[GH-ISSUE #599] [Feature Request] Add ability to automatically decrypt outgoing messages

kerem commented

2026-03-14 11:24:00 +03:00

Owner

Originally created by @Pr0prioceptid on GitHub (Feb 21, 2024).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/599

Hello,
It would be nice if I could encrypt my mail locally with the anonaddy public key before sending and have anonaddy decrypt it for me before it gets to the person I'm trying to send mail to.

This is for when I'd like to hide the contents of my outgoing mail from my email provider, but the person I'm sending to isn't interested in providing their public key.

Originally created by @Pr0prioceptid on GitHub (Feb 21, 2024). Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/599 Hello, It would be nice if I could encrypt my mail locally with the anonaddy public key before sending and have anonaddy decrypt it for me before it gets to the person I'm trying to send mail to. This is for when I'd like to hide the contents of my outgoing mail from my email provider, but the person I'm sending to isn't interested in providing their public key.

kerem closed this issue

2026-03-14 11:24:05 +03:00

kerem commented

2026-03-14 11:24:11 +03:00

Author

Owner

@willbrowningme commented on GitHub (Mar 13, 2024):

I have this working and I'm currently beta testing it on addy.io.

Please drop me an email with your username if you'd like to help test it out so that I can add you as a beta tester.

@willbrowningme commented on GitHub (Mar 13, 2024): I have this working and I'm currently beta testing it on addy.io. Please [drop me an email](https://addy.io/contact/) with your username if you'd like to help test it out so that I can add you as a beta tester.

kerem commented

2026-03-14 11:24:16 +03:00

Author

Owner

@willbrowningme commented on GitHub (Mar 13, 2024):

In order to help beta test this you simply need to encrypt a reply/send to one of your aliases using the no-reply@addy.io public key (fingerprint - 26A987650243B28802524E2F809FD0D502E2F695). You can get the key on https://keys.openpgp.org.

When the message arrives at the addy.io server, it will attempt to decrypt it using the corresponding private key. If it is successful then it will replace the message data with the decrypted contents and send it on to the correct destination.

If you are using Mozilla Thunderbird then you will need to use their pgp alias rules configuration - https://support.mozilla.org/en-US/kb/openpgp-recipient-alias-configuration, this is because by default they do not allow you to encrypt an email using a public key that does not match the receiver's identity.

Here's an example config that you can use for your openpgp_alias_to_keys.json:

{
  "description": "Thunderbird OpenPGP Alias Rules",
  "rules": [
    {
      "domain": "anonaddy.me",
      "keys": [
        {
          "description": "Testing decrypt replies/sends on addy.io",
          "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695"
        }
      ]
    }
  ]
}

This will allow you to encrypt all messages sent to aliases *@anonaddy.me using the no-reply@addy.io public key.

@willbrowningme commented on GitHub (Mar 13, 2024): In order to help beta test this you simply need to encrypt a reply/send to one of your aliases using the `no-reply@addy.io` public key (fingerprint - `26A987650243B28802524E2F809FD0D502E2F695`). You can get the key on [https://keys.openpgp.org](https://keys.openpgp.org/search?q=26A987650243B28802524E2F809FD0D502E2F695). When the message arrives at the addy.io server, it will attempt to decrypt it using the corresponding private key. If it is successful then it will replace the message data with the decrypted contents and send it on to the correct destination. If you are using Mozilla Thunderbird then you will need to use their pgp alias rules configuration - [https://support.mozilla.org/en-US/kb/openpgp-recipient-alias-configuration](https://support.mozilla.org/en-US/kb/openpgp-recipient-alias-configuration), this is because by default they do not allow you to encrypt an email using a public key that does not match the receiver's identity. Here's an example config that you can use for your `openpgp_alias_to_keys.json`: ```json { "description": "Thunderbird OpenPGP Alias Rules", "rules": [ { "domain": "anonaddy.me", "keys": [ { "description": "Testing decrypt replies/sends on addy.io", "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695" } ] } ] } ``` This will allow you to encrypt all messages sent to aliases `*@anonaddy.me` using the `no-reply@addy.io` public key.

kerem commented

2026-03-14 11:24:21 +03:00

Author

Owner

@willbrowningme commented on GitHub (Mar 13, 2024):

It will also remove any attached PGP keys (Content-Type: application/pgp-keys) when decrypting the reply/send in order to prevent you accidentally exposing your real email.

@willbrowningme commented on GitHub (Mar 13, 2024): It will also remove any attached PGP keys (`Content-Type: application/pgp-keys`) when decrypting the reply/send in order to prevent you accidentally exposing your real email.

kerem commented

2026-03-14 11:24:26 +03:00

Author

Owner

@lawmanuk commented on GitHub (Feb 5, 2026):

What happens when we want our PGP public key to go to recipient so they can write back?

2 problems I've found.

Addy doesn't give option to keep them.
Thunderbird doesn't allow assigning key to email account without an email address in identity. Ideally I'd like to create a pgp key without email in identity the import to thunderbird pgp manager, but it doesn't let you assign to account if identity has no email. Claws email lets you do this but its not great in many other ways. Don't want to use console Neomutt and others as too many limitations in the modern world with graphics etc.

Is there a solution to above? Especially (2)?

Thanks

@lawmanuk commented on GitHub (Feb 5, 2026): What happens when we want our PGP public key to go to recipient so they can write back? 2 problems I've found. 1) Addy doesn't give option to keep them. 2) Thunderbird doesn't allow assigning key to email account without an email address in identity. Ideally I'd like to create a pgp key without email in identity the import to thunderbird pgp manager, but it doesn't let you assign to account if identity has no email. Claws email lets you do this but its not great in many other ways. Don't want to use console Neomutt and others as too many limitations in the modern world with graphics etc. Is there a solution to above? Especially (2)? Thanks

kerem commented

2026-03-14 11:24:32 +03:00

Author

Owner

@willbrowningme commented on GitHub (Feb 5, 2026):

There is the option now to allow PGP keys to be kept (and not be removed by addy.io). You can enable this by clicking "Edit" next to a recipient from the recipients page and then turning off the "Remove PGP Keys from Replies/Sends" option.

I'm afraid I don't currently know of a solution to the Thunderbird issue.

@willbrowningme commented on GitHub (Feb 5, 2026): There is the option now to allow PGP keys to be kept (and not be removed by addy.io). You can enable this by clicking "Edit" next to a recipient from the [recipients](https://app.addy.io/recipients) page and then turning off the "Remove PGP Keys from Replies/Sends" option. I'm afraid I don't currently know of a solution to the Thunderbird issue.

kerem commented

2026-03-14 11:24:37 +03:00

Author

Owner

@lawmanuk commented on GitHub (Feb 5, 2026):

when deleting pgp key from replies/sends does it also remove from the autocrypt headers?

@lawmanuk commented on GitHub (Feb 5, 2026): when deleting pgp key from replies/sends does it also remove from the autocrypt headers?

kerem commented

2026-03-14 11:24:42 +03:00

Author

Owner

@willbrowningme commented on GitHub (Feb 5, 2026):

No it just removes the attachments as shown here - https://github.com/anonaddy/anonaddy/blob/master/app/Mail/ReplyToEmail.php#L208-L220

@willbrowningme commented on GitHub (Feb 5, 2026): No it just removes the attachments as shown here - https://github.com/anonaddy/anonaddy/blob/master/app/Mail/ReplyToEmail.php#L208-L220

kerem commented

2026-03-14 11:24:47 +03:00

Author

Owner

@lawmanuk commented on GitHub (Feb 5, 2026):

I meant that if addy removes attachment but not the autocrypt header (which also contains the pgp key), then the identity can still be leaked if it contains email address. Seems like this leak should be considered in same light.

The ideal situation would be to figure out how to make thunderbird allow on-the-fly signing/replaying without email in identity, but will see if alias can resolve that issue albeit much less ideal if can't adapt for on-the-fly addy addresses. This is a serious problem making encryption + private email address almost impossible with thunderbird. I've had to stop using pgp for now until I can figure out a solution or use a different linux mailer.

Thanks for your efforts.

@lawmanuk commented on GitHub (Feb 5, 2026): I meant that if addy removes attachment but not the autocrypt header (which also contains the pgp key), then the identity can still be leaked if it contains email address. Seems like this leak should be considered in same light. The ideal situation would be to figure out how to make thunderbird allow on-the-fly signing/replaying without email in identity, but will see if alias can resolve that issue albeit much less ideal if can't adapt for on-the-fly addy addresses. This is a serious problem making encryption + private email address almost impossible with thunderbird. I've had to stop using pgp for now until I can figure out a solution or use a different linux mailer. Thanks for your efforts.

kerem commented

2026-03-14 11:24:52 +03:00

Author

Owner

@willbrowningme commented on GitHub (Feb 6, 2026):

addy.io forwards on replies/sends as entirely new emails and does not pass through all original headers, so the Autocrypt: header will not be included in replies/sends.

@willbrowningme commented on GitHub (Feb 6, 2026): addy.io forwards on replies/sends as entirely new emails and does not pass through all original headers, so the `Autocrypt:` header will not be included in replies/sends.

kerem commented

2026-03-14 11:24:57 +03:00

Author

Owner

@lawmanuk commented on GitHub (Feb 6, 2026):

If there is an option to leave pgp key attached, it would follow that autocrypt being left in would also assist as an option.

Thanks for considering.

@lawmanuk commented on GitHub (Feb 6, 2026): If there is an option to leave pgp key attached, it would follow that autocrypt being left in would also assist as an option. Thanks for considering.

kerem commented

2026-03-14 11:25:02 +03:00

Author

Owner

@lawmanuk commented on GitHub (Feb 11, 2026):

What happens when we want our PGP public key to go to recipient so they can write back?

2 problems I've found.

Addy doesn't give option to keep them.

Thunderbird doesn't allow assigning key to email account without an email address in identity. Ideally I'd like to create a pgp key without email in identity the import to thunderbird pgp manager, but it doesn't let you assign to account if identity has no email. Claws email lets you do this but its not great in many other ways. Don't want to use console Neomutt and others as too many limitations in the modern world with graphics etc.

Is there a solution to above? Especially (2)?

Thanks

I found a solution to (2). If you go into the config editor in settings, you can find your account and put the key id of the pgp key you want to use. If you create a pgp key in gnupg without email address and import into thunderbird, then you can use with any alias without revealing your real email.

Also, when using multiple domains for alias, a separating comma is needed fyi incase anyone tries this in future like below.

You can place this into your profile folder in thunderbird and it will work, once you add to config editor in settings under mail.openpgp.alias_rules_file setting.

mail.openpgp.alias_rules_file.json

{
  "description": "Thunderbird OpenPGP Alias Rules for Addy",
  "rules": [
    {
      "domain": "anonaddy.me",
      "keys": [
        {
          "description": "Addy.io Key",
          "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695"
        }
      ]
    },
    {
      "domain": "addy.io",
      "keys": [
        {
          "description": "Addy.io Key",
          "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695"
        }
      ]
    },
    {
      "domain": "anonaddy.com",
      "keys": [
        {
          "description": "Addy.io Key",
          "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695"
        }
      ]
    }
  ]
}

@lawmanuk commented on GitHub (Feb 11, 2026): > What happens when we want our PGP public key to go to recipient so they can write back? > > 2 problems I've found. > > 1. Addy doesn't give option to keep them. > 2. Thunderbird doesn't allow assigning key to email account without an email address in identity. Ideally I'd like to create a pgp key without email in identity the import to thunderbird pgp manager, but it doesn't let you assign to account if identity has no email. Claws email lets you do this but its not great in many other ways. Don't want to use console Neomutt and others as too many limitations in the modern world with graphics etc. > > Is there a solution to above? Especially (2)? > > Thanks I found a solution to (2). If you go into the config editor in settings, you can find your account and put the key id of the pgp key you want to use. If you create a pgp key in gnupg without email address and import into thunderbird, then you can use with any alias without revealing your real email. Also, when using multiple domains for alias, a separating comma is needed fyi incase anyone tries this in future like below. You can place this into your profile folder in thunderbird and it will work, once you add to config editor in settings under mail.openpgp.alias_rules_file setting. [mail.openpgp.alias_rules_file.json](https://github.com/user-attachments/files/25243023/mail.openpgp.alias_rules_file.json) ``` { "description": "Thunderbird OpenPGP Alias Rules for Addy", "rules": [ { "domain": "anonaddy.me", "keys": [ { "description": "Addy.io Key", "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695" } ] }, { "domain": "addy.io", "keys": [ { "description": "Addy.io Key", "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695" } ] }, { "domain": "anonaddy.com", "keys": [ { "description": "Addy.io Key", "fingerprint": "26A987650243B28802524E2F809FD0D502E2F695" } ] } ] } ```

Rows
Columns

[GH-ISSUE #599] [Feature Request] Add ability to automatically decrypt outgoing messages #994