0	0	Sweden
biomail.de	ToDo	ToDo	ToDo	A	A	ToDo	ToDo	No	No	No	No	Reject	ToDo	ToDo	F	A	A	C	F	No	No	Leaked	0	0	0	Germany
greensta.de	ToDo	ToDo	ToDo	B	B	F	B	No	No	No	Disabled	Softfail	ToDo	ToDo	F	A	A+	B	F	No	No	Leaked	6	2	1	Germany
yahoo.com	ToDo	ToDo	ToDo	C	C	C	Timeout	No	Yes	Testing	Reject	Neutral	ToDo	Yes	F	A	A+	C	D	No	No	Partially	13	133	15	United States
unseen.is	ToDo	ToDo	ToDo	C	C	F	F	No	No	No	No	Reject	ToDo	ToDo	C+	A+	A+	A+	D	Yes	No	Leaked	0	0	0	Iceland
vodafone.de	ToDo	ToDo	ToDo	F	Timeout	Timeout	F	No	No	No	No	Reject	ToDo	ToDo	F	B	C	C	D	No	No	Leaked	36	90	40	Netherlands
cryptix.de	ToDo	ToDo	ToDo	M	M	M	C	No	No	No	No	No	ToDo	ToDo	F	C	A	B	D	No	No	Leaked	3	0	0	Germany
aktivix.org	ToDo	ToDo	ToDo	F	F	X	Timeout	No	No	No	No	Softfail	ToDo	ToDo	F	A+	A+	A+	F	No	No	Leaked	2	0	0	United States
neomailbox.com	ToDo	ToDo	ToDo	C	F	F	Timeout	No	No	No	No	Softfail	ToDo	ToDo	F	A	B	A	F	No	No	Leaked	0	0	0	Switzerland
goneo.de	ToDo	ToDo	ToDo	F	F	C	C	No	No	No	No	No	ToDo	ToDo	D	A+	A	C	D	No	No	Leaked	14	16	10	Germany
bluewin.ch	ToDo	ToDo	ToDo	F	F	C	C	No	No	No	No	Softfail	ToDo	ToDo	F	A	A+	B	F	No	No	Leaked	43	161	44	Switzerland
artikel-140.nl	ToDo	ToDo	ToDo	F	X	A	No TLS	No	No	No	Quarantine	Reject	ToDo	ToDo	D+	A+	A+	A+	D	No	No	Leaked	2	0	0	Netherlands
free.de	3.0 / 5.0	3.0 / 5.0	1.0 / 5.0	F	F	A	No TLS	No	No	No	No	Softfail	No	ToDo	F	B	F	F	F	No	No	Leaked	0	0	0	Germany	greylister does not support TLS
inbox.com	ToDo	ToDo	ToDo	C	X	F	No TLS	No	No	No	No	Softfail	ToDo	ToDo	F	B	A	C	F	No	No	Leaked	11	9	5	United States
one.com	ToDo	ToDo	ToDo	F	F	F	F	No	No	No	Report only	Softfail	ToDo	ToDo	C-	A+	A+	B	D	No	No	Leaked	21	52	20	Denmark
safe-mail.net	3.0 /5.0	3.0 / 5.0	1.0 / 5.0	?	?	?	No TLS	No	No	No	No	Syntax Error	ToDo	ToDo	F	B	A	F	F	No	No	Leaked	0	0	0	Israel
islandnet.com	ToDo	ToDo	ToDo	F	F	F	Timeout	No	No	No	Report only	Neutral	ToDo	ToDo	F	B	A	F	F	No	No	Leaked	3	4	3	Canada
cox.net	ToDo	ToDo	ToDo	F	F	F	No TLS	No	No	No	No	Neutral	ToDo	ToDo	F	No HTTPS	B	No HTTPS	D	No	No	Leaked	180	350	112	United States
teknik.io	ToDo	ToDo	ToDo	F	F	F	F	No	No	No	Quarantine	Softfail	ToDo	ToDo	A+	B	A	B	A	Yes	No	Leaked	2	0	0	Netherlands
mc-free.com	3.0 / 5.0	0.0 / 5.0	1.0 / 5.0	ToDo	ToDo	ToDo	ToDo	ToDo	No	No	No	No	No	ToDo	F	A	A+	B	F	No	No	Leaked	5	9	5	Germany
simbamail.de	3.0 / 5.0	0.0 / 5.0	1.0 / 5.0	ToDo	ToDo	ToDo	ToDo	No	No	No	No	No	No	ToDo	F	A	A+	B	F	No	No	Leaked	1	8	7	Germany
rediffmail.com	3.0 / 5.0	4.5 / 5.0	3.5 / 5.0	ToDo	ToDo	ToDo	ToDo	No	No	No	Report only	Softfail	Yes	ToDo	F	F	ToDo	Timeout	E	No	No	Leaked	5	8	5	India
anpa.de	3.0 / 5.0	3.0 / 5.0	1.0 / 5.0	B	X	B	No TLS	No	No	No	No	Softfail	No	ToDo	F	C	C	F	F	No	No	Leaked	4	19	11	Netherlands	Hostname Mismatch
netcup.net/de	ToDo	ToDo	ToDo	F	F	F	F	No	No	No	No	No	ToDo	ToDo	F	A	A	B	F	No	No	Leaked	2	0	0	Germany

To be clear: This list does not want to make any statement about the quality of the email providers or their services. It takes more than just encryption, to provide a secure and reliable email service.

This is a manually created list which might be outdated in some places. In addition, test results may be wrong for various reasons. Please take into account the fact that email providers have to be very cautious when modifying there servers, e.g. to not lock out old clients and to avoid problems when receiving or sending emails.

So, please don't take this list too seriously, and/or try to ...

... understand the test results and the implications they might have:

[1] MECSA Technical Details
[3] Understanding the CryptCheck results (IMAPS,POP3S,SMTPS,SMTP and HTTPS)
[5] STARTTLS Everywhere - prevent/detect downgrade attacks and interception by hosting a preload list.
[6] MTA-STS - RFC 8461 (prevent/detect downgrade attacks and interception by publishing MTA-STS policy via HTTPS) has just been relased (September 2018). It is currently rarely used, partly because it is quite new (first draft 2016) and partly because it has some very unusual aspects, to say the least. Even those who submitted the draft (e.g yahoo, google and microsoft) are not using it.
dismail's outgoing MTA-STS policy implementation is not fully RFC 8461 complient.
[10] Multi-factor authentication (MFA): "granted access only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism".
Some claim to have the only correct/secure implementation, but offer insecure reset functions. I don't want to score such things. So, the list only indicates whether there is any kind of MFA or not, regardless of the way it is implemented.
more to come

Please feel free to send links, corrections or extra infos to: a2e7ff3a@dismail.de (email/xmpp)

Last update: 2019-02-05

Changes:

2019-02-05: updated: mailbox.org - Mozilla Observatory B+ -> A+
2019-01-29: updated: STARTTLS Everywhere - mail.de Queued -> Yes; mailbox.org Queued -> Yes; systemli.org Queued -> Yes
2019-01-29: removed: Email Security Grader: as noted earlier - Some test results are just plain wrong, for example: for most serious providers the SMTP, IMAP and POP Server addresses are wrong, ESG just assumes they're on the MX Servers. The Open Relay Test results are wrong, if they hit a greylister, or if the provider rejects after the "DATA" part (mail.de). The MX Connection Test result is wrong if some kind of "fake MX" is involved (mailbox.org) ... ~~I'll keep it in the list for now, but will probably remove the column in the future.~~.
2019-01-15: updated: Email Security Grader - posteo.org 78% -> 82%; mailbox.org 91% -> 87%
2019-01-10: added: 2FA - the answer to every single security threat these days (not). Or is it still the NextGen UTM Security (nightmare) Hardware Firewall Appliance with DPI, IDS, IPS, Deep Learning Protection, Sandboxing, Lightning Protection and whatnot? Quite unbeatable ... sorry I digress. So, here it is - the 2FA column.
2019-01-07: updated: STARTTLS Everywhere - mail.com Queued -> Yes; systemausfall.org Queued -> Yes; tutanota.com Queued -> Yes
2018-12-26: updated: mail.de - MTA-STS Testing -> Yes; SPF Neutral -> Softfail
2018-12-14: added: schokokeks.org
2018-11-29: updated: outlook.com - MECSA 3.0/5.0; 4.5/5.0; 3.5/5.0 -> 4.0/5.0; 4.5/5.0; 5.0/5.0
2018-11-26: added: Email Security Grader is online again
2018-11-17: updated: riseup.org IMAPS Timeout -> A; POP3S Timeout -> A; CryptCheck Timeout -> A
2018-11-16: updated: mailbox.org - Cookies 1 -> 3
2018-11-15: updated: mailbox.org - Referrers leaked No -> Partially; Cookies 2 -> 1; IMAPS A -> A+; POP3S A -> A+
2018-11-15: removed: Email Security Grader is down for days now
2018-11-10: updated: STARTTLS Everywhere - disroot.org No -> Queued; tutanota.com No -> Queued; AOL No -> Yes; web.de No -> Queued;
2018-11-10: updated: icloud.com - added MECSA
2018-11-08: updated: free.de - added MECSA
2018-11-07: updated: the SPF column has been updated. "No" - no SPF record; "Neutral" - must be treated exactly like "none", but some spam filters use it; "Softfail" - treated as somewhere between "Reject" and "Neutral"; "Reject" reject message during the SMTP transaction, or use it for spam rating (recommended)
2018-10-07: updated: systemausfall.org - SPF No -> Softfail; MECSA PHISHING AND IDENTITY THEFT 2.5 -> 3.5
2018-11-06: updated: the DMARC column has been updated. "No" - no DMARC record; "Disabled" - DMARC Record with "p=none" and no reporting email address; "Report only" - DMARC Record with "p=none" and reporting email address; "Quarantine" deliver to the "spam folder"; "Reject" reject message during the SMTP transaction
2018-11-06: updated: riseup.net - Mozilla Observatory B -> A+, Referrers Leaked No -> Yes
2018-10-28: removed: vmail.me (Vmail is shutting down its services)
2018-10-26: updated: mailbox.org - CAA No -> Yes; MTA-STS No -> Testing; Mozilla Observatory B -> B+, Referrers leaked Yes -> No (Thanks mailbox.org for sending the updates)
2018-10-25: added: tuffmail.com
2018-10-11: removed: openmailbox.org (down for more than 1 month)
2018-10-11: updated: systemausfall.org - added MECSA; StartTLS Everywhere No -> Queued; DKIM ToDo -> Yes; Hostname Mismatch on MX is gone
2018-10-08: updated: systemli.org - MTA-STS Testing -> Yes
2018-10-07: updated: safe-mail.net - added MECSA
2018-10-02: updated: riseup.net, web.de, yahoo.com, mail.com - MTA-STS No -> Testing
2018-10-01: updated: mail.de - SMTPS F -> B; SMTP timeout -> B; MTA-STS No -> Testing; STARTTLS Everywhere No -> Queued; Referrers Leaked -> No; Third-party requests 10 -> 6; Third-parties contacted 6 -> 5; Email Security Grader is wrong about the Open Relay Test. So, the overall result is wrong. (Thanks to mail.de for the update and the clarification)
2018-10-01: updated: posteo.de - Email Security Grader 87% -> 78%
2018-09:27: removed: freemail.ox.io (will be shut down as of 1st December 2018)
2018-09-17: updated: disroot.org - IMAPS M -> A; POP3S M -> A (was previously checked with a wrong DNS name, hence the M)
2018-09-14: added: mail.de - comment: Punkt 2 in der Datenschutzerklärung beachten.
2018-09-14: removed: 1984.is (Is not an email provider)
2018-09-14: updated: pobox.com IMAPS C -> B; POP3S C -> B; SMTPS C -> B; Mozilla Observatory F -> B+; Security Headers F -> A; htbridge A -> A+
2018-09-14: updated: web.de: Mozilla Observatory C -> F; gmx.de Mozilla Observatory C -> F; vodafone.de D -> F
2018-09-14: updated: cock.li Email Security Grader 80% -> 87%
2018-09-12: updated: posteo.de - Email Security Grader 91% -> 87% (mx01 Reverse DNS Test failed; mx02 migration?); IMAPS C -> A+; POP3S C -> A+; SMTPS C -> A+; SMTP F -> A (Thumbs up)
2018-09-12: updated: autistici.org - added MECSA
2018-09-11: updated: cock.li - SFP No -> Yes; Cookies 4 -> 2; Third-party requests 2 -> 0; Third-parties contacted 2 -> 0
2018-09-11: updated: dismail.de - StartTLS Everywhere Queued -> Yes
2018-09-11: added: netcologne.de
2018-09-03: updated: zoho.eu - Mozilla Observatory D -> F; IMAPS B -> F; POP3S B -> F; SMTPS B -> F; SMTP B -> what a mess
2018-09-03: added: GeoIP column
2018-09-03: added: zoho.com
2018-08-31: updated: StartTLS Everywhere No -> Queued: systemli.org, protonmail.com, riseup.net, lavabit.com, posteo.de, mailjunky.de, runbox.com
2018-08-20: updated: mail.de - IMAPS F -> B; POP3S F -> B
2018-08-18: updated: mailfence.com - DMARC - disabled -> Yes
2018-08-02: updated: mailbox.org - StartTLS Everywhere No -> Queued
2018-07-24: Added STARTTLS Everywhere column
2018-07-23: Added MTA-STS (protecting STARTTLS) column
2018-06-29: It seems that some providers have started blocking TLS-Scans (tls.imirhil.fr) instead of improving their configuration.
2018-06-29: added: netcup.net/de (netcup, you can't possibly be serious (SSLv3, DES3, MD5, RC4 ...?))
2018-06-15: updated: riseup.net - added MECSA; Mozilla Observatory C+ -> B; Security Headers D -> A; Referrers Leaked -> No
2018-06-15: updated: danwin1210.me - MECSA 4.0 / 5.0; 4.5 / 5.0; 5.0 / 5.0 -> 0.0 / 5.0; 4.0 / 5.0; 3.5 / 5.0; IMAPS, POP3S, SMTPS A -> B; Crypt Check A -> B; Security Headers D -> A; Mozilla Observatory D+ -> D-; Referrers leaked: Yes -> Partially;
2018-06-15: added: mc-free.com, simbamail.de, rediffmail.com, anpa.de ... (ongoing)
2018-06-15: updated: kolabnow.com - added MECSA; SMTP B -> A; CryptCheck Timeout -> A+
2018-06-14: added: ok.de
2018-06-06: updated: DMARC - gmail.com No -> Disabled; fastmail.com No -> Disabled; yandex.ru No -> Disabled
2018-06-04: added: mecsa for directbox.com
2018-06-04: updated: directbox.com - DMARC No -> Disabled; DKIM ToDo -> Yes; Mozilla Observatory B -> B+
2018-06-02: added: mailjunky.de; mailjunky.de
2018-05-27: added: mecsa for yandex.ru
2018-05-24: updated: mailfence.com - IMAPS "B" -> "A"; POP3S "B" -> "A"; SMTPS "B" -> "A"; SMTP "B" -> "A"; CryptCheck "B" -> "A+"
2018-04-20: updated: systemli.org - IMAPS "A" -> "B"; POP3S "A" -> "B"; SMTPS "A" -> "B"; SMTP "A" -> "B"; Mozilla Observatory "B" -> "A+"; securityheaders "B" -> "A"; Referrers "Leaked" -> "No"; Cookies "2" -> "0"
2018-03-28: updated: posteo.de - mecsa "5.0/5.0; 4.5/5.0; 4.0/5.0" -> "5.0/5.0; 5.0/5.0; 5.0/5.0"; IMAPS "A+" -> "C"; POP3S "A+" -> C; DMARC "No" -> Disabled
2018-03-24: updated: arcor.de - mecsa "0.0/5.0; 3.0/5.0; 0.0/5.0" -> "4.0/5.0; 3.0/5.0; 2.0/5.0"; securityheaders "F" -> "D"
2018-03-24: updated: emailn.de - mecsa "4.0/5.0 ; 3.0/ 5.0 / 2.0/5.0" -> "4.0/5.0; 0.0/5.0; 2.0/5.0"
2018-03-24: updated: systemli.org - mecsa "4.5/5.0; 4.5/5.0; 5.0/5.0" -> "5.0/5.0; 5.0/5.0; 5.0/5.0"
2018-03-16: updated: tutanota.com - htbridge "A" -> "A+"; CryptCheck "C" -> "B"
2018-02-20: added: teknik.io
2018-02-17: added: mecsa for fastmail.com; hushmail.com (hushmail.me)
2018-02-17: added: mecsa for lavabit.com
2018-02-13: updated: disroot.org - mecsa "4.5/5.0; 4.5/5.0 4.0/5.0" -> "4.5/5.0; 5.0/5.0; 5.0/5.0"; DMARC "No" -> "disabled"; Referrers "Yes" -> "No"; securityheaders "B" -> "A"
2018-02-08: updated: mailcow.de - Mozilla Observatory "F" -> "B"; securityheaders "C" -> "B"; Referrers leaked: "Yes" -> "No"; Cookies "2" -> "1"; Third-party requests "2" -> "0"; Third-parties "2" -> "0"
2018-02-06: added: biomail.de, greensta.de
2018-02-05: added: free.de
2018-02-01: added: goneo.de
2018-01-31: added: online.de (1und1.de)
2018-01-20: added: hosted.mailcow.de
2018-01-18: updated: mailfence.com - mecsa "3.0/5.0; 4.5/5.0 3.5/5.0" -> "4.0/5.0; 4.5/5.0; 5.0/5.0" - IMAPS; POP3S; SMTPS "C" -> "B"
2018-01-16: added: eclipso.de
2018-01-15: added: strato.de, countermail.com
2018-01-14: added: 1984.is, islandnet.com, unseen.is, ownbay.net
2018-01-13: added: safe-mail.net, pobox.com
2018-01-12: added: Email Security Grader
2018-01-12: added: gandi.net
2018-01-12: updated: mailfence.com - DMARC - "No" -> "Disabled"
2018-01-06: added: inbox.com, cox.net, virginmedia.com
2018-01-05: added: danwin1210.me
2018-01-04: added: mecsa for aol.com
2018-01-01: added: mecsa for t-online.de
2017-12-29: added: mecsa for keemail.me (tutanota.de), systemli.org, posteo.de, startmail.com
2017-12-28: added: mecsa for web.de, netcourrier.com
2017-12-28: added: aktivix.org, artikel-140.nl, lavabit.com, boum.org, cryptix.de, immerda.ch, systemausfall.org, netcourrier.com, aikq.de
2017-12-27: added: mecsa for runbox.com
2017-12-27: added: cock.li, riseup.net, systemli.org, so36.net, yandex.ru, zoho.eu, mail.com, fastmail.com, hushmail.com, mail.ru, mail.lilo.org, freemail.ox.io, vmail.me, autistici.org, artikel-140.nl
2017-12-26: added: mecsa for mail.de, arcor.de and gmx.de (Michael)
2017-12-24: Initial list

dismail.de