YeyMail sells email aliases for money. DuckDuckGo Email Protection gives them away for nothing, and there is no paid tier of it to upsell you to later. That is the disclosure, and it should colour everything below, because we have an obvious commercial reason to be unkind about a free competitor and you should be watching for it.
So this review does not editorialise. Every claim here was read on DuckDuckGo's own help pages and its own blog today, and where their documentation does not answer a question, the piece says so rather than guessing. Where DuckDuckGo is the better answer, it says that too, without softening it.
The short version: Email Protection is a good product. Its tracker removal is the strongest part of it and is better documented than most, its replies work without setup, and for a very large number of people it is simply the correct choice. It is also narrower than it first appears, in ways worth knowing before you route your signups through it.
What it is, and what it costs
DuckDuckGo describes Email Protection as "a free email forwarding service that removes multiple types of hidden email trackers and lets you create unlimited unique private email addresses on the fly." It is forwarding only. There is no mailbox to log into: their troubleshooting pages state plainly that "There is no unique inbox for your Duck Address," because everything sent to one is stripped of trackers and passed on to the ordinary inbox you nominated at signup, whether that is Gmail, Outlook, Apple Mail or Proton.
On price, we checked specifically for a hidden upper tier and there is not one. DuckDuckGo does sell a subscription, listed on its own pricing page today at $9.99 a month or $99.99 a year for Plus, and $19.99 a month or $199.99 a year for Pro. That subscription covers a VPN, advanced models in Duck.ai, Personal Information Removal and Identity Theft Restoration. Email Protection itself is not sold at any level and has no paid tier; the one connection their pages draw is that subscribers can enhance Email Protection with Personal Information Removal. The forwarding, the addresses and the tracker stripping are free.
One friction point is real and easy to miss. Signing up requires DuckDuckGo's own browser or its extension. Their setup page lists the iOS and Android browsers, the Mac and Windows browsers, and extensions for Firefox, Chrome, Edge, Brave and Opera. You cannot register from a bare browser tab.
Two kinds of Duck Address
Their pages distinguish two things carefully, and the distinction matters. There is one personal Duck Address, which you choose at signup and which looks like name@duck.com. Then there are private Duck Addresses, which are generated for you and look like their own example, amaze-gem-spider@duck.com. The personal one is the address you hand to people. The private ones are what you give to shops, forums and newsletters, one per site, in the ordinary alias pattern.
How many private addresses can you have? Their help page answers "Effectively unlimited!" and then, to their credit, immediately qualifies it: "Technically, there is a limit on the number of private Duck Addresses you can generate per day to prevent abuse, but it's not a limit we expect anyone to practically hit." The number is not published. That is a fair and honest way to phrase a limit, and more services should copy it.
Generating them happens through autofill when the browser or extension spots an email field, through the menu in their apps and extensions, or on the Autofill tab of Email Protection Settings. Managing them afterwards is less centralised than you might expect, and we come back to that below.
Tracker removal is the actual product
Most alias services treat tracker stripping as a feature bullet. For DuckDuckGo it is the reason the thing exists, and their documentation of it is unusually specific for a free service.
Their pages describe email trackers as embedded in images and links, collecting "when you've opened a message, where you were when you opened it, and what device you were using," and they put the prevalence at 85% of emails, which is their own figure rather than an independent one. Against that, the mechanism they document has three parts. Mail arriving at a Duck Address is "stripped of email trackers on our block list" before forwarding, covering trackers hidden in images, scripts and other media embedded in the message. Separately they say they "detect and remove a growing number of the trackers embedded in email links," which is the harder half of the problem and the part many competitors leave alone. And they upgrade insecure HTTP links in a message to HTTPS when those links appear on their upgradable list.
The forwarded message then carries a DuckDuckGo banner at the top, which their blog says will tell you "how many trackers we've removed, what company appears to be behind them, and other helpful information." Whatever you think of a banner injected into your mail, it is the most legible tracker report any of these services puts in front of you, and it makes an abstract problem visible. If you want the background on what is being stripped and why, we wrote about the mechanics in how to stop email tracking.
On what happens to the message itself, their privacy page is blunt: "DuckDuckGo will never save your emails for this service," and "We don't even save the headers (e.g., to/from)." That is a stronger written commitment on headers than most forwarding services make.
Replies, precisely as documented
Replying needs no configuration. Their page says to "Simply reply to any email sent to one of your Duck Addresses as you normally would. We route your replies through duck.com so they're delivered from the Duck Address they were sent to." That is the behaviour you want and it arrives without an SMTP dialog.
There is one documented exception and it is worth reading twice: "If your forwarding address is on a unique domain without an SPF record, replies sent from Duck Addresses aren't supported." If you forward to a personal domain you administer yourself and have never set up SPF, replies will not work. Most people forwarding to Gmail or Outlook are unaffected.
They also add a caveat that other services quietly skip. Because DuckDuckGo does not write your message, they "can't guarantee that it will not include your forwarding address or other identifiers if they appear within the text of the email." A signature block will leak you regardless of how good the routing is. That applies to every service in this category, ours included, and we covered the general shape of it in replying without revealing your address.
Starting a brand new conversation is the awkward part. Their help page on composing is titled for the personal Duck Address, and the documented method is to send from your forwarding address to a rewritten recipient: to reach brian@gmail.com from jane@duck.com, you address the message to brian_at_gmail.com_jane@duck.com. It works, and it is clearly a workaround rather than a feature. Their pages do not document the same trick for private Duck Addresses.
Custom domains
There is no custom domain support, and their help pages do not discuss the possibility at all. Every address ends in @duck.com, personal and private alike. For a free service that is an entirely reasonable line to draw, but it sets a hard ceiling: you cannot use Email Protection for hello@yourbusiness.com. If a domain you own is the requirement, this is the point at which Email Protection stops being a candidate and you want custom domain aliases from somewhere, whether that is us or one of the others in our comparison of alias services.
What their pages do not state
Reviewing documentation means being honest about its gaps as gaps, not as failures. These are questions we went looking for answers to today and did not find.
| Question | What DuckDuckGo's pages say |
|---|---|
| Daily private address limit | Confirmed to exist, number not published |
| Mail to a deactivated address | Not stated whether it is rejected or dropped |
| Reply all behaviour | Not addressed |
| Custom domains | Not mentioned anywhere |
| Central list of your addresses | Not offered; managed via the Passwords menu or the banner on each forwarded email |
The management model deserves a note of its own. On Android, macOS and iOS you handle private addresses inside the Passwords menu of their browser. On Windows or the extension, their instructions are to find an email sent to the address in question and use the Deactivate button in the banner. There is no single screen listing everything you have created. If you like auditing your aliases in one place, that will bother you. If you only ever touch an address when spam arrives at it, it will not.
Who should just use DuckDuckGo
Plainly, without hedging: if you already use the DuckDuckGo browser or extension, forward to Gmail, Outlook, Apple Mail or Proton, want effectively unlimited throwaway addresses for signups (a daily generation cap exists, unpublished, and is not one normal use will reach), and care most about not being tracked when you open your mail, use Email Protection and do not pay anyone for this. It is free, it is competently built, its tracker removal is the best documented in the category, and it costs you nothing to stop using.
That describes a lot of people. It stops describing you at fairly specific points: when you need a domain you own, when you need to start conversations from an alias rather than only reply to them, when you want one screen showing every address and what has been arriving at it, or when the addresses are for a business and duck.com in the sender line is not acceptable.
Where we fit, honestly
We charge $0.99 a month for Starter and $4.99 for Plus, with a free seven-day trial that needs no card. We have no free tier, so we are not competing with DuckDuckGo on price and never will be.
On tracker handling specifically, we should be careful not to imply an advantage we do not have. Our tracker removal is opt-in per alias and is never automatic, so out of the box DuckDuckGo strips more than we do. Read receipts are stripped for everyone on our side, but the broader tracker blocklist is a switch you turn on alias by alias. If tracker stripping without thinking about it is your priority, that is a point for them.
One more thing we should state rather than let you discover: reply all is our documented exception too. A plain reply goes out from the alias with no setup, but the other people on the thread are ordinary addresses in your mail app, so your reply to them leaves from your real account and reveals it. DuckDuckGo's pages do not address reply all either. On this, neither of us solves it.
What we sell instead is the part their pages do not cover: aliases on domains you own, per-alias SMTP so you can start new conversations rather than only reply, a per-alias activity view, and a kill switch that refuses mail at SMTP time. Those are worth $0.99 a month to some people and worth nothing to others, and the honest recommendation depends entirely on which group you are in.