Mailbox.org is a Berlin-based email hosting service, not a forwarding-only service. Real mailboxes on a custom domain, catch-all forwarding, server-side PGP encryption, and a proprietary admin API, hosted on infrastructure in Germany and operated by Heinlein Hosting GmbH (part of the Heinlein Group, whose Berlin postmaster roots trace to 1989 via JPBerlin). It appears in this category for the same reason Fastmail and Migadu do: WordPress operators evaluating a custom-domain inbox will meet it alongside the forwarding-only services, and its German jurisdiction, encryption defaults, and BSI C5 attestation answer a class of query that Fastmail (Australian, US data centres) and Migadu (Swiss company, French servers) do not.
The distinction matters. ImprovMX and Forward Email forward mail somewhere else. Mailbox.org is the somewhere else. For inbound-only forwarding, Mailbox.org is overkill at €3/month for something ImprovMX does for free. For a mailbox on a custom domain hosted in Germany with server-side PGP and audited BSI C5 compliance, it is the closest thing the market has to a GDPR-by-default mailbox host. (For a category overview, see the email forwarding services roundup.)
Mailbox.org launched in 2014 as the Heinlein Group’s private-mail offering, built on the same postmaster expertise that has run JPBerlin since 1989. The company is independently operated, runs its own hardware in Berlin data centres on renewable electricity, and holds a BSI C5 Type 1 attestation issued to Heinlein Hosting GmbH (announced 7 January 2026) and an ISO/IEC 27001:2022 certification.
Where Mailbox.org fits in a WordPress stack
Inbound mailbox hosting. For a WordPress operator who wants [email protected], [email protected], and [email protected] to be real mailboxes with IMAP access rather than aliases into Gmail, Mailbox.org handles that layer. Standard (€3/month at annual billing) covers 50 aliases across custom-domain addresses; Premium (€9/month at annual billing) raises that ceiling to 250 and multiplies mail and drive storage. Both tiers include the Office and Meet suite; both support custom domains on the account (Mailbox.org’s docs do not publish a per-account domain count).
Outbound SMTP. The relay lives at smtp.mailbox.org, ports 465 (SSL) and 587 (STARTTLS). A WordPress SMTP plugin can be pointed at it with an app password, but Mailbox.org is not a transactional relay: no bounce webhooks, no suppression lists, no dedicated IPs, no published sending limits. A WordPress site sending A transactional email is the automated message a WordPress site sends in response to a single user action – a password reset, an order confirmation, a form receipt – addressed to the user who triggered it. Read full reference → (password resets, order confirmations, form receipts) should use a dedicated relay (Postmark, SMTP2GO, Mailgun) alongside a Mailbox.org mailbox for the human inbox. Different DNS records, different traffic directions, one shared domain.
Pricing
Mailbox.org publishes three private tiers with a 25% discount at annual billing over monthly. There is no perpetual free tier; the 30-day trial does not require a credit card.
| Plan | Annual billing | Monthly billing | Mail storage | Drive storage | Custom domain | Aliases (custom-domain) |
|---|---|---|---|---|---|---|
| Light | €12/year (€1/month) | €1/month | 2 GB | – | Family accounts only | – |
| Standard | €3/month (€36/year) | €4/month | 20 GB | 10 GB | Yes | 50 |
| Premium | €9/month (€108/year) | €12/month | 50 GB | 100 GB | Yes | 250 |
Office (word processor, spreadsheet, presentation) and Meet (video conferencing) are included on Standard and Premium; Meet is also on Light. Every plan grants fixed-count @mailbox.org aliases (3 on Light, 25 on Standard and Premium) alongside the custom-domain aliases.
Business is priced in two shapes. Business Standard (€4 net/month per user) and Business Premium (€12 net/month per user) mirror the private tiers with an admin console for team accounts. Separate Silver, Gold, and Platinum admin tiers at €25, €75, and €250 per month bundle larger mailbox counts and priority support for organisations sizing by team rather than by user.
The September 2026 adjustment raised private Standard and Premium and doubled mail and drive storage at both tiers. Light was unchanged. New customers moved to the new prices on 15 July 2026; existing private customers switched on 1 September 2026; business customers on the same date.
For context: Fastmail Individual is €5/month per user at annual billing for 50 GB and Masked Email; Migadu Mini is $9/month flat for unlimited addresses on unlimited domains; Google Workspace Business Starter is $7 per user per month. Standard is the entry point to custom-domain email for a private operator on Mailbox.org, as Light restricts custom domains to family accounts.
DNS setup
Mailbox.org uses four MX records at priority 10 and four DKIM CNAMEs, plus SPF and DMARC:
| Record type | Host | Value | Priority |
|---|---|---|---|
| MX | @ |
mxext1.mailbox.org |
10 |
| MX | @ |
mxext2.mailbox.org |
10 |
| MX | @ |
mxext3.mailbox.org |
10 |
| MX | @ |
mxext4.mailbox.org |
10 |
| TXT (SPF) | @ |
v=spf1 include:mailbox.org ~all |
– |
| CNAME | MBO0001._domainkey |
MBO0001._domainkey.mailbox.org |
– |
| CNAME | MBO0002._domainkey |
MBO0002._domainkey.mailbox.org |
– |
| CNAME | MBO0003._domainkey |
MBO0003._domainkey.mailbox.org |
– |
| CNAME | MBO0004._domainkey |
MBO0004._domainkey.mailbox.org |
– |
| TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:[email protected] |
– |
Four equal-priority MX records give receiving mail a load-balanced entry across Mailbox.org’s inbound cluster; a handful of registrar DNS UIs insist on distinct priorities, in which case 10/20/30/40 works with the same downstream failover. Four DKIM selectors (MBO0001 through MBO0004) as CNAMEs let Mailbox.org rotate signing keys without the customer touching DNS again.
The ~all SPF terminator (softfail) is Mailbox.org’s documented default and is the right starting point while a WordPress SMTP relay is being enumerated as an additional sender. Tighten to -all (hardfail) once the sender list is stable. The p=none DMARC policy is the standard monitoring-mode starting point; tighten to p=quarantine or p=reject once aggregate reports confirm SPF and DKIM pass consistently for legitimate mail.
Aliases, catch-all, and forwarding
Standard permits 50 custom-domain aliases and Premium 250. Whether that ceiling applies per domain or across every custom domain on the account is not clarified in Mailbox.org’s KB; the pricing page uses the unqualified phrasing “for custom domain names”. Role addresses (postmaster@, abuse@, hostmaster@, webmaster@) do not count against the limit. Aliases are pre-configured through the admin panel or API; there is no per-vendor masked-alias generator equivalent to Fastmail Masked Email or SimpleLogin.
Catch-all. Any address on a custom domain that does not match a configured alias can be delivered to a nominated mailbox. Only one catch-all per domain is allowed; when a domain is shared across multiple user accounts, only one user can hold it.
External forwarding. Aliases and mailboxes can forward to an external destination through the standard mail-rules interface. As with any mailbox-host forwarding, SPF alignment breaks in transit and receiving providers running strict DMARC policies (Gmail in particular) may reject forwarded messages. If BYO-domain forwarding is the primary requirement, ImprovMX or Forward Email do the job with SRS envelope rewriting; Mailbox.org’s forwarding is a convenience on top of a mailbox, not a substitute for a dedicated forwarding service.
Encryption and compliance
The differentiator that separates Mailbox.org from Fastmail and Migadu:
mailbox Guard (server-side PGP). Private keys are generated and stored encrypted on Mailbox.org’s German servers and unlocked with the account password. Incoming PGP-encrypted mail is decrypted server-side for delivery to the webmailer, and outgoing mail is signed and encrypted at send time. Both PGP/MIME and PGP/Inline are supported. This is a different trust model from Proton Mail’s client-side-only PGP: the server can decrypt when the user is logged in, in exchange for search, filtering, and mobile-app compatibility that pure client-side PGP cannot provide.
S/MIME. Available in the webmailer on every plan (Light, Standard, and Premium), with certificate storage handled server-side alongside PGP keys.
BSI C5 Type 1. Attestation issued to Heinlein Hosting GmbH, announced by Mailbox.org on 7 January 2026, aligning the operator against the German Federal Office for Information Security’s Cloud Computing Compliance Criteria Catalogue. C5 is the German regulator’s baseline for cloud services handling regulated data and is required or expected by many German public-sector procurements.
ISO/IEC 27001:2022. Held; the published scope statement lives on the Mailbox.org security page rather than the marketing pricing table.
For operators subject to German or EU compliance requirements (public sector, healthcare, legal), the C5 and 27001 pair is the audit trail Fastmail’s Australian entity cannot produce.
API and protocol support
IMAP (imap.mailbox.org, port 993), POP3 (pop3.mailbox.org, port 995), and SMTP (smtp.mailbox.org, ports 465/587) cover the mail layer. CalDAV and CardDAV cover calendars and contacts. There is no JMAP endpoint.
The admin API lives at api.mailbox.org (v1) and uses a proprietary JSON-RPC-style envelope with HPLS-AUTH header authentication. Its scope is administrative: creating and managing users, domains, mailboxes, and aliases from scripts or a provisioning system. It is not a REST API and is not intended for reading or sending mail (IMAP and SMTP handle that end).
Delivery logs are visible in the webmailer for troubleshooting individual messages; there is no bulk log export or webhook stream.
What Mailbox.org does not do
Free forwarding. Every use case requires a paid Standard plan or higher; Light is @mailbox.org only and does not support custom domains. If all that is needed is [email protected] forwarding to Gmail, ImprovMX or Forward Email handle this at no cost.
Masked email aliasing. No SimpleLogin-style per-vendor disposable-alias generator. Aliases are conventional and pre-configured. SimpleLogin or Fastmail’s Masked Email cover that pattern; layer one in front of a Mailbox.org mailbox if it is a requirement.
Transactional email relay. No dedicated IPs, no suppression lists, no bounce webhooks, no published sending quotas. WordPress wp_mail() should not route through Mailbox.org.
JMAP. Fastmail’s modern API alternative to IMAP is not implemented. Clients that specifically want JMAP will need to fall back to IMAP.
Non-EU data residency. All infrastructure is in Berlin. Operators with a specific US-residency requirement should look elsewhere; operators wanting EU residency will find this the point of the exercise.
Verdict
Mailbox.org is the EU-jurisdiction alternative to Fastmail for operators who want a real domain-attached mailbox on German infrastructure with server-side PGP and audited compliance. Standard at €3/month annual (€4/month monthly) is the entry point for a custom domain, with 50 custom-domain aliases and catch-all forwarding; Premium at €9/month annual raises the alias ceiling to 250 and multiplies storage. Office and Meet come with both. The trade-offs are legible: no JMAP, no Masked Email, no non-EU option, and no transactional-sending capability worth relying on.
For a simple [email protected] alias to Gmail, this is overkill; use ImprovMX or Forward Email. For a real mailbox on a custom domain where German jurisdiction, native PGP, and BSI C5 compliance matter, Mailbox.org is the pick in the roundup no competitor can match. Pair it with a dedicated transactional relay for anything WordPress itself generates.