If an email provider uses an .onion address, does the email exit their servers into the internet through a tor exit node? Could a powerful adversary track it?


It depends, there are a few scenarios.

  1. Internal mail, from: alice@foo.onion to: bob@foo.onion or from: alice@foo.com to: bob@foo.com

    • The email never leaves the foo.com server(s), there's no way to intercept it without compromising the mail server(s).
  2. Onion to onion, from: alice@foo.onion to: bob@bar.onion

    • This is the same as internal except now either of the two servers would need to be compromised to gain visibility. It would need to be supported by both mail providers to work, which isn't common, I don't know of any that do.
  3. External to onion, from: alice@foo.com to: bob@bar.onion

    • This is mostly the same as onion to onion, since the outbound mail from foo.com connects over tor to bar.onion.
  4. Onion to external, from: alice@foo.onion to: bob@bar.com

    • Yes, this would traverse the internet in some way and would have to leave the Tor network.


  • Onion to onion mail isn't widely supported, until it is this is mostly irrelevant.
  • Email is protected in-transit anyway, on any well configured mail service. The connection from foo.com to bar.com would be encrypted using TLS, taking it out of the reach of a passive man-in-the-middle adversary anyway.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.