Run your own mailserver. If you don't trust Google with your data, there's nobody else I would trust. There are plenty of open-source webmail apps if that matters to you.
If anyone has any suggestions to get around this sort of limitation, I'm all ears and will be back on Zimbra before the weekend is out ;-)
They've got a free account for up to 200 mails a day.
Note; 'clean IPs from unassigned netblocks' are not necessarily good. see bogon filtering[1] - still, running your own mailserver is not an impossibly difficult task.
Looking at their pricing page it looks like you'd be out about $150-160 bucks per year. Up to you to decide if it's worth it, but hardly expensive in the normal sense of the word.
1. Set up reverse DNS for your IP address
2. Publish an SPF record
3. Check the Spamhaus lists http://www.spamhaus.org/query/bl?ip=1.2.3.4 and request removal if your IP address is on them.
As an addendum to grandparent: extremely comprehensive guide to postfix + dovecot here: http://workaround.org/ispmail
Setting up your own mailserver is easy. But getting a gmail-like experience is pretty hard. For example, I tried Roundcube a while back with my full Gmail mail dump. It tried to keep up, but there was just no way it was going to handle 2gb of mail going back years.
I'd love to see something that either ran off of a standard imap server or that was a mail-delivery agent (MDA) that had a gmail-like web interface, complete with full text search.
I haven't found anything like that yet.
Like mbreese, I have wondered for some years if an open-source version of Gmail existed, and also what would be necessary to reproduce the Gmail experience (on the backend side for example, to get to the same speed in search). But I always hear Zimbra which doesn't seem to be the right answer to me.
My experience too, after using it for about a year. It's OK, but it's nowhere near as good as gmail.
My biggest complaint with it is that doesn't have a threaded view for mailing lists, but I haven't found a webmail yet with proper threaded view either. Other than that, I think it's a great substitute for a native client when I'm not at home and don't feel like using my phone, or don't have a good data connection.
first you have to set up redundant hosts. preferably on different backbones in different colos, unless a majority of your gear is in one place. next you set up the software as secure as you can so there is a minimum window for 0-days and patching can be done in scheduled maintenance windows. then you set up your monitoring to notify you when something goes south, on both hosts. things like queue size checkers and threshold-based statistic alerts are handy.
next you set up your spam filtering. THIS IS HARD. i don't care what any old salty dog mail admin tells you, it is an arduous process to properly manage the filtering and blocking and unblocking etc of mail. for a small site, getting aol or yahoo to unblock your ip range may be a great feat. for a large site, 90% of your traffic will be spam and getting every legitimate mail is nearly impossible without subjecting your users to tons of crap.
the cost in money and time just to host some free webmail yourself is astronomical in comparison to putting up with an ad and a possible privacy violation from a free provider like yahoo or gmail. if you want your mail handled properly, pay a big e-mail provider to host it for you, or spend a lot moree time and money to do the same thing yourself.
My mail server stack looks like:
Linode + Postfix + Dovecot (w/mySQL & imap) + RoundCube + SpamAssassin + managesieve.
With this setup, I get more powerful mail filters than Gmail, a better webmail client than most ISPs, and spam controls that I can access directly from my webmail client.
It's not the easiest setup to pull off, though. I'll need to roll out a second one of these before long, and I'll try to write it up next time.
EDIT: Or for $5/month/domain (the same deal I give my clients), I'll give anyone unlimited domain email hosting, unlimited accounts, (practically) unlimited storage.
Of course I was also given a mobileme account (which uses a pretty slick desktop-like web UI for mail) but I was shocked that they didn't do like a Google-Apps style rebrand of MobileMe email for their own @apple.com accounts. Pretty sad if you ask me.
What are some of the plugins that you find useful?
I also have managesieve installed, and there's a plugin for it too, so with imap, inbound email gets automatically sorted into folders for me, and I can control that from RoundCube. The filtering is actually way more powerful than anything Gmail can do (last time I checked).
Those are the two "must-haves" IMO.
Way nicer than SquirrelMail.
there's also this - http://lmgtfy.com/?q=open-source+webmail
That's assuming you can get access to PuTTY and/or ssh from anywhere. :-P
Do you have time to manage and keep your server secure? Can you patch a new 0day in an hour, possibly not.
On the other hand when men-in-black asks to Google yes they might give it away, which is another story.
However, if, like the OP, you do not trust a major corporation with a near-immaculate record on data integrity and an industry-leading stance on LEA disclosure, why trust any corporation?
Hosting your own server is inherently risky, but it is a different sort of risk with different mitigations. As you allude to in your post, the question is whether you fear malicious individuals, the workings of the state or corporate incompetence.