Migadu email review

2026-03-14 on muffin.ink

I've been a customer of Migadu email for over two years. I do not recommend Migadu and intend to move to a competing service in the near future.

My needs

I use Migadu as an individual. My personal domain (the one you're reading this on) and TurboWarp (an open source project I started) both use it. Some other side projects have used it at various points.

I am not a high traffic email user. 90% of what is being received is emails from GitHub about people leaving comments, and 90% of what I send is replying to questions sent over email.

On a few occasions I've set up mailboxes for other people to log in to, but at this time everything mostly just flows into one big inbox.

Any typical email forwarding service would easily cover 90% of my use, but I like being able to send emails from my domains and having access to (presumably) high reputation mail servers so it's likely that my messages will be received on the other end.

I need CalDAV and CardDAV to sync emails and contacts across my various devices. I'm not sending email invites to people; I just need a way to add an event and to ensure I get a notification later on.

Migadu's $19/year "Micro" plan should meet my needs.

Credit where it's due

Migadu has some nice features:

Some things that are just fine:

Onto the bad things, from least bad to most bad.

Uptime is just okay

During the two years I've used Migadu, I have encountered several outages lasting more than an hour. Their own status page shows that over the last two years, their MX services (the things that receive emails) have only two nines of uptime.

Migadu uptime from https://status.migadu.com/ using the "SLA Uptime Calculator" tool from 2024-01-01 to 2026-03-14.

Email servers handle downtime gracefully by trying to send again later so at least you don't lose any emails during this, but even in the best case that could be a few hours of delay. Hope that email isn't urgent.

You're probably aware of the modern trend where status pages are only updated manually and as such tend to miss a lot of downtimes. Migadu's status page is no different. There are outages missing from here so real uptime is even lower.

CalDAV and CardDAV support is awful

Migadu does support calendars and contacts. Support is described on their pros/cons list as:

Basic Calendar

We make the basic CalDAV and CarDAV [sic] services available, but they are not our focus. We continue developing them but please do not expect we will ever compete with dedicated calendar services.

Support being basic is fine -- I'm not doing anything crazy. You just have to find the documentation for how to set it up manually.

...

Migadu only documents how to set up CalDAV in one page -- at the bottom of the Thunderbird guide. There are no other places on the Migadu website that mention the critical URL cdav.migadu.com. If you were hoping to get documentation about CardDAV specifically, you are even more out of luck because that one misspelled mention of "CarDAV" on the pros/cons list is the only mention of CardDAV on the entire website. The best source of documentation about this is random Reddit comments.

I've also never been able to make CalDAV or CardDAV work with the default macOS calendar app or macOS contacts app. I'm sure it's somehow Apple's fault, but every other service I've used just works, so Migadu can make it work too.

I'm not asking for calendar or contacts to become a focus. I'm just asking for it to not suck.

Spam detection is beyond awful

Here's a legitimate email from a little website called "accounts.google.com" informing me that someone has logged into my account. I know it's real because it passed DKIM and SPF, and also I had just logged in to my Google account on a new device.

Email from no-reply@accounts.google.com. Subject: Security alert. Body: A new sign-on on Windows.

This is clearly not spam. Let's see what Migadu's spam filter thinks about it:

From: Google <no-reply@accounts.google.com>
X-Migadu-Flow: FLOW_IN
X-Migadu-Country: US
X-Migadu-Spam-Score: 9.62
X-Migadu-Scanner: mx13.migadu.com
X-Migadu-Spam: Yes
X-Spam-Score: 9.62
X-Migadu-Queue-Id: 9296C8961D
X-Spam: Yes
X-Migadu-Mailbox-Spam: Yes

Indeed: the email was filed directly into the spam folder. This isn't an isolated thing; it has been happening for months. I keep moving them from spam to inbox but new alerts keep going into spam.

Meanwhile, actual spam such as the below routinely lands right in the inbox. I always move these into spam to help train their detection. It doesn't do anything.

Cryptocurrency trash:

Spam email. Subject: Meteoroa Airdrop Allocation Information. Body: Describing various cryptocurrency scam garbage.

People asking to make "guest posts" to advertise gambling on TurboWarp:

Spam email. Subject: https://turbowarp.org/. Body: Automated email with poor grammar describing that they want to make a guest post on a website that has no concept of a post. They seek to pay to promote CBD and gambling (likely illegal forms of both).

These are both pretty standard automated spam that any respectable filter should catch or learn to catch after a few reports. Even Thunderbird's awful spam detection algorithm detects these as spam (Thunderbird isn't an email provider [yet] so its filter being bad isn't an issue for me).

I'm not asking for spam protection to be perfect. I know it will never be. I just feel that a spam detector that marks real security emails from the most popular website on the planet as spam is a defective piece of software.

Vulnerable to trivial denial-of-service attacks

Migadu's price tiers have prominent rate limits on emails received and sent per day. These aren't gentle limits. Going more than ~10% over results in emails not being sent or received until the next day. All email providers have these limits, so that alone isn't the problem.

Migadu pricing table from https://migadu.com/pricing/. Important details discussed in the post.

The problem is that Migadu's limits are incredibly low and lack basic protections. For example, Fastmail's $60/year plan has limits of 8000 received emails per day (more than double Migadu's $290/year plan) and 8000 outgoing emails per day (4x as much as Migadu's $990/year plan). Fastmail also describes some of their defenses against attackers including that a single sender can't use up more than half of your account's rate limits.

Migadu has no such protections. As described in the previous section, their spam detection in general is defective. Additionally, they allow a single sender to use up all of your rate limits. There is absolutely no protection against even the most unsophisticated attackers.

This is not a hypothetical. This happened to me where someone abused the password reset form on one of the many websites I have an account on to send 200 emails with the same sender and subject within 15 minutes. Any half-decent protections would've been able to detect this and block just those emails, but Migadu's defective systems instead decided to block my ability to receive email for the rest of the day.

I complained to Migadu support about this happening, and it was largely brushed off as the other service needing to add rate limits. Migadu did reset my limits, but by then it was already the next day. I agree that website needs to have rate limits on the password reset form. At the same time, I expect a paid service to not crumble against the most trivial attack imaginable.

Upgrading from the $19/year plan to the $90/year plan would not have stopped this attack. It just would've taken a little bit longer.

Conclusion

After two years of usage, I've concluded Migadu is not for me. Maybe it works for you, but I'll be moving somewhere else before it's time to renew.

I haven't yet decided where I'm moving, but here's my current thoughts:

Update March 29, 2026: I switched to Fastmail a couple weeks ago and have been enjoying it. Their first-party apps are best-in-class such that I've switched from Thunderbird & FairEmail to just using Fastmail's official apps. If I have anything significant to say about Fastmail, I'll write a future blog post about it.