It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster.
Now, I am wondering whether the same is true for the e-mail provider that provides the e-mail address that serves as the official contact address for a website. Do I need a contract for processing on behalf with my e-mail provider, if they host the address that might receive inquiries from strangers who have visited my website?
My straightforward guess would be that my e-mail inbox can contain more personal data about people who visited my website by orders of magnitude than a server log that just stores IP addresses ever will.
On the other hand, I notice that at least e-mail providers here in Germany do not seem to offer any templates for such contracts (unlike various local web hosters). Furthermore, the only really explicit statement on the matter that I could find appears to come from one such e-mail provider, GMX, saying:
Bei GMX-TopMail handelt es sich um einen Telekommunikationsdienst. Die Erhebung, Verarbeitung und Speicherung von personenbezogenen Daten und anfallenden Verkehrsdaten regelt das Telekommunikationsgesetz (TKG).
Ein gesonderter Auftragsdatenverarbeitungsvertrag ist bei solchen Telekommunikationsdiensten vom Gesetzgeber nicht vorgesehen.
GMX TopMail is a telecommunication service. Retrieval, processing, and storing of personal data and any mail detail records are regulated by the telecommunication law (TKG).
The legislator does not assume any separate contract for processing on behalf for such telecommunication services.
It should be noted that this statement refers explicitly to the paid variant of their e-mail service, and that I understand the statement to say "separate contract" (separate from, or in addition to what?).