I often send and receive gpg-encrypted mail. At the moment I use thunderbird + enigmail (in linux) to do that. As far as I know there is no way in thunderbird to find all encrypted messages which bodies contain particular keywords. There also seems to be no option to save encrypted mails decrypted (so they would be searchable). However for me it is important to be able to search old encrypted mails. So my question is:

Is there a way in linux to save incoming mails automatically decrypted in my inbox and save outgoing encrypted mail decrypted in the send folder? Both times adding a line to the body which remarks that the mail was encrypted.

It could be another email client for linux that could to that or perhaps a solution using procmail or maildrop.

For a procmail solution I guess there could be some problems with encoding (perhaps one have to use emil?) the solution should work well with german special characters in subject and body. Note that the solution should work for multipart encrypted messages (including encrypted attachments) too i.e. with everything which could thunderbird + enigmail generate.

Further note that I don't want a discussion about security holes. For me it's ok if messages are stored decrypted on my harddrive (which is encrypted as a whole anyway). In doubt for a first solution it would be ok to store my private key passphrase in cleartext on my harddrive, too. The point is that the mails are encrypted on the mailserver or more generally on their "way through the net".

  • the reason you have not received any solutions is that they probably do not exist. It is the 'security holes' that you mention that normally people do not want to do something like this. I've written simple solutions (do a quick forward on the msg, copy all, paste to a php page for parsing and input to a database for searching) but its normally a bad practice – g19fanatic Mar 22 '11 at 19:15
  • 1
    Related: superuser.com/questions/375194/… – student Dec 12 '12 at 12:34
  • 1
    Related: unix.stackexchange.com/questions/46580/… – student Dec 12 '12 at 12:42
  • 1
    This is being discussed a lot on the Enigmail community forums and the feature request has been on the roadmap for 7 years now. On why this is difficult to implement, read for yourself: enigmail.net/forum/viewtopic.php?f=9&t=34 – gertvdijk Dec 12 '12 at 21:30

Have you tried BCC'ing yourself and adding a per recipient rule that says to never, sign or encrypt the message to your BBC'd email address?

Then on the incoming you could make a rule, but you would have to provide your passphrase interactively anyway, so you might as well copy the email to a folder after you decrypt it.

Of course, if you had access to the mail server, and you run maildir, you could always write a short script that greps the mail files looking for "-----PGP BEGIN -----" and runs them through GPG on the command line and them copies them to a folder. Then you could just set it up for a cron job. Caveat is that you would have to provide the script your key and passphrase - which sort of defeats the whole idea, but possible.

/2 cents

UPDATE: I was thinking (this morning in the shower...) that since you're running linux as your OS, you could just write a shell script that greps your thunderbird inbox (and folders) to find the PGP files on the command line, decrypt them, and then copy them in to the appropriate mail folder. That way none of the data is in the clear on the server. You could run the script interactively for better security.

  • It would be interesting to see more details, how you would implement those scripts. – student Mar 24 '11 at 6:41
  • 1
    I'd like to point out that BCC'ing yourself unencrypted will still send it over the internet once. Defying at least part of the reason to encrypt in the first place. – amenthes Oct 15 '16 at 17:36

After skub's hint I could imagine that the following could work:

  • use fetchmail to fetch mail
  • put something like this: /usr/bin/procmail -d %s in .fetchmailrc
  • procmail puts mail into ~/Maildir
  • use the following postfix rule in .postfixrc

    :0 Bfw
     \* -----BEGIN PGP MESSAGE-----| formail -A "MIME-Version: 1.0" | formail -A "Content-Transfer-Encoding: quoted-printable"
    :0 fw
    | emil
    :0 bfw
    | gpg -d --passphrase "My password" --batch
  • run locally an IMAP server like Dovecot (reads ~/Maildir)

  • configure Thunderbird (or another email client) to listen on localhost for IMAP
  • 1
    The problem is that I don't really trust this solution. I am afraid of loosing mails or that I oversee some mail coding problem. Perhaps someone with more experience could edit my text and correct and improve my partial solution. – student Mar 23 '11 at 19:16
  • I should add that I have no experience with the programs mentioned above (fetchmail, procmail, dovecat etc.). I put this together from reading the manuals... – student Mar 23 '11 at 19:17
  • But that is all server-side and runs the risk of others gaining access to your mail in plain text - or worse, your secret key! Wouldn't it just be better to make a shell script locally to run through your local mail boxes and decrypt it to decrypted folders? – skub Mar 24 '11 at 1:28
  • No, that's not really server-side since in this case we have only a trivial server, which is my own PC. After fetching the mail everything happens offline. – student Mar 24 '11 at 6:40
  • Ok, I have the two security hole that someone with access to my machine could read mail in plaintext and get the secret key. For the first point notice that my entire harddrive is encrypted for the second I guess that it would be possible to modify my solution in such a way, that the secret key is not stored in plain text (for example authentificate via usb stick...). However every solution which has only severe security problems in the case when someone has access to my machine would be great. – student Mar 24 '11 at 6:48

One "possible" solution is to run Zimbra Starter Server, which their website claim to support PGP.

However I don't have experience with that version as I only use the Open Source version, which do not support PGP or S/MIME.


  1. Powerful webmail interface
  2. Support PGP/S/MIME
  3. Support external mail box
  4. * IF * this solution works, no more extra steps for storing/encrypting/decrypting emails.


  1. Very Expensive for personal use, it is $399/yr, or $840(Perpetual)
  2. It is very resource intensive

I suggest this because

  1. I am using their open source version daily and quite happy with the web interface.
  2. I really don't seems to find open source / free linux email client that meets your need.

If you consider this route, I would suggest getting on their forum or even with a sales/tech over the phone, and make sure it meets your need 100%.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.