← Back to Directory
Logo: GMX Mail

GMX Mail

German FreeMail from 1&1 Mail & Media GmbH (United Internet): large free storage, IMAP/POP/SMTP, optional OpenPGP and 2FA, ad-supported consumer webmail.

freemailwebmailgermanyimapopenpgpunited-internetad-supportedconsumer
Visit WebsiteAsk an EU migration specialistFeedback & corrections

GMX Mail is a consumer webmail service operated by 1&1 Mail & Media GmbH in Germany, part of the United Internet AG consumer applications segment alongside WEB.DE and mail.com. The product is offered internationally under domains such as gmx.com and gmx.net.

It exists as high-storage German FreeMail rather than a zero-access privacy inbox. Free accounts are advertising-supported; paid tiers exist for ad-reduced or ad-free use. Users can enable POP3, IMAP, and SMTP, plus optional OpenPGP and 2FA.

The concrete differentiator is that combination of large free storage, open client protocols, and a German United Internet operator. It is consumer SaaS, not default end-to-end encrypted mail.

German operatorMailbox in DE (claimed)IMAP / POP3 / SMTPOptional OpenPGPFree ad-supportedSaaS only

Shortlist GMX Mail for consumer or light-professional freemail when you want a German United Internet operator, claimed German mailbox data centers, large free storage, and standard IMAP/POP—with optional OpenPGP. Skip when you need zero-access encryption by default, enterprise DPA/audit packs, or an ad-free architecture as the baseline; consider Proton Mail instead.

Key capabilities

gmx.com free accounts advertise up to 65 GB email storage and 50 MB attachments. POP3, IMAP, and SMTP are supported after you enable them in settings (TLS 1.2+; imap.gmx.com / mail.gmx.com). Suits users who want client choice (Thunderbird, Outlook, mobile) without Google or Microsoft as the mailbox host.

GMX offers free OpenPGP messaging via the Mailvelope browser extension: key generation, local key storage, key directory, and mobile recovery. Encryption is opt-in per message after setup—not whole-mailbox zero-access by default. Best for occasional sensitive threads when both parties can use OpenPGP.

Create up to 10 alias addresses (including other GMX domains) managed in one inbox, and pull up to 10 external accounts via Mail Collector. Useful for freelancers and project mail without juggling multiple passwords or providers day-to-day.

Free accounts include automated spam filtering (user blacklist and optional improved detection) and antivirus scanning of mail and cloud files. Optional two-factor authentication uses an authenticator app (TOTP); third-party clients use app-specific passwords when 2FA is on.

Accounts include contacts, calendar/organizer, about 2 GB GMX Cloud with share links, and Online Office for common document formats—enough for light personal productivity without a separate suite subscription.

At a glance

HQ / entity
1&1 Mail & Media GmbH, Montabaur (DE)
Parent group
United Internet AG (DE)
Product type
Consumer FreeMail + optional paid tiers
Hosting (claimed)
Mailbox/calendar data in German data centers
Protocols
Webmail; POP3/IMAP/SMTP (opt-in)
Open source
No
Self-hosted
No

Best fit when

  • Individuals and freelancers who want a European freemail address with large free storage and IMAP client freedom
  • Users consolidating multiple addresses via aliases (up to 10) and Mail Collector
  • Buyers who prefer a German legal controller (1&1 Mail & Media GmbH / United Internet) over US Big Tech freemail
  • Teams that only need optional OpenPGP for specific sensitive threads, not zero-access by default
  • Users already familiar with GMX/WEB.DE in German-speaking markets who need international domains (e.g. gmx.com)

Poor fit when

  • Organizations that require default end-to-end / zero-access encryption for all mail
  • Procurement that needs a published independent security audit pack, ISO/SOC evidence, and a B2B DPA as standard shortlist inputs
  • Teams that cannot accept advertising-funded freemail economics or interest-based ad consent UX
  • Custom-domain corporate mail and admin controls at Microsoft 365 / Google Workspace depth
  • Self-hosted or open-source mail stack requirements

Consider instead when

  • When: You need zero-access encryption by default and a privacy-first paid model without ad-funded freemail as the core product

    Consider: Proton Mail

    Proton is the stronger shortlist peer in this catalog for E2E-first evaluation.

  • When: You need Google Workspace-class collaboration and are willing to accept US Big Tech jurisdiction

    Consider: Gmail / Google Workspace

    Richer suite integration; different sovereignty and ad/ecosystem tradeoffs.

  • When: You need Microsoft ecosystem mail, calendar, and compliance tooling

    Consider: Outlook.com / Microsoft 365

    Strong enterprise admin story; US parent and CLOUD Act path differ from GMX.

Jurisdiction & ownership

Legal entity
1&1 Mail & Media GmbH (Zweigniederlassung Karlsruhe; Hauptsitz Montabaur)
Governing law
German law (international T&Cs); GDPR applies as EU controller
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Vendor privacy (EN): FreeMail emails, address book, and calendar processed in secure data centers in Germany. Product security pages: European data centers for stored mail. Group United Internet AG (DE). Named non-mail paths: Google Analytics/GTM on portal; Google/Yahoo search partnership; international ad partners under consent; DE privacy allows third-country transfers with Chapter V safeguards when used. No public exhaustive mail-infra subprocessor list found.

No known US parent of 1&1 Mail & Media GmbH / United Internet AG. Exposure scored medium (not low) because of incomplete public infrastructure subprocessors plus US-group analytics (Google) and worldwide ad partners on freemail. Mailbox content residency claims are first-party. Indicative only — not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumAdvertising-funded free tier

    FreeMail depends on ads and (with consent) interest-based targeting and partner sharing. Privacy posture differs from paid privacy mail. Practical impact: expect consent UX, ad surfaces, and partner lists—not a zero-ads default.

  • MediumE2E encryption is optional, not default

    Without OpenPGP setup, mailbox content is accessible to the provider like conventional hosted mail. Practical impact: do not treat GMX FreeMail as zero-access encryption architecture.

  • MediumIncomplete public infrastructure subprocessors

    Residency for mail is claimed (Germany/EU), but there is no enterprise-style published subprocessor inventory for core mail infrastructure. Portal paths name Google Analytics and global ad partners. Practical impact: extra questionnaire work for high-assurance buyers.

  • LowInactivity and freemail operational policies

    Terms/privacy allow deletion of free mailbox content after prolonged inactivity (about 180 days without login on FreeMail privacy text). Practical impact: inactive project addresses can disappear if not maintained.

  • LowNo public ISO/SOC package for FreeMail

    Security pages emphasize product features (spam, AV, 2FA, PGP) rather than downloadable ISO/SOC evidence for FreeMail. Practical impact: may fail enterprise vendor security questionnaires without further vendor dialogue.

Open questions for due diligence

  • Will 1&1 Mail & Media sign a B2B DPA and publish a current mail-infrastructure subprocessor list for our use case?
  • Are FreeMail mailbox systems solely on United Internet / 1&1 operated German DCs, or are any US-group cloud providers used for primary storage, backup, or DR?
  • What independent audits or certifications (if any) cover the FreeMail platform beyond the Mailvelope/OpenPGP path?
  • For paid/premium mailboxes: which advertising and tracking paths remain, and what contractual residency language is available?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

The controller named on imprint and privacy pages is 1&1 Mail & Media GmbH (Montabaur / Karlsruhe, Germany). It sits in United Internet AG's consumer Mail & Media segment with WEB.DE and mail.com. IONOS is a related United Internet business-applications brand (hosting/cloud), not the FreeMail legal operator—though group companies may provide selected infrastructure services for other GMX products (e.g. homepage hosting).

For FreeMail, the English privacy policy states that emails, address book, and calendar data are processed in secure data centers in Germany (with limited exceptional cases). Product security/encryption pages also describe European data-center storage and transport encryption. Confirm current wording and any exceptions with the vendor before treating this as a contractual residency guarantee.

No. Transport encryption and provider-side protections apply, but OpenPGP E2E is optional (Mailvelope setup, both parties). Without it, the provider can access message content as a normal hosted mailbox—relevant if your bar is zero-access encryption like Proton Mail.

Yes. Enable POP3/IMAP in account settings, then use the published server data (e.g. IMAP imap.gmx.com:993, SMTP mail.gmx.com:587 STARTTLS, TLS 1.2+). Official Android/iOS apps are also available. With 2FA enabled, third-party clients need an app-specific password.

FreeMail is advertising-supported. Privacy materials describe interest-based advertising when you consent, permission management, and (on German product lines) a consent-or-pay style choice between paid ad-tracking-free options and free use with ad consent. Portal/search partners can include Google. Paid premium mailboxes reduce or remove ads—evaluate commercial options on the official site without relying on third-party price tables.

Prefer Proton Mail when default end-to-end encryption, privacy-first architecture, and avoiding an ad-funded freemail model are non-negotiable. Prefer GMX when you need a mainstream European freemail with large free storage, aliases/collector, and standard IMAP under a German United Internet group company—and optional PGP is enough for sensitive threads.