Recommended Free Tools
Nearly three-quarters of 70 EU institutions examined by Dutch broadcaster NOS routed email through servers operated by US companies. That finding is about email routing—not 70% of the messages sent, where each message was stored, or proof that US authorities accessed anyone’s mailbox. The apparent contradiction is that Europe’s push for technological sovereignty is broad and long-term, while institutional email services are operational systems that cannot be changed simply by declaring a policy goal.
What does the “70%” figure actually measure?
NOS checked DNS records associated with sending and receiving email for 70 EU institutions. It found that nearly three-quarters routed email through servers operated by US companies. The statistic describes the institutions in NOS’s sample and the routes indicated by those records; it is not a count of messages or a measure of how much EU email is stored in the United States. NOS’s investigation also does not establish that a government accessed messages because of these configurations.
As an Amazon Associate I earn from qualifying purchases.
Email can pass through several systems on its way to a recipient. A DNS record can point to a service that receives or filters incoming mail before forwarding it to another server. That makes a routing record useful evidence about the providers involved, but not a complete map of the message’s storage, access controls, or handling at every stage.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Why would EU institutions use American providers?
The finding points to dependence on services already embedded in institutional operations, not necessarily a deliberate rejection of European alternatives. Email must be continuously available and often connects to identity systems, calendars, security filtering, support and other workplace tools. Replacing it means managing migration, compatibility, security and service-continuity risks—not just selecting a provider based on its headquarters.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Provider nationality is only one factor in judging sovereignty. Institutions also need to consider which laws may apply to a supplier, where data is stored, what contracts say about access, how resilient the service is, and whether a credible alternative can meet operational and security requirements. NOS’s DNS analysis does not answer those questions institution by institution, and the sources available here do not provide a comparable technical or cost evaluation of the services involved.
What NOS reported about the Commission—and what it did not establish
NOS reported that the European Commission’s email routing involved US-company servers. After the broadcaster made inquiries, a Microsoft receiving-server record configured for the Commission was removed. NOS also said two other configured US servers were generally used for spam and threat filtering before forwarding messages to the actual mail servers. This is a time-sensitive snapshot: the changed record illustrates why DNS findings should not be treated as a permanent inventory.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
NOS said the Commission did not answer its question about where its email was physically stored. The investigation therefore does not establish the Commission’s storage location, much less a complete storage map for all 70 institutions. A routing provider and the location of stored data are related but distinct questions.
Were there EU institutions without American email servers?
Yes. NOS reported that the European Parliament, Europol and the Court of Justice of the European Union did not use American email servers. It identified the European Defence Agency, several financial-market regulators and the EU anti-money-laundering and counter-terrorism-financing authority among Microsoft users; it said the European Central Bank used another American email service. These examples show that institutional choices differ, but they do not establish that one provider or ownership model is inherently more secure, private or resilient.
Rank #3
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
Does Brussels’ sovereignty plan include an email migration?
On 3 June 2026, the European Commission announced a broader technology-sovereignty package covering proposals for Chips Act 2.0 and a Cloud and AI Development Act, an EU Open Source Strategy, and a Strategic Roadmap for Digitalisation and AI in Energy. The Commission described the package as a way to strengthen European capacity and widen choice in core technologies for businesses, citizens and public administrations. The announcement does not set out a specific measure to move EU-institution email away from US providers.
That distinction matters: a broad effort to reduce strategic dependence is not the same as an immediate procurement decision for every public body. In announcing the package, Commission President Ursula von der Leyen said Europe must not depend on others for technologies that keep services secure and essential systems running, and called for Europe to turn its strengths into “technological sovereignty.” The statement describes the policy ambition; it does not specify an email timetable or mandate.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Could a US provider or government switch off EU email?
Politicians quoted by NOS raised concerns about control and continuity. European Parliament member Bart Groothuis argued that email must always work and that sensitive information passes through it, so control should be in European hands. MEP Kim van Sparrentak warned that the US government “can pull the plug at any moment.” That is a political warning about dependence, not evidence that a shutdown is imminent or likely.
NOS reported that experts considered a cutoff scenario highly unlikely for now. The more grounded policy question is whether institutions can withstand a serious service interruption and switch providers if necessary. Resilience depends on practical arrangements—such as continuity planning and the ability to migrate—not simply on the provider’s nationality. Microsoft, for its part, told NOS it supports greater European digital sovereignty on the basis of openness, cooperation, fair competition and choice; that is the company’s stated position.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
How to assess email sovereignty beyond the provider’s nationality
An institution comparing email services needs evidence about the service and its operating arrangements, not just a DNS lookup or a provider’s country of origin. Useful questions include:
- Provider jurisdiction and control: Where is the provider incorporated, and which laws may apply to it?
- Data location and access: Where is information stored, what does the contract promise, and what lawful access obligations apply?
- Operational resilience: Can the institution keep email available during a supplier disruption, and can it realistically switch providers?
- Security and capability: Does the service meet requirements for filtering, identity management, integration, support and reliability?
- Competition and choice: Does procurement preserve viable alternatives and avoid dependence on a single supplier?
The NOS findings make reliance visible, but they do not answer these procurement and security questions. Nor do the examples of non-US services establish that European ownership alone resolves privacy, security or resilience concerns.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
