Skip to content

# Mail Encryption

Info

The Mail crypt plugin is used to secure email messages stored in a Dovecot system. Messages are encrypted before written to storage and decrypted after reading. Both operations are transparent to the user.

In case of unauthorized access to the storage backend, the messages will, without access to the decryption keys, be unreadable to the offending party.

There can be a single encryption key for the whole system or each user can have a key of their own. The used cryptographical methods are widely used standards and keys are stored in portable formats, when possible.

Official Dovecot documentation: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/

## Basic Setup

1. Before you can enable mail_crypt, you'll need to copy out several dovecot/conf.d files to the host (from a running container) and then take the container down:

       mkdir -p config/dovecot
       docker cp mailserver:/etc/dovecot/conf.d/20-lmtp.conf config/dovecot/
       docker cp mailserver:/etc/dovecot/conf.d/20-imap.conf config/dovecot/
       docker cp mailserver:/etc/dovecot/conf.d/20-pop3.conf config/dovecot/
       docker-compose down

2. You then need to generate your global EC key.
3. The EC key needs to be available in the container. I prefer to mount a /certs directory into the container:

       services:
         mailserver:
           image: docker.io/mailserver/docker-mailserver:latest
           volumes:
           . . .
             - ./certs/:/certs
           . . .

4. While you're editing the docker-compose.yml, add the configuration files you copied out:

       services:
         mailserver:
           image: docker.io/mailserver/docker-mailserver:latest
           volumes:
           . . .
             - ./config/dovecot/20-lmtp.conf:/etc/dovecot/conf.d/20-lmtp.conf
             - ./config/dovecot/20-imap.conf:/etc/dovecot/conf.d/20-imap.conf
             - ./config/dovecot/20-pop3.conf:/etc/dovecot/conf.d/20-pop3.conf
             - ./certs/:/certs
           . . .

5. The `mail_crypt` plugin, unless you're using a non-standard configuration of docker-mailserver, should be enabled on both `lmtp` and `imap`. You'll want to edit three different files:
   - `./config/dovecot/20-lmtp.conf`

         protocol lmtp {
           mail_plugins = $mail_plugins sieve mail_crypt
           plugin {
             mail_crypt_global_private_key = </certs/ecprivkey.pem
             mail_crypt_global_public_key = </certs/ecpubkey.pem
             mail_crypt_save_version = 2
           }
         }

   - `./config/dovecot/20-imap.conf`

         protocol imap {
           mail_plugins = $mail_plugins imap_quota mail_crypt
           plugin {
             mail_crypt_global_private_key = </certs/ecprivkey.pem
             mail_crypt_global_public_key = </certs/ecpubkey.pem
             mail_crypt_save_version = 2
           }
         }

   - If you use pop3, make the same changes in `20-pop3.conf`
6. Start the container and monitor the logs for any errors

This should be the minimum required for encryption of the mail while in storage.