I quit Gmail. Not dramatically — no manifesto, no LinkedIn post about "digital sovereignty." I just got tired of being the product in a relationship I never signed up for, tired of knowing that somewhere in a Mountain View data center there's a shockingly accurate profile of me built from thirteen years of subject lines, and tired of the fact that my entire digital identity — every password reset, every "verify it's you" — routed through a single company that owes me nothing and could nuke my account for a TOS violation I'll never fully understand.
So I rebuilt it. Properly, as an engineer, not as someone who read one privacy blog and panic-deleted their contacts. What follows is the actual architecture: the domain, the mail routing, the encrypted mailbox, the hardware keys, and the self-hosted photo/file layer that finally let me tell Google Photos to get lost too. I'm also going to correct a popular myth along the way, because half the "de-googling" guides floating around right now are recommending a setup that's been dead since 2023 and don't seem to have noticed.
Let's build it properly.
First, Let Me Kill a Myth: "Free Custom-Domain Corporate Email" Mostly Doesn't Exist Anymore
If you've read any de-googling guide from the last few years, you've seen some version of this recipe: buy a domain, bolt it onto a free-tier business email suite from whatever regional Google Workspace competitor was fashionable that year, get real custom-domain mailboxes at zero cost, done. It used to work, for a bunch of different providers, and half the tutorials still floating around online are reheating a version of that trick from an era that's already over.
The honest 2026 landscape: Google Workspace killed its free custom-domain tier years ago and never brought it back. Microsoft 365 never had one. Most "free business email" providers that still advertise a genuinely free custom-domain tier cap you hard — a handful of users, a few gigabytes, webmail-only with no real IMAP/POP access, meaning no Outlook, no Apple Mail, no third-party client. Fine for a solo side project, not something you want to build your actual identity on. I'm mentioning this loudly because nothing kills your credibility as "the security guy" faster than shipping someone a setup guide built around a free tier that got quietly gutted three years ago.
So here's the actual, currently-true architecture, and it's honestly better than any single free-tier suite anyway, because it doesn't depend on one company's continued generosity.
The Architecture
your-domain.com (registered, DNS on Cloudflare)
│
▼
Cloudflare Email Routing (free, forever, forwards mail — no mailbox of its own)
│
▼
Proton Mail (the real, encrypted mailbox — zero-access, custom domain optional)
│
▼
YubiKey / FIDO2 hardware key (guards the front door to everything above)
Three moving parts, one hardware key protecting all of them. Let's go through each layer, because the interesting engineering is in why each piece sits where it does, not just in the click-here-click-there setup steps you can already find in eleven other tutorials.
Layer 1: The Domain, and Why the Registrar Matters More Than You Think
Buy a domain. Doesn't matter much which TLD, but do yourself a favor and register it directly through Cloudflare Registrar, which sells at wholesale/cost pricing with no markup, no upsell renewal traps, and it lands your DNS on Cloudflare's infrastructure by default — which you need anyway for Email Routing in the next step.
Two settings people skip that you shouldn't:
- WHOIS privacy — on by default with most modern registrars now, but verify it. Your name and home address do not need to be a
whois lookup away from anyone who's curious.
- Registry lock / registrar transfer lock — this stops someone from social-engineering their way into transferring your domain out from under you. Your entire identity system is built on top of a domain name. Whoever controls the domain controls the DNS. Whoever controls the DNS controls where your mail goes. This is your actual root of trust, and it deserves more paranoia than the mailbox does.
Layer 2: Cloudflare Email Routing — The Free Plumbing
This is the part that's genuinely free, forever, no asterisk. It is not a mailbox — I want to be precise here because a lot of tutorials get sloppy about this and it causes confusion. Email Routing receives mail addressed to anything at your domain and forwards it to a real, existing inbox you already control. There's no login, no storage, no IMAP server sitting on Cloudflare's side.
Setup, for real this time:
1. Add your domain to Cloudflare (nameservers must point to Cloudflare)
2. Dashboard → Email → Email Routing → Enable
3. Cloudflare auto-adds the MX and SPF TXT records for you
4. Add a "Destination address" — this is where mail actually lands
(verify it: Cloudflare emails you a confirmation link)
5. Create routing rules:
*Emails are not allowed* → forward to → your Proton Mail address
*@your-domain.com → catch-all → same destination (optional)
The free tier gives you 200 routing rules per domain and 200 destination addresses per account, with a 25 MiB inbound message cap — genuinely generous limits that most humans will never bump into. The one thing to understand clearly: this is receive-only. Hit reply and your message goes out from whatever mailbox you're actually forwarding into, not from a magic Cloudflare SMTP server. That's fine, because the next layer is where sending actually happens.
Layer 3: Proton Mail — Your Actual Mailbox, Not Just a "Backup Channel"
Here's where I'm going to gently push back on the brief I was given, because architecturally it doesn't quite hold up: Proton Mail isn't really a "backup secure channel" sitting behind something else — it's the actual encrypted mailbox doing the real work. Cloudflare Email Routing has nowhere to forward mail to unless something on the other end is actually storing and encrypting it. Proton is that something.
Two ways to wire it up, depending on how much you want to spend:
- $0 path: free Proton Mail account as the destination for Cloudflare's forwarding rules. You receive at
*Emails are not allowed*, it lands zero-access-encrypted in Proton, and you reply from your @proton.me address (or configure Gmail/whatever client-side "send as" trickery you like — it's the same limitation Cloudflare has, just one layer removed).
- ~$4–5/month path: Proton Mail Plus (or Unlimited) supports native custom domains — full two-way send-and-receive as
*Emails are not allowed*, no forwarding hop needed at all, Proton handles your domain's MX directly. This is the cleaner setup if you want your custom address to be indistinguishable from a "real" hosted mailbox, and it skips Cloudflare Email Routing for mail entirely (you'd still likely keep Cloudflare as your DNS host for everything else).
Zero-access encryption means Proton's own infrastructure can't read your mail content even if compelled to — this is architecturally different from Gmail, where Google absolutely can and does read metadata and content for ad targeting, ML training, and "safety" scanning, whatever their current PR phrasing for that is this quarter.
Layer 4: The YubiKey, and What FIDO2/WebAuthn Actually Is Under the Hood
This is the part every de-googling guide name-drops and almost none actually explain, so let's fix that.
A YubiKey isn't "a password, but physical." It's a hardware implementation of public-key cryptography for authentication. When you register the key with a service, the key generates a unique public/private keypair for that specific domain — the private key never leaves the hardware, ever, under any circumstances, not even during authentication. The service stores the public key. To log in, the service sends a challenge, your key signs it with the private key, and the service verifies the signature. Nothing secret ever crosses the network. There is no password to phish, because there's no password in the exchange at all — just a domain-bound cryptographic signature that a phishing site literally cannot forge, because it can't reproduce your domain's cryptographic challenge context.
That domain-binding is the entire point, and it's why WebAuthn/FIDO2 is considered close to phishing-proof in a way SMS codes and even TOTP apps aren't — a fake login page at proton-login-secure.com can absolutely trick you into typing a TOTP code, and that stolen code works. It cannot trick your YubiKey, because the key checks the actual origin before it signs anything, and it will simply refuse to respond to a domain it wasn't registered against.
Practical setup:
- Buy two. One you carry, one that lives somewhere safe (a drawer, a safe deposit box, not "in a drawer next to the first one"). Register both as separate security keys everywhere. Losing your only key locks you out of your own life; losing one of two is a Tuesday.
- Register it on Proton (Account Settings → Security → Two-factor authentication → Security keys), on Cloudflare (this protects your DNS — arguably your most important account of all, per the root-of-trust point above), on GitHub, and on your password manager.
- One honest nuance worth knowing, because it'll make you sound sharp in a security discussion rather than someone who just read the marketing page: Proton's "FIDO2" support is, more precisely, U2F running under the FIDO2 umbrella — you still authenticate with username and password plus the key, not a full passwordless discoverable-credential flow the way Google or Microsoft now support natively. It's still genuinely phishing-resistant and worth using; it's just not the fully passwordless flavor some competitors ship. Small distinction, but the kind of thing that separates "I read a blog post" from "I actually understand what I deployed."
The Password Manager You Still Need
A hardware key protects logins that support it. Everything else — every random SaaS tool, every forum, every one-off account — still needs a strong, unique password, and you still need somewhere to keep them. Bitwarden (or its self-hostable fork, Vaultwarden, which runs happily on a Raspberry Pi) supports FIDO2/WebAuthn as an unlock method itself, so your entire password vault ends up gated behind the same hardware key guarding your mail. One key, one consistent security model, instead of a different app-based 2FA scheme for every service you own.
De-Googling the Rest: Files and Photos
Email was never the whole problem. Google Photos and Google Drive are the other two legs of the stool, and 2026 finally has a clean, boring, mature answer for both — you just need two different tools, because they solve two different problems and pretending one tool does both is how people end up disappointed.
- Immich replaces Google Photos specifically. It's the closest like-for-like clone that exists: native iOS and Android apps with automatic background backup, CLIP-based natural-language search ("photos of a dog on a beach" actually works), on-device-adjacent face recognition, timeline and map views. AGPL-3.0, open source, sitting north of 100,000 GitHub stars as of mid-2026. Budget real resources for it — figure roughly 1.5–2GB of idle RAM and more under load for the ML workers doing face/search indexing; this is not a Raspberry Pi project unless you're patient.
- Nextcloud replaces Google Drive, Calendar, and Contacts — a general-purpose self-hosted platform rather than a photo-specific app. Its own Photos app exists but is, by every current comparison, the weakest part of the suite; if photos are your main goal, don't lead with Nextcloud for that job.
The honest, slightly annoying truth: run both, side by side, on the same box if it has the RAM. They don't conflict, they solve different problems, and "one self-hosted app to rule them all" is a myth in this ecosystem the same way "one language to rule them all" is in ours. Nextcloud handles your documents and calendar; Immich handles your camera roll. You now maintain two databases and two upgrade paths instead of one, and that is the actual, non-negotiable cost of self-hosting — nobody hands you Google's engineering team for free, you're trading their maintenance burden for your own.
The Part Nobody Mentions: Don't Self-Host the Mail Server Itself
I want to head off the inevitable next question, because I can feel some of you already reaching for postfix and a fresh VPS: do not run your own SMTP server for this. I've written about self-hosting plenty of things on this blog, and mail is the one category where I will talk you out of it every single time. Port 25 is blocked outbound by default on most major cloud providers specifically because of spam abuse. A brand-new IP has zero sending reputation and lands in spam folders by default. Getting off the major blocklists once you're on them is a slow, humiliating, manual process involving web forms and goodwill. Proton and Cloudflare have already spent years building and defending the sending reputation you're borrowing — let them keep doing that job. Self-host your files, your photos, your git repos, your home automation. Don't self-host your mail's deliverability reputation; you will lose that fight against Gmail's spam filter and you won't even get a good war story out of it.
What you should configure yourself, regardless of which mail path you pick: SPF, DKIM, and DMARC records on your domain. These are the DNS records that tell the rest of the internet "only these servers are allowed to send mail as me," and without them your domain is a much easier target for someone to spoof *Emails are not allowed* in a phishing email sent to your own contacts. Both Cloudflare Email Routing and Proton's custom domain setup walk you through adding these automatically — just don't skip the step because the wizard finished without complaining.
What This Actually Costs
- Domain: roughly $10–15/year, depending on TLD
- Cloudflare Email Routing: $0, forever
- Proton Mail: $0 (free tier, forwarding path) or ~$50–60/year (custom domain, native send-and-receive)
- Vaultwarden self-hosted, or Bitwarden free tier: $0
- Two YubiKeys: roughly $50–60 total, one-time, and they'll outlive several phones
Total: somewhere between the price of a domain name alone and the price of a decent dinner out, once a year, for a mail and identity system where no single ad-funded company holds the keys to your entire digital life. Not bad for an afternoon of DNS records and one very satisfying moment of finally deleting the Gmail app off your phone.
