ChatGPT answers, unedited

For a health-focused blog, I’d recommend self-hosting mailcow on a dedicated VPS, with a few privacy/security layers around it.

Recommended setup

Domain: yourblog.com
Mail server: mailcow on a dedicated Linux VPS
Webmail: SOGo, included with mailcow
Encryption: TLS 1.2/1.3 for client connections + MTA-STS/DANE where practical
Authentication: DKIM + SPF + DMARC
Admin security: WebAuthn/FIDO2 or TOTP 2FA
Backups: encrypted, off-server backups

Mailcow is a particularly good fit because it gives you a fairly complete mail stack rather than requiring you to assemble Postfix, Dovecot, spam filtering, webmail, DKIM, etc. yourself. Its current stack includes Postfix, Dovecot, Rspamd, SOGo, DKIM handling, and TLS-security components. Mailcow Documentation Mailcow Documentation

Why I'd choose it

• You control the mailbox data. Unlike a hosted provider, you control the server, storage, logs, and backups.
• Strong transport encryption: mailcow supports encrypted IMAP/SMTP connections and currently supports MTA-STS; it also incorporates DANE/TLSA capabilities. Mailcow Documentation Mailcow Documentation
• Good domain authentication: mailcow's documentation recommends SPF, DKIM and DMARC, including a p=reject DMARC configuration once you're confident everything is working. Mailcow Documentation
• Strong administrator authentication: WebAuthn, YubiKey-based authentication and TOTP are supported. Mailcow Documentation
• Encrypted backups: mailcow specifically recommends regular backups and supports encrypted backup approaches such as Borgmatic. Mailcow Documentation

One important caveat about "encrypted email"

Self-hosting doesn't automatically mean end-to-end encrypted email.

TLS protects messages while they're traveling between your server and another mail server that supports TLS. It does not guarantee that the recipient's provider can't read the message after delivery.

For genuinely sensitive health-related correspondence, I'd therefore use a separate E2EE mechanism—for example, send a notification email saying "You have a secure message" and put the sensitive content behind an authenticated HTTPS page, rather than putting health information directly into ordinary email.

If you don't actually need to administer your own mail infrastructure, Proton Mail with your custom domain is the alternative I'd seriously consider. Proton supports custom domains on paid plans and provides E2EE between Proton users plus zero-access encryption for externally received mail. Proton Proton

My choice for your blog

One additional consideration: if the blog will collect information about people's medical conditions, symptoms, treatments, or other health information, treat that as a substantially higher-risk privacy project than ordinary blogging. Email infrastructure alone isn't enough—you'd want to minimize what you collect, restrict access, encrypt backups, keep logs to a minimum, and establish appropriate retention/deletion policies.

If you want true self-hosting, my concrete starting architecture would be mailcow + a hardened VPS + encrypted backups + Cloudflare/DNS only where appropriate + SPF/DKIM/DMARC + MTA-STS + WebAuthn 2FA.

For a health-focused blog, I would prioritize privacy, account security, domain reputation, and a good workflow for handling reader questions. You probably do not need to self-host an email server (it is difficult to secure, maintain deliverability, and prevent leaks). A privacy-focused hosted provider is usually the stronger option.

My top recommendations:

1. Best overall: Proton Mail with your custom domain

Best fit if you want: strong privacy + professional appearance + manageable setup.

Example:

• hello@yourhealthblog.com
• newsletter@yourhealthblog.com
• privacy@yourhealthblog.com

Advantages:

• End-to-end encryption between Proton users.
• Zero-access encryption for stored mail (the provider cannot simply read your mailbox contents).
• Supports custom domains on paid plans.
• Strong security features such as 2FA and domain authentication tools. proton.meproton.me

Trade-offs:

• Regular email sent to Gmail/Outlook users cannot magically become end-to-end encrypted unless the recipient uses compatible encryption or you use a protected-message workflow.
• Some integrations may be less convenient than traditional business email.

For a health blog, I would use:

• Proton Mail for your main identity and reader correspondence.
• A separate newsletter platform if you collect large subscriber lists.
• A dedicated address like contact@ rather than exposing your personal inbox.

2. Most privacy-maximal: Tuta Mail

Best fit if you want: maximum encryption coverage and minimal data exposure.

Advantages:

• End-to-end encryption is built into the service.
• Encrypts more mailbox data than many traditional providers, including subject lines and contacts. tuta.com
• Supports custom domains on paid plans. tuta.com
• Strong privacy orientation and German jurisdiction. tuta.com

Trade-offs:

• Less compatible with some third-party email clients and workflows compared with conventional email providers.
• If your blog grows into a business with many integrations, you may find Proton or a business-oriented provider easier.

3. Best usability compromise: Fastmail

Best fit if you want: a polished email experience with good privacy practices.

Advantages:

• Excellent email usability.
• Custom domains.
• Strong security features and no advertising business model. www.fastmail.com
• Works well with normal email apps.

Trade-off:

• It does not provide the same zero-access/end-to-end encrypted mailbox architecture as Proton or Tuta. www.fastmail.com

My suggested setup for a health blog

Domain

• Register your domain with a privacy-respecting registrar.
• Enable domain privacy where available.

Email

• Use Proton Mail or Tuta.
• Create separate addresses:
  • hello@domain.com — public contact
  • editor@domain.com — blog operations
  • privacy@domain.com — privacy requests
  • alerts@domain.com — account/security notifications

Security

• Use a hardware security key if possible (for example, a FIDO2/YubiKey-style device).
• Enable 2FA.
• Use a password manager.
• Configure:
  • SPF
  • DKIM
  • DMARC

These help prevent spoofing and improve deliverability. proton.meproton.me

Health-specific caution
If readers may send personal health information, avoid positioning ordinary email as a secure medical communication channel. Email encryption protects many risks, but it does not automatically make a setup compliant with healthcare regulations (such as HIPAA in the U.S.). If you will receive identifiable patient information, consider a dedicated secure intake system rather than ordinary inbox email.

My pick:

• Solo health blogger → Proton Mail + custom domain
• Privacy-first activist/research style blog → Tuta Mail
• Business blog needing lots of integrations → Fastmail or Proton Mail Business

For most health-focused blogs, Proton Mail is the best balance of privacy, professionalism, and ease of use.

For a health-focused blog, I would prioritize:

1. Strong privacy (especially because readers may contact you about sensitive health topics)
2. Custom domain support (e.g., hello@yourhealthblog.com)
3. Good spam/phishing protection
4. Encryption options
5. Reliable delivery (newsletters, reader inquiries, partnerships)

A good shortlist:

Privacy Decoded Proton## My recommendation for a health blog

Best balance: proton.me + your own domain

Example setup:

• you@yourblog.com → public contact address
• privacy@yourblog.com → privacy/legal inquiries
• newsletter@yourblog.com → mailing list identity
• Separate aliases for services and accounts

Why it fits:

• Readers may share personal health experiences, so minimizing provider access to mailbox contents is valuable.
• You can use your own domain rather than a provider address.
• You can add other privacy tools from the same ecosystem if needed. Proton

If you expect very sensitive reader messages

Consider:

tuta.com

Good if your priority is minimizing metadata exposure and maximizing encryption coverage. It encrypts more mailbox elements than many traditional providers, including subject lines within its system. Privacy Ranker Tuta

A possible approach:

• Public blog contact: contact@yourdomain.com
• Sensitive reader contact: secure@yourdomain.com on Tuta
• Tell readers not to send medical records or identifiable health information unless you have a proper process for handling it.

If your main goal is professional publishing

Choose:

fastmail.com

It is excellent for:

• editorial workflows
• assistants
• calendars
• normal email apps
• reliable sending

But it is a privacy-focused hosted email service rather than a zero-access encrypted mailbox. Privacy Decoded

Important health-blog privacy additions

Email alone does not make a health site private. I would also add:

• DMARC, DKIM, and SPF records for your domain to reduce spoofing.
• A separate newsletter provider that supports consent management and privacy compliance.
• Avoid collecting unnecessary health details through contact forms.
• Use encrypted forms if readers submit sensitive information.
• Enable hardware security keys or strong 2FA on your email account.
• Keep domain registration privacy enabled where available.

For most independent health writers, my ranking would be:

1. Proton Mail + custom domain — best overall choice
2. Tuta + custom domain — strongest privacy-first choice
3. Fastmail + custom domain — best usability choice

One caveat: ordinary email to Gmail/Outlook recipients is not magically end-to-end encrypted just because you use a private provider; the strongest protection applies when both sides support compatible encryption or when you use secure message options. Privacy Ranker

For a health-focused blog, I’d recommend Tuta Mail with your own domain rather than literally running the mail server yourself.

My pick: Tuta Mail + your domain

Tuta Mail is particularly well suited if privacy is the priority:

• End-to-end encryption by default for email, attachments, calendars, and contacts; Tuta says mailbox data is encrypted so that it isn't accessible to Tuta itself. tuta.com
• Custom-domain support, so you can use addresses such as hello@yourblog.com rather than a provider-branded address. tuta.com
• Password-protected encrypted messages to non-Tuta recipients, useful if readers, contributors, or sources need to send you sensitive material. tuta.com
• Servers are operated in Germany, with GDPR protections and ISO 27001-certified data centers. tuta.com
• Tuta supports SPF, DKIM, DMARC and MTA-STS for a custom domain, which are important for preventing spoofing and improving mail security. tuta.com
• Its clients are open source, and it supports 2FA. tuta.com

For a blog, I'd create separate addresses such as:

hello@yourdomain.com — general correspondence
editor@yourdomain.com — contributors
privacy@yourdomain.com — privacy/data inquiries
newsletter@yourdomain.com — automated blog mail

One important caveat

Email encryption has a fundamental limitation: you don't control the recipient's email system. Tuta-to-Tuta mail can be end-to-end encrypted, while messages to ordinary Gmail/Outlook/etc. accounts aren't automatically E2EE in the same way. For sensitive communications with outsiders, use Tuta's password-protected encrypted-mail mechanism rather than assuming ordinary email is confidential. tuta.com

Alternatives

Proton Mail is my second choice. Proton Mail supports custom domains on paid plans and provides E2EE between Proton users plus zero-access encryption for externally received mail. proton.me It's an excellent choice if you want a more conventional email ecosystem.

Migadu is interesting if you specifically want standard IMAP/SMTP/POP3 and lots of addresses/domains. Migadu It says traffic is encrypted and that it doesn't advertise or track users, but it doesn't offer the same provider-side end-to-end encryption model as Tuta. migadu.com

What I'd deploy

Domain registrar/DNS → Tuta Mail → your blog

Then configure:

1. A privacy-conscious domain registrar.
2. Tuta as your MX provider.
3. SPF + DKIM + DMARC (I'd use a strict DMARC policy once you've verified everything works).
4. MTA-STS/TLS where supported.
5. 2FA with a hardware security key or authenticator.
6. Unique passwords and secure recovery credentials.
7. Separate addresses/aliases for public-facing functions.
8. Keep reader health information out of ordinary email whenever possible. If your blog solicits personal health information, email encryption alone doesn't automatically make your setup HIPAA-compliant or otherwise appropriate for regulated health data.

If by "host email on my own domain" you specifically mean run the mail server yourself on a VPS, rather than using a privacy-focused hosted provider, I'd choose a different architecture—e.g. Mailcow/Postfix + Dovecot + encrypted storage + hardened DNS/TLS. That gives you more control but substantially increases the security and maintenance burden.

For a health-focused blog, I’d avoid running your own mail server unless you have a strong operations/security background. Self-hosted email is difficult to secure, maintain, and keep out of spam folders. A privacy-focused hosted provider with your own domain usually gives a better security/privacy balance.

My top recommendation:

Best overall: Proton Mail with your custom domain

Proton Mail is a strong fit if your blog may involve readers sharing sensitive health experiences.

Why it fits:

• Custom domain support (for example, hello@yourhealthblog.com) on paid plans. proton.me
• Zero-access encryption architecture: Proton stores mail encrypted so it cannot normally read your mailbox contents. proton.me
• End-to-end encryption for Proton-to-Proton messages. proton.me
• Strong account security options, including hardware security keys and 2FA.
• Swiss jurisdiction and a privacy-focused business model.

Good setup for a health blog:

• hello@domain.com — public contact
• editor@domain.com — publishing/admin
• privacy@domain.com — privacy requests
• Separate private mailbox for your personal identity

Most privacy-maximal alternative: Tuta

Tuta Mail is worth considering if your priority is minimizing metadata exposure.

Strengths:

• End-to-end encryption is built into the service. tuta.com
• Encrypts more mailbox data than traditional email systems, including subject lines and attachments. tuta.com
• Supports custom domains on paid plans. tuta.com
• Privacy-first design with no advertising model. tuta.com

Tradeoff:

• It is less compatible with traditional email clients because it does not use normal IMAP access. tuta.com

Best if you want a normal email experience: Fastmail

Fastmail is excellent for professional blogging workflows:

• Very polished email/calendar experience.
• Custom domains supported. www.fastmail.help
• Good privacy practices and no advertising model.

Tradeoff:

• It is not designed around provider-proof end-to-end encryption in the way Proton and Tuta are. www.fastmail.helpprivacy-decoded.com

Security configuration I’d use for a health blog

Regardless of provider:

1. Use a domain registrar with privacy protection
   • Hide your personal registration details where allowed.

2. Enable:
   • Hardware security key (best)
   • 2FA
   • Strong unique password stored in a password manager

3. Configure email authentication:
   • SPF
   • DKIM
   • DMARC

These reduce spoofing and improve deliverability. Proton specifically recommends configuring these with custom domains. proton.me

4. Separate public contact from sensitive communication
   • A public blog inbox will receive spam.
   • Avoid mixing reader submissions with your personal mailbox.

5. Be careful with health information
   • Regular email is not automatically a HIPAA-compliant communication channel.
   • If readers may submit identifiable medical information, consider a dedicated secure intake form or a healthcare-compliant communication platform rather than ordinary email.

My pick:

• Most health/privacy-oriented: Proton Mail + custom domain
• Maximum privacy philosophy: Tuta + custom domain
• Most like traditional business email: Fastmail + custom domain

For a solo health blogger, I would choose Proton Mail with a custom domain plus a secure contact form that discourages sharing personal medical details.

For a health-focused blog, I’d prioritize privacy, control of stored mail, and strong encryption without making email administration a full-time job.

My recommendation: self-hosted Stalwart

Stalwart Mail Server is probably the best fit if “host it myself” is literal.

Why:

• You control the server and mailbox data, rather than handing your email archive to a hosted provider.
• It supports encrypted message storage and PGP, and Privacy Guides specifically recommends Stalwart for self-hosted email. www.privacyguides.org
• With OpenPGP + Web Key Directory (WKD), you can make encrypted communication with compatible clients/users substantially easier.
• You can use your own domain, e.g. hello@yourhealthblog.com.
• You can run it on a VPS and keep the mail database, encryption keys, and backups under your control.

The important caveat: self-hosting does not automatically mean end-to-end encrypted email. TLS protects mail while it's transported between servers, but ordinary email sent to Gmail, Outlook, etc. can still ultimately be readable by the recipient's provider. For genuinely sensitive conversations, use PGP or a secure-mail workflow.

Easier alternative: Proton Mail + your domain

If by “my own domain” you mean your own address/domain rather than your own physical server, I would actually choose Proton.

Proton supports custom domains on paid plans, and messages between Proton users are end-to-end encrypted. Proton also provides zero-access encryption for stored mail. proton.me

Proton Mail custom-domain documentation

This is considerably easier to operate than a mail server and is a particularly good choice if you expect readers to email you about potentially sensitive health topics.

If you want a polished self-hosted package: mailcow

mailcow is another strong option. It packages the mail server, webmail, spam/virus protection, DKIM, TLS, administration, and 2FA into one system. docs.mailcow.email

It does require more resources and maintenance: current mailcow documentation recommends at least 6 GB RAM plus 1 GB swap, with 8 GB recommended for a small private installation. docs.mailcow.email

What I'd deploy for your blog

Best balance:

your domain → VPS → Stalwart → encrypted disk → encrypted off-site backups

I'd configure:

1. Dedicated VPS with full-disk/storage encryption where available.
2. Stalwart for SMTP/IMAP.
3. TLS everywhere.
4. SPF + DKIM + DMARC to prevent spoofing and improve deliverability.
5. PGP/WKD for readers who need genuine end-to-end encryption.
6. 2FA for administrative accounts.
7. Encrypted, offline/immutable backups of mail and encryption keys.
8. Separate contact@, privacy@, and editor@ addresses rather than exposing a personal mailbox.
9. Avoid putting sensitive health information into ordinary email unnecessarily.

One especially important point for a health blog: don't treat ordinary email as a HIPAA-style secure communication channel just because your server is encrypted. If readers might submit medical histories, diagnoses, medications, or other sensitive information, I'd create a dedicated secure submission/contact mechanism instead of encouraging them to email those details.

Bottom line:

• Maximum sovereignty: Stalwart self-hosted.
• Maximum privacy with minimal administration: Proton + your domain.
• Best full-featured traditional self-hosted suite: mailcow.

If you tell me your approximate budget (e.g. $5, $10, or $20/month) and whether you're comfortable administering a Linux server, I can recommend a specific architecture and hosting setup.

For a health-focused blog, I’d prioritize privacy, domain ownership, strong account security, and good deliverability over simply “hosting your own mail server.” Running your own server gives you control, but it also creates a large security and maintenance burden (spam reputation, backups, patching, encryption configuration, monitoring).

My recommended options:

Best overall: Proton Mail with your custom domain

Proton Mail

Why it fits a health blog:

• End-to-end encryption between Proton users and zero-access encryption for stored mail. proton.me
• Supports your own domain (for example, hello@yourhealthblog.com). proton.me
• Strong security options:
  • 2FA
  • hardware security keys (depending on account setup)
  • phishing protections
  • SPF/DKIM/DMARC support for domain reputation proton.me
• Good balance between privacy and usability.

Good addresses to create:

• hello@domain.com — public contact
• editor@domain.com — publishing inquiries
• privacy@domain.com — privacy requests
• newsletter@domain.com — mailing list separation
• yourname@domain.com — personal admin account

Potential limitation: Email sent to ordinary Gmail/Outlook users is not automatically end-to-end encrypted unless you use a secure message method or another encryption system. That is a limitation of the email ecosystem, not just Proton. proton.me

Most privacy-maximal: Tuta

Tuta Mail

Choose this if your priority is: “I want the provider to have as little ability as possible to access my mailbox.”

Strengths:

• End-to-end encryption by default.
• Encrypts more mailbox data than traditional email systems, including subject lines and contacts. tuta.com
• Supports custom domains on paid plans. tuta.com
• Strong privacy-oriented design and German data protection environment. tuta.com

Trade-offs:

• Less compatible with traditional email apps and workflows than some competitors. proton.me
• Some health-blog workflows (assistants, CRM tools, newsletter integrations) may require more planning.

Best “normal email experience”: Fastmail

Fastmail

Good if you need:

• excellent email apps
• custom domains
• reliable sending/receiving
• easy integration with other tools

Fastmail is privacy-respecting and ad-free, but it is not designed around provider-inaccessible end-to-end encryption like Proton or Tuta. privacy-decoded.com

My suggested setup for a health blog

Domain registrar

• Use a reputable registrar that supports privacy protection.

Email host

• Start with Proton Mail (best balance).

DNS security
Configure:

• SPF — prevents spoofing
• DKIM — cryptographically signs outgoing mail
• DMARC — protects your domain reputation

These are especially important if you send newsletters. proton.me

Account security

• Enable hardware security keys if possible.
• Use a dedicated password manager.
• Create separate admin and public-facing addresses.

Newsletter separation
Do not send large subscriber campaigns directly from your personal mailbox. Use a privacy-conscious newsletter platform and keep your main mailbox isolated.

My recommendation by scenario

For most independent health bloggers, I would choose Proton Mail + custom domain + SPF/DKIM/DMARC + hardware security key. It gives a strong privacy posture without turning email administration into a full-time job.

For a health-focused blog, I’d recommend Proton Mail with your own domain rather than running your own mail server.

My top pick: Proton Mail + your domain

For example:

hello@yourhealthblog.com
contact@yourhealthblog.com
privacy@yourhealthblog.com

Why I’d choose it:

• Strong encryption: Proton uses end-to-end encryption between Proton users and zero-access encryption for stored mail. You can also send password-protected encrypted messages to people using Gmail, Outlook, etc. proton.me
• Custom domains: Paid Proton plans support addresses on your own domain. proton.me
• Good fit for sensitive health conversations: If readers contact you about personal health experiences, you don't want your email provider's business model or administrators routinely having access to readable inbox contents.
• Security controls: Proton supports 2FA, PGP/OpenPGP, and additional account-security features. proton.me
• Business features: If the blog eventually has multiple contributors, Proton supports organization/user management and custom-domain addresses. proton.me
• Good deliverability setup: You can configure SPF, DKIM, and DMARC for your domain, which is important for preventing spoofing and improving delivery. proton.me

A strong alternative: Tuta

Tuta Mail is arguably the better choice if maximum metadata privacy is more important to you than compatibility.

Tuta provides end-to-end encryption, custom domains on paid plans, open-source clients, and particularly strong encryption of email data. tuta.com

The trade-off is that Proton has better interoperability and broader business/productivity features, including PGP and support for conventional desktop mail clients through Proton Mail Bridge. proton.me

What I would not do

I wouldn't self-host Postfix/Dovecot on a VPS unless you specifically want the administrative responsibility. You'd have to handle:

• spam/phishing filtering
• backups
• server security and patching
• IP reputation and blacklists
• SPF/DKIM/DMARC
• TLS
• encryption at rest
• monitoring and uptime
• mail deliverability

And self-hosting doesn't magically provide end-to-end encryption: ordinary email sent to Gmail, Outlook, etc. still isn't E2EE.

One important health-blog distinction

If you're going to receive actual patient/client health information, email privacy alone isn't enough. You should avoid encouraging readers to send diagnoses, medical records, medications, or other sensitive information through ordinary email unless you've established an appropriate compliance/privacy workflow. In particular, if the blog is associated with a healthcare provider or you're handling regulated health information, the appropriate requirements can be considerably more stringent.

For a typical independent health-information blog, though, my setup would be:

Domain registrar → privacy-conscious DNS → Proton Mail → SPF + DKIM + DMARC → 2FA/security key → separate public contact address

I'd also use an address such as contact@... for public submissions rather than exposing the account you use for administration.

If you tell me whether this is a personal blog, a business/clinic blog, or a blog where readers may submit personal medical information, I can recommend the appropriate setup and security level.

For a health-focused blog, I’d prioritize privacy and encryption without taking on the security burden of running a mail server yourself.

My recommendation: Tuta Mail + your own domain

Tuta is probably the best fit if privacy is the primary requirement.

• Custom domain: You can use addresses such as hello@yourblog.com, with paid plans supporting multiple custom domains. tuta.com
• End-to-end encryption by default: Tuta encrypts email contents, attachments, subject lines, contacts, calendars, and its search index. tuta.com
• Strong privacy architecture: Tuta says it cannot access users' encrypted mailbox contents and stores data on its own servers in Germany. tuta.com
• Encrypted communication with non-Tuta users: You can send password-protected encrypted messages to people using Gmail, Outlook, etc. tuta.com
• Good fit for health-related correspondence: It is specifically marketed for medical/health use and business privacy. tuta.com
• Post-quantum cryptography: Tuta currently uses quantum-resistant algorithms as part of its encryption architecture. tuta.com

Tuta Business

Strong alternative: Proton Mail

Proton is my second choice. It has excellent privacy, custom-domain support, zero-access encryption, and E2EE between Proton users. proton.me

Proton Mail custom domains

I'd choose Proton if you want a more conventional email ecosystem and particularly value compatibility with existing email applications through Proton Mail Bridge. proton.me

What about literally hosting it yourself?

If by "on my own domain" you mean running the mail server yourself, I'd generally not recommend that for a health blog unless you have substantial server/security expertise.

A platform such as mailcow can give you genuine control over your mail infrastructure, with TLS for SMTP/IMAP and automated Let's Encrypt certificate support. docs.mailcow.email

But self-hosting means you become responsible for patching, backups, spam reputation, malware filtering, TLS configuration, authentication, server compromise, IP reputation, and reliable delivery. Also, normal email is not automatically end-to-end encrypted just because your server uses TLS.

Recommended setup

For your use case, I'd do:

Domain registrar → Tuta Business → hello@domain.com, contact@domain.com, privacy@domain.com

Then configure:

1. MFA/passkeys on the Tuta account.
2. SPF, DKIM, and DMARC on your domain.
3. A dedicated contact@ address for reader correspondence.
4. A separate administrative address that isn't publicly advertised.
5. Password-protected E2EE messages when readers need to send genuinely sensitive information.
6. A clear notice telling readers not to email medical records or highly sensitive health information unless you've specifically provided a secure process for doing so.

One important distinction: email encryption doesn't automatically make a health blog HIPAA-compliant. If you're actually collecting protected health information on behalf of a covered entity/business associate, that's a substantially different compliance question.

Bottom line: For a privacy-first health blog, I'd pick Tuta + your existing domain rather than self-hosting. If you specifically want maximum infrastructure control and are comfortable administering Linux/mail systems, then mailcow is the self-hosted route worth considering.

For a health-focused blog, I’d prioritize privacy, domain control, spam resistance, and the ability to protect reader communications. I would generally avoid running your own mail server unless you already manage servers professionally; email hosting has difficult deliverability, abuse, and security maintenance issues. alexi.shsecuremailguide.com

My recommendations:

1. Best overall privacy choice: Proton Mail with your custom domain

Proton Mail

Best for: a health blog where readers may send sensitive questions or personal information.

Strengths

• End-to-end encryption between Proton users and encrypted options for external recipients.
• Zero-access encryption model: the provider is designed so it cannot read encrypted mailbox contents. privacy-decoded.com
• Custom domain support on paid plans. alexi.shsecuremailguide.com
• Good privacy reputation and a broader privacy ecosystem (calendar, storage, VPN, etc.). privacy-decoded.com

Tradeoffs

• Less seamless with traditional email clients unless you use Proton Mail Bridge.
• Some workflows are more locked into Proton’s apps. alexi.shsecuremailguide.com

Good setup for a health blog

• hello@yourdomain.com — general inquiries
• newsletter@yourdomain.com — mailing list
• privacy@yourdomain.com — privacy-related requests
• Use a separate form tool for collecting health-related questions rather than encouraging readers to email medical details.

2. Best usability/privacy balance: Fastmail

Fastmail

Best for: a professional blog where you want email to work like Gmail/Google Workspace without advertising-based services.

Strengths

• Excellent custom-domain support.
• Strong spam filtering and organization.
• Works with normal email clients (IMAP/SMTP).
• Good calendars, contacts, aliases, and workflow tools. alexi.shsecuremailguide.com

Tradeoff

• It is privacy-focused, but it is not a zero-knowledge encrypted mailbox in the same way Proton is. privacy-decoded.com

This is probably the easiest choice if your blog is mostly publishing content, newsletters, partnerships, and reader correspondence that does not contain sensitive health information.

3. Privacy-focused traditional email: Mailbox.org

mailbox.org

Best for: people who want classic email standards plus stronger privacy features.

Strengths

• German jurisdiction.
• Supports standard email protocols.
• Supports PGP workflows for users who want encryption control.
• Includes productivity features. securemailguide.com

Tradeoff

• Less polished than Proton or Fastmail for many users.
• Encryption requires more setup and user awareness. securemailguide.com

I would not recommend self-hosting for this use case

Running your own mail server (for example with Mailcow, Postfix, or similar) gives maximum control, but you become responsible for:

• server security updates
• backups
• spam filtering
• IP reputation
• DKIM/SPF/DMARC configuration
• avoiding blacklists
• uptime monitoring

For a health-focused site, a commercial privacy-focused provider usually gives a better security-to-maintenance ratio. alexi.shsecuremailguide.com

Additional privacy steps I’d use for a health blog

1. Enable domain email authentication
   • SPF
   • DKIM
   • DMARC (start with monitoring, then move toward enforcement)

2. Use separate services for newsletters
   • Keep your private mailbox separate from your subscriber database.
   • Avoid storing health-related reader messages in marketing platforms.

3. Add a clear disclaimer
   • Email is not a secure medical consultation channel.
   • Avoid asking readers to send diagnoses, medical records, or identifiable health details.

4. Use MFA everywhere
   • Hardware security keys are preferable for the main admin account.

5. Register your domain privately
   • Use domain privacy protection where available.

My pick:

• Health education blog with occasional sensitive reader messages: Proton Mail + custom domain.
• Professional blog/newsletter/business workflow: Fastmail + custom domain.
• Technical/privacy enthusiast who wants traditional email standards: Mailbox.org.

For most health-focused bloggers, I’d choose Proton Mail for the inbox and a separate privacy-conscious newsletter platform for subscribers.

For a health-focused blog, I’d recommend Proton Mail with your own domain as the best overall balance of privacy, encryption, usability, and professional email hosting.

My recommendation: Proton Mail + your domain

For example, you could have hello@yourblog.com, contact@yourblog.com, and privacy@yourblog.com hosted by Proton.

Why it fits a health-focused site:

• End-to-end encryption: Proton supports E2EE between Proton users, while incoming mail is stored with zero-access encryption. proton.me
• Custom domains: Paid Proton plans support your own domain. proton.me
• Strong domain security: You can configure SPF, DKIM, and DMARC, which is important for preventing impersonation of your health brand and improving deliverability. proton.me
• Good fit for sensitive correspondence: If readers might send you personal health information, Proton gives you a substantially better privacy posture than conventional hosted email.
• Desktop-client support: Proton Mail Bridge lets you use clients such as Thunderbird, Apple Mail, or Outlook while retaining Proton's encryption architecture. proton.meproton.meproton.me

Proton Mail custom-domain setup

A strong alternative: Tuta Mail

Tuta is arguably the more privacy-maximalist choice. It encrypts the entire mailbox—including subject lines, contacts, and calendars—and says its servers store the data encrypted. It also supports custom domains on paid plans. tuta.comtuta.com

Tuta additionally uses post-quantum cryptography and stores its data in Germany, making it particularly attractive if minimizing provider access to your data is the priority. tuta.com

Tuta Mail

What I wouldn't choose for your priority

Fastmail is excellent traditional email hosting and has strong encryption in transit/at rest, custom-domain support, passkeys, and 2FA. But it doesn't provide native end-to-end encryption in its own apps, instead recommending PGP/S/MIME for E2EE. www.fastmail.com

So I'd rank them:

One important health-specific caveat: if your readers are going to send you identifiable medical/health information, don't assume that "encrypted email" automatically makes your operation HIPAA-compliant or otherwise legally compliant. Your email provider, contracts, data handling, retention, and the way you collect/process information all matter.

For a typical health blog where the goal is "don't expose readers' correspondence unnecessarily, and give them a private way to contact me," I'd choose Proton Mail + a domain registered separately from the email provider, with SPF/DKIM/DMARC and 2FA/passkeys enabled.

For a health-focused blog, I would prioritize privacy, account security, domain reputation, and avoiding accidental exposure of sensitive communications. You probably do not need to run your own mail server (which is difficult to secure and maintain); a privacy-focused hosted email provider is usually the better solution.

Recommended choice: Proton Mail with your custom domain

Best overall fit for a health blog. proton.me

Why:

• End-to-end encryption for Proton-to-Proton messages and zero-access encryption for stored mail. proton.me
• Supports custom domains (for example hello@yourhealthblog.com). proton.me
• Strong privacy reputation and Swiss jurisdiction.
• Supports PGP/OpenPGP, useful if you communicate with clinicians, researchers, or privacy-conscious readers. proton.me
• Good ecosystem if you also want encrypted storage, passwords, calendar, or VPN.

A practical setup:

• hello@domain.com → public contact
• newsletter@domain.com → mailing list
• press@domain.com → media inquiries
• yourname@domain.com → private admin account

Use aliases where possible so your personal inbox is not exposed.

Strong alternative: Tuta Mail

Choose this if your priority is maximum privacy architecture over convenience.

Advantages:

• End-to-end encryption by default.
• Encrypts more mailbox data than traditional email systems, including subject lines and contacts. tuta.comwww.fastmail.com
• Custom domain support on paid plans. tuta.comwww.fastmail.com
• German jurisdiction and GDPR-focused approach. tuta.com

Tradeoffs:

• Less compatible with traditional email clients/workflows than Proton.
• Some integrations may be more limited. proton.me

Best “normal email” experience: Fastmail

Good if you need:

• Excellent search
• Traditional email apps
• Calendars and contacts
• Easy domain management

Fastmail supports custom domains and strong security practices, but it is not end-to-end encrypted in the same way as Proton or Tuta. www.fastmail.com

My recommended stack for a health blog

Domain registrar

• Use a privacy-conscious registrar that supports WHOIS privacy.

Email

• Proton Mail paid plan (best balance)
• Tuta Mail paid plan (maximum privacy)

DNS security
Configure:

• SPF
• DKIM
• DMARC (start with monitoring, then move toward enforcement)

These reduce spoofing and improve deliverability. Proton specifically recommends SPF, DKIM, and DMARC when using custom domains. proton.me

Account protection

• Hardware security key (YubiKey-style) for the admin account
• Password manager-generated password
• Separate admin email not published anywhere

Blog contact forms
Avoid sending form submissions directly into a normal inbox if readers might share:

• medical histories
• symptoms
• medication details
• identifying health information

Instead:

• Add a notice that the blog is not a secure medical communication channel.
• Minimize collected data.
• Consider storing submissions separately with access controls.

My ranking for your use case

1. Proton Mail + custom domain — best overall for a health-focused creator
2. Tuta Mail + custom domain — strongest privacy-first option
3. Fastmail + custom domain — best usability, weaker encryption model

I would avoid self-hosting mail unless you already manage servers professionally; the security burden (spam filtering, patching, TLS configuration, backups, reputation management) is substantial.

For a health-focused blog, I’d recommend self-hosted Stalwart Mail Server if “my own server + strong privacy” is the priority. If you mean “use my own domain but avoid operating a mail server,” I’d choose Proton Mail instead.

Best self-hosted option: Stalwart

Stalwart is particularly interesting because it goes beyond ordinary TLS:

• Encryption at rest: Stalwart can encrypt stored messages using the recipient's OpenPGP public key or S/MIME certificate, meaning an administrator with access to the disk cannot simply read those messages. It supports AES-128 and AES-256 modes. www.stalwart.emailwww.stalwart.emailwww.privacyguides.org
• Strong transport security: It supports TLS plus DANE, MTA-STS and TLS reporting, and can automatically provision certificates through ACME/Let's Encrypt. www.stalwart.email
• Modern security architecture: It's written in Rust, has rate limiting/IP blocking and has undergone security auditing. www.stalwart.email
• Normal email compatibility: It supports SMTP, IMAP and JMAP, so you're not locked into a proprietary client. www.stalwart.email
• Domain authentication: You can configure SPF, DKIM, DMARC and MTA-STS, which is important for a blog's email reputation and protection against spoofing. stalwart.emailstalw.art

A good architecture would be:

Your domain → VPS → Stalwart → encrypted mailbox storage → Thunderbird/another mail client

For particularly sensitive correspondence, I'd use OpenPGP end-to-end encryption between you and trusted recipients. TLS alone does not provide end-to-end encryption—it protects email while it is being transported, whereas encryption with the recipient's public key can protect the message itself.

Privacy Guides also specifically recommends Stalwart for self-hosted email and highlights its encrypted-message storage and OpenPGP/WKD capabilities. www.privacyguides.org

Easier alternative: Proton Mail + your domain

If you don't actually need to control the server, Proton Mail is probably the better practical choice.

You can use you@yourdomain.com on a paid Proton plan, while Proton provides zero-access encryption for externally received mail and end-to-end encryption between Proton users. proton.me

The trade-off is that Proton hosts the infrastructure. That's substantially easier and probably more reliable than self-hosting, but it doesn't give you the same level of server-side control.

What I'd choose for your blog

One important health-related consideration: don't treat ordinary email as inherently HIPAA-secure just because your server uses encryption. If your blog will receive identifiable patient/client health information, that's a substantially different compliance problem; you'd want to design the intake process so readers aren't encouraged to send sensitive medical information by ordinary email.

If you want to actually self-host, I can also give you a concrete Stalwart setup for your domain—including VPS specs, DNS records, TLS, DKIM/DMARC, backups, encryption-at-rest, and a privacy-oriented configuration. stalwart.emailstalw.art

For a health-focused blog, I’d recommend Proton Mail with your own domain rather than running your own mail server.

My pick: Proton Mail + your domain

It gives you a strong balance of privacy, encryption, reliability, and low maintenance:

• Custom domain: You can use addresses such as hello@yourblog.com; paid Proton plans support custom domains. proton.meproton.me
• Zero-access encryption: Proton says stored mail is encrypted so Proton itself cannot access the contents. proton.meproton.me
• End-to-end encryption: Messages between Proton users are automatically E2EE. For people using Gmail/Outlook/etc., you can send password-protected encrypted messages rather than relying on ordinary email encryption. proton.me
• Good domain authentication: Set up SPF, DKIM, and DMARC on your domain to reduce spoofing and phishing. Proton documents all three as part of custom-domain setup. proton.me
• Less operational risk: You don't have to maintain an SMTP server, spam reputation, TLS configuration, backups, patching, etc.—all particularly important for a public-facing health site.

For a health blog, I'd also avoid putting actual patient/client health information into ordinary email. E2EE between Proton accounts is strong, but email to someone on Gmail or another provider isn't automatically end-to-end encrypted. For sensitive correspondence, use Proton's password-protected encrypted-email mechanism or, preferably, a dedicated secure intake/portal system.

Strong alternative: Tuta

Tuta Mail is arguably even more privacy-oriented. It encrypts the mailbox, contacts, calendars, and subject lines, supports custom domains, and uses post-quantum-resistant cryptography. Its servers are based in Germany. tuta.com

I'd choose Tuta if maximum privacy/metadata protection is more important than integrations and conventional email compatibility.

One important distinction

If by “host email on my own domain” you mean actually operate the mail server yourself, I wouldn't recommend that unless you already administer mail infrastructure. Self-hosting gives you control, but it also makes you responsible for security, backups, spam filtering, IP reputation, uptime, encryption, and incident response. For a small health-focused publication, that tradeoff usually isn't worthwhile.

Recommended setup:
yourblog.com → privacy-focused registrar/DNS → Proton Mail → hello@yourblog.com, contact@yourblog.com, etc., with SPF + DKIM + DMARC enabled and 2FA/passkeys on the administrator account.

If the blog will collect health questions, patient stories, or other potentially sensitive submissions, I'd go one step further and separate the public contact email from a genuinely secure submission system.