Encrypt your stored mail
Have the mail on your server stored encrypted with a key only you hold, so a stolen disk or backup shows nothing. How to turn it on, set up Thunderbird and OpenKeychain, and what you give up.
On this page
Normally the mail on your server sits on its disk as readable text. Anyone who gets that disk, or a copy of your backups, can read it. Encrypted mail changes that. Each new message is locked with your public key the moment it arrives, so the server only ever keeps a scrambled copy. Only your private key, which stays on your own devices, can open it.
Sending and receiving work exactly as before. People who write to you notice nothing.
What you give up#
It is a real trade, so it is off until you choose it.
- You need your key everywhere you read mail. Your phone, your laptop, any mail app you use. Without the key a message is unreadable, to you as much as to anyone.
- The server cannot search inside messages. Searching by sender or subject still works. Subjects, senders and dates are not encrypted, only the text and attachments.
- Mail already stored stays as it is. The mail server cannot encrypt old messages afterwards. Only mail that arrives after you switch it on, and the copies your mail app saves to Sent, are encrypted.
- Webmail needs your key too. SnappyMail can read encrypted mail only if you give it your key in its own OpenPGP settings.
Lose the key and the mail is gone
LibrePortal never sees your private key and cannot recover it. Keep a copy somewhere safe, such as a password manager or an encrypted drive.
Before you start#
You need a mailbox on your mail server (Stalwart) linked to your person under Admin → Users. And your server has to allow it: when you installed Stalwart, Encrypted mail storage was on by default. If it is off, turn it on under Stalwart's Config tab. Turning it on never encrypts anyone's mailbox. It only lets each person choose.
Turn it on#
- Go to Admin → Users and open your own person. Find the Encrypted mail card, under the Mailbox card.
- Press Encrypt my stored mail and read the four points. Press Continue.
- Choose Make a new key here. The key is made in your browser, so the private half never leaves your device. Add a passphrase if you can: it locks the key file you download.
- Press Download the private key and keep the file safe. Tick the box to say you have, then Continue.
- Press Switch on and test. LibrePortal sends the public key to the mail server, sends a test message to your mailbox, and reads back how it was stored.
You should see Test passed. The test message is in your inbox. Open it once you have set up your mail app below: if you can read it, your key works on that device.
Why a test?
A switch that looks on but stores your mail plainly is worse than no switch. The test reads the stored message back and checks it is really an encrypted message. If it is not, you are told.
Already have a key? Choose Use my own public key instead, and paste your public key or pick the file. Only a public key is accepted. A private key is refused.
Thunderbird on a computer#
- Open Tools → OpenPGP Key Manager.
- Choose File → Import Secret Key(s) from File and pick the file you downloaded. Enter the passphrase if you set one.
- Open your account's Account Settings, then End-to-End Encryption, and under OpenPGP choose Add Key, then Use your existing key. Pick the key for your mailbox.
- Open the test message. Thunderbird decrypts it for you.
A phone: Thunderbird for Android and OpenKeychain#
- Install Thunderbird (formerly K-9 Mail) and OpenKeychain. OpenKeychain is on F-Droid.
- Copy the private key file to the phone, over a cable or from your password manager.
- In OpenKeychain choose Import from file and pick it. Enter the passphrase if you set one.
- In Thunderbird open the account's settings, choose End-to-end encryption, and pick the key under OpenPGP.
- Open the test message in your inbox.
OpenKeychain is not being developed much any more, and Thunderbird is moving to its own built-in OpenPGP. It still works, and the steps above are the same idea either way.
Turn it off#
On the same card, press Turn off encryption. New mail is stored as plain text again, and the public key is removed from the server.
Mail already encrypted stays encrypted
Turning it off does not unlock what is already stored. Keep your private key for as long as you want to read that mail.
If the test fails#
The card tells you why in plain words. The usual causes are a key with no part for encrypting (make a new one here, or export a fresh public key from your mail app), a mail server that is not running, or a test message that never arrived. After fixing it, press Run the test again.