Skip to content

# Mail Encryption

Info

The Mail crypt plugin is used to secure email messages stored in a Dovecot system. Messages are encrypted before written to storage and decrypted after reading. Both operations are transparent to the user.

In case of unauthorized access to the storage backend, the messages will, without access to the decryption keys, be unreadable to the offending party.

There can be a single encryption key for the whole system or each user can have a key of their own. The used cryptographical methods are widely used standards and keys are stored in portable formats, when possible.

Official Dovecot documentation: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/

## Single Encryption Key / Global Method

1. Create `10-custom.conf` and populate it with the following:

       # Enables mail_crypt for all services (imap, pop3, etc)
       mail_plugins = $mail_plugins mail_crypt
       plugin {
         mail_crypt_global_private_key = </certs/ecprivkey.pem
         mail_crypt_global_public_key = </certs/ecpubkey.pem
         mail_crypt_save_version = 2
       }

2. Shutdown your mailserver (`docker-compose down`)

3. You then need to generate your global EC key. We named them `/certs/ecprivkey.pem` and `/certs/ecpubkey.pem` in step #1.

4. The EC key needs to be available in the container. I prefer to mount a /certs directory into the container:

       services:
         mailserver:
           image: docker.io/mailserver/docker-mailserver:latest
           volumes:
           . . .
             - ./certs/:/certs
           . . .

5. While you're editing the `docker-compose.yml`, add the configuration file:

       services:
         mailserver:
           image: docker.io/mailserver/docker-mailserver:latest
           volumes:
           . . .
             - ./config/dovecot/10-custom.conf:/etc/dovecot/conf.d/10-custom.conf
             - ./certs/:/certs
           . . .

6. Start the container, monitor the logs for any errors, send yourself a message, and then confirm the file on disk is encrypted:

       [root@ip-XXXXXXXXXX ~]# cat -A /mnt/efs-us-west-2/maildata/awesomesite.com/me/cur/1623989305.M6v�z�@�� m}��,��9����B*�247.us-west-2.compute.inE��\Ck*�@7795,W=7947:2,
       T�9�8t�6�� t���e�W��S   `�H��C�ڤ �yeY��XZ��^�d�/��+�A

This should be the minimum required for encryption of the mail while in storage.

Back to top