Using the SecureMail add-on for Thunderbird

The SecureMail add-on brings the choice of delivery path straight into the compose window of Thunderbird. Encrypting, signing and delivering happen at the gateway. The add-on sets headers on the outgoing message for that, it holds no key material and performs no cryptography. The only exception is the PDF without mail routing, see below.

The same therefore applies to Thunderbird as to any other client: encryption takes effect even when the add-on is not installed at all. Without the add-on, the rule set for outgoing messages decides on its own.

What the add-on does

A button with the released delivery paths appears in the compose window. S/MIME, OpenPGP, password-protected PDF and the message portal are available. Which methods are visible is governed by the same configuration as for the Outlook add-in, including release per sender group.

Before sending, the add-on can require a confirmation when no delivery path has been chosen. It is triggered by the same conditions as in Outlook, for instance a recipient domain, an attachment being present or a route that does not encrypt. If the add-on is not connected to the account, Thunderbird sends without asking, so that unmanaged accounts are never blocked.

Prerequisites

Thunderbird from version 128. The sender domain is proven in the tenant, with or without mail routing, see connecting a domain. Mailboxes without a domain of their own work with the PDF only, see below.

PDF without mail routing

From add-on 1.4.0 the password-protected PDF is created before sending where needed:

1. The add-on sends subject, text and attachments to Conbool and receives the PDF.
2. Text and attachments of the draft are replaced by a notice and the PDF.
3. Thunderbird sends the message itself through the mailbox's SMTP server.

Conbool does not deliver the message. The sender's SPF and DKIM stay untouched, no MX, SPF or TXT record for Conbool is required. If creating the PDF fails, nothing is sent.

Without a domain of its own the add-on offers the PDF only. S/MIME, OpenPGP and the message portal need mail routing. Pairing is per mailbox, and the mailbox belongs to a member with a confirmed address. The password is agreed in advance or sent by mail from a Conbool address. Older add-on versions are not offered the PDF this way.

Installation

The add-on file is available for download in the portal under settings, SecureMail, add-in on the Thunderbird tab. In Thunderbird, then go to tools, add-ons and themes, choose the entry for installing from a file through the gear icon and select the downloaded file.

Thunderbird does not require a signature for this.

Pairing

After installation the add-on is not yet connected to the tenant. The connection is created through a pairing code from the portal, which the add-on accepts under settings. There are two kinds of code.

A single mailbox

A code for exactly one address. It is valid for 15 minutes and can be redeemed once. Suitable for individual workplaces and for tests.

A whole domain

A code for all mailboxes of a verified domain. It is valid for seven days and can be redeemed on any number of machines. Every machine receives its own token and stays individually revocable. This is the path for a rollout, since a single code is enough for the entire domain.

With this variant the add-on reports the concrete sender address with every request. The gateway checks it against the domain of the token and additionally against the verified domains of the tenant. A token for one domain can therefore never act for a foreign domain.

Distribution in the company

For larger environments the add-on file can be distributed through the enterprise policy of Thunderbird. In policies.json an entry under ExtensionSettings with the installation mode force_installed and the address of the file makes sure that the add-on is present at every start. Together with an enrolment code for the domain, only a single step is left for the user.

Managing and revoking access

All connected credentials are listed in the portal under settings, SecureMail, add-in on the Thunderbird tab. Status, last activity and the associated address or domain are visible. Every credential can be revoked individually, after which the associated token is immediately invalid.

An enrolment code for a domain is revoked separately from the credentials created from it. If it is revoked, no new machines are added, while already connected ones keep working unchanged.

Differences from the Outlook add-in

The Outlook add-in signs in through Entra ID and is rolled out through the Microsoft 365 admin center, described under SecureMail for Microsoft 365. Thunderbird does not know that path, hence the pairing through a code. Functionally both behave the same: the same delivery paths, the same configuration, the same confirmation before sending unencrypted.