Decrypting and verifying incoming email

For incoming messages SecureMail takes care of decryption and signature verification at the gateway. A route with the direction inbound defines which messages are processed how before they arrive in the mailbox.

Defining the addressees

In the first step the route determines the addressees. With incoming mail the recipient is typically a mailbox of the tenant domain and the sender is the external counterpart. Addressees can be chosen as a single address, as a group or as all mailboxes. The matches or does not match condition includes or excludes a route.

Defining the addressees of an inbound route.

Choosing protocols

Then at least one protocol is enabled: S/MIME for X.509-based processing, OpenPGP for PGP processing or both together. SecureMail recognises the method actually used by the incoming message and applies the matching logic.

Protocol selection for incoming messages.

Decryption and signature verification

The cryptography step governs two operations. Decryption ranges from do not decrypt through decrypt if possible to decrypt only. Signature verification ranges from do not verify through verify if possible to verify only. The key is identified automatically from the email address, a specific certificate is optional.

Governing decryption and signature verification.

Two options make operations easier. The automated import recognises certificates and public keys contained in signed emails and stores them for later replies. After successful verification the signature can be removed from the message, the content stays intact. The result can be shown as a status in the subject, for instance [Decrypted] or [Signature verified].

For the opposite direction see outbound messages. The keys in use are managed on the S/MIME certificates and PGP keys page. An overview is given in the SecureMail index, and the content inspection of incoming mail is additionally handled by MailGuard.