Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I'm trying to do is be able to take all incoming messages and encrypt them with that users public pgp key.

I'm running postfix + courier etc.

I've read through this and that makes sense to me, but it's for all mail for a single user.

I've looked into gpg-mailgate ( I cant post any more links )

Also using an after queue content filter hook to grab the email per user and then pass it off, encrypt, then pass back in to be delivered.

My question is, has anyone successfully implemented this sort of setup? I'm curious as to what happens if an already encrypted message comes through?

Just looking for some direction here. There seem to be a few options and I'm not sure which if any is correct.

share|improve this question

If you use Courier's maildrop, and you have the full Courier package then you can use the xfilter mailfilter expression and Courier's mimegpg command (from the sqwebmail package):

exception {
  xfilter "mimegpg -e -- -r $LOGNAME"

You can optionally add filtering to include/exclude specific emails, e.g. by sender, subject or those already containing encrypted parts (depending on how robust you want it to be, and how paranoid/cautious you are).

The delivery user must have access to the recipient public key(s), you may need to have a key server or a shared keyring. LOGNAME may need some tweaking, in my preferred configuration it's a full email address rather than just the local part, so the above works for me.

mimegpg preserves the email headers, and encrypts the email part-wise. Each single part becomes a new multipart/encrypted container, with an application/pgp-encrypted stub part and an application/octet-stream ASCII-armored payload. My email client and GPG plugin have no problems with this, some might however.

I have also used mimedefang to interface with gpg, this allows greater flexibility, but requires some non-trivial code.

If you use postfix to deliver directly into a maildir, or you don't use maildrop as an MDA, this won't work for you. You may either set up postfix to use maildrop, or perhaps do something similar with mimegpg and what ever you do use.

share|improve this answer
I decided to go with gpg-mailgate ( ). I currently have this up and functioning except for the fact that it only works with plain text email. Everything else I get headers and thats it. Will post more info when/if I figure out what is going on. – TheEditor Sep 6 '13 at 12:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.