Encryption

Configures encryption at rest and the encryption gateway.

This object can be configured from the WebUI under Settings › Encryption › Key Discovery, Settings › Encryption › Gateway, Settings › Encryption › Encryption at Rest, Settings › Encryption › S/MIME Trust

Fields

`atRestEnable`

Type: Boolean · default: true

Encrypt stored messages for accounts that configured encryption at rest

`gatewayEnable`

Type: Boolean · default: false

Enable the encryption gateway, which encrypts messages for remote recipients and maintains their public keys

`gatewayOutbound`

Type: Expression · default: {"else":"opportunistic","match":{"0":{"if":"is_local_domain(rcpt_domain)","then":"disable"}}}

When to encrypt a message for a recipient with a stored key

Available variables: MtaQueueRcptVariable.

Available constants: EncryptionModeConstant.

`gatewayMinTrust`

Type: Expression · default: {"else":"harvested"}

Minimum trust level a key needs before it is used for a recipient

Available variables: MtaQueueRcptVariable.

Available constants: KeyTrustConstant.

`gatewayMethods`

Type: Set<PublicKeyKind> · default: {"openPgp":true,"smime":true}

Key types the gateway encrypts with; when a DNS lookup returns both an OpenPGP key and an S/MIME certificate for a new key, the certificate is stored

`gatewayHeaderProtection`

Type: HeaderProtection · default: "baseline"

Header protection for messages encrypted for remote recipients. Signed messages are not header protected.

`gatewayEncryptSigned`

Type: Boolean · default: true

Whether to encrypt messages that are signed but not encrypted

`harvestKeys`

Type: Expression · default: {"else":"!is_local_domain(sender_domain)"}

Whether to learn the S/MIME certificate or Autocrypt key of an authenticated sender from a received message; a valid OpenPGP signature on the message raises the trust level of an Autocrypt key

Available variables: EncryptionHarvestVariable.

`hkpServers`

Type: Set<Uri>

Keyservers queried for keys that use the HKP discovery method

`discoveryProxy`

Type: Uri?

HTTP proxy for key fetches and certificate revocation list downloads

`sourceTimeout`

Type: Duration · default: 5000

Maximum time spent fetching one key

`keyRefreshInterval`

Type: Duration · default: 86400000

How often keys are fetched again from their discovery method

`negativeCacheTtl`

Type: Duration · default: 86400000

How long an address with no key is remembered before the store is read again

`useBundledRoots`

Type: Boolean · default: true

Trust the bundled Mozilla S/MIME root certificates when validating recipient certificates

`maxCrlSize`

Type: Size · default: 20000000 · min: 1

Maximum size of a downloaded certificate revocation list

JMAP API

The Encryption singleton is available via the urn:stalwart:jmap capability.

`x:Encryption/get`

This is a standard Foo/get method as defined in RFC 8620, Section 5.1.

For singletons, the ids argument should be the literal singleton (or null to return the single instance).

This method requires the sysEncryptionGet permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:Encryption/get",
          {
            "ids": [
              "singleton"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

`x:Encryption/set`

This is a standard Foo/set method as defined in RFC 8620, Section 5.3.

For singletons, only the update argument with id singleton is accepted; create and destroy arguments are rejected.

This method requires the sysEncryptionUpdate permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:Encryption/set",
          {
            "update": {
              "singleton": {
                "atRestEnable": true
              }
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

CLI

stalwart-cli wraps the same JMAP calls. See the CLI reference for installation, authentication, and general usage.

Fetch

stalwart-cli get Encryption

Update

stalwart-cli update Encryption --field atRestEnable=true

Nested types

Expression

A conditional expression with match rules and a default value.

`match`

Type: List<ExpressionMatch>

List of conditions and their corresponding results

`else`

Type: String · required

Else condition

ExpressionMatch

A single condition-result pair in an expression.

`if`

Type: String · required

If condition

`then`

Type: String · required

Then clause

Enums

PublicKeyKind

Value	Label
`openPgp`	OpenPGP
`smime`	S/MIME

HeaderProtection

Value	Label
`none`	None
`noConfidentiality`	Protected, headers visible
`baseline`	Protected, Subject hidden

Expression references

The following expression contexts are used by fields on this page: