Enigmail Help Information
This document provides some basic information on using Enigmail.
If you encounter unexpected problems, you should also check the
Troubleshooting page.
- Getting started
- Using Enigmail with GnuPG
- Using Enigmail on Windows
- Configuring Enigmail
- Using Enigmail when reading messages
- Using Enigmail when composing messages
- Tips
- Known problems and workarounds
Getting started
In order to use Enigmail, you need a recent version of the GNU Privacy Guard
(GnuPG).
If you are new to GnuPG (gpg) and/or Mozilla/Enigmail, we have
step by step instructions for installing
GnuPG on Windows, as well as a
Beginners Manual (PDF). Both give you a good introduction for setting
up GnuPG and using Mozilla/Enigmail.
- You need to restart the application after installation to start
using Enigmail. If you installed Enigmail as the root user
on Unix/Linux systems, your first restart should also be as root.
(Subsequent restarts do not require root privileges.)
- If the application crashes when launching
just after installing Enigmail, just restart it again. This problem
has to do with the XUL cache and usually just goes away after the
second or third restart. As a last resort, you may try deleting
in your user profile directory the file named XUL.mfasl (Unix)
or XUL.mfl (Windows), and the chrome directory, and
then re-launch the application.
- The gpg executable must reside in one of the directories
listed in the PATH environment variable.
- On Windows only, the following additional directories are also searched for
the executable (gpg.exe) file:
c:\gnupg;c:\gnupg\bin;d:\gnupg;d:\gnupg\bin
- If the GnuPG executable is in a non-standard directory, you should
specify its location using the Enigmail Preferences panel.
- To check if Enigmail has located the GnuPG executable and
is ready for use, go to the Enigmail menu of the mail window
and click on About Enigmail
- Configure the settings in both your Account and in Enigmail
> Preferences before attempting to send your first mail or the mail will
be sent unsigned and/or un-encrypted.
- To enable Enigmail for an account and set the signing/encryption
defaults:
- On Mozilla, use the Edit -> Mail & Newsgroups Account Settings
menu in the Mail & Newsgroups window.
- On Thunderbird, use the Tools -> Account Settings menu.
Select the OpenPGP Security menu item below the account you want
to configure.
- To set user preferences or to uninstall Enigmail,
use the Enigmail -> Preferences menu choice in the Mail &
Newsgroups/Thunderbird window. (The uninstall feature is yet to be enabled
on the Windows platform.)
- S/MIME: You should be able to use Enigmail along side with S/MIME (but not
both together for one message). If you do
not wish to use S/MIME, you can hide the S/MIME button (on Mozilla you need to use the
Enigmail Advanced Preferences panel. You will need to restart the application for this setting
to take effect.)
- We recommend that you select the OpenPGP key in the account settings. This
adds the option -u key-id to the GnuPG command line for the
account from which the message is being sent.
- Enigmail has the facility to create a logfile for debugging errors.
If you experience problems with Enigmail, enter a directory path (e.g.: /home/tmp,
c:\temp, etc.) in the Debugging tab of Preferences. The logfile can be
viewed by going to Enigmail -> View logfile.
- Enigmail creates a Decrypt button on the main Mail
window. It also creates Enigmail menus on the main Mail window
and the Mail/Compose window (see screenshots).
- In addition Enigmail creates pen and key icons in the status
bar of the Mail/Compose windows. These icons indicate what will be done to the
message (pen = sign, key = encrypt) and can be clicked on to change the
function of signing or encrypting for that message only.
These icons will also appear in the status bar of the Message Pane if reading a
signed or encrypted message to indicate if it was signed and/or encrypted.
- You can use the Enigmail menu in the Mail/Compose window to
generate keys, decrypt and verify messages, import keys, etc.
- There is a console to capture output from GnuPG. Choose
the Enigmail -> View Console menu option to view the output.
Using Enigmail with GnuPG
- By default, Enigmail enables the --always-trust option
for GnuPG to allow outgoing mail to be encrypted to any key, even untrusted
ones. If you would like to encrypt only to trusted keys, you should
disable this option in Preferences. (This setting does not affect
signature verification on received messages: you will always be warned if
the signing key is untrusted.)
Using Enigmail on Windows
- Enigmail no longer supports any version of PGP. Instead you should
use GnuPG (GPG). If you download the version of GnuPG from
www.nullify.org you will get a more
Windows-friendly compilation and on that site you will find links to
the Windows GUIs to make key management even more easy. The Nullify
build also supports hash algorithms greater than 160 bit (not OpenPGP
standard conform). Unfortunately, there still only is a somewhat ancient
version 1.2.3 from September 2003 on nullify.org; the current gnupg.org
version is 1.2.6, current Windows version is 1.2.5 from July 2004.
- If you're lost with setting up or using GnuPG, here are
step by step instructions for installing GnuPG.
Additionally, think about joining the
PGP-Basics group who
have some excellent online documents to help new users set up GnuPG on Windows.
There is also a
GnuPG Users group who offer friendly and knowledgeable support specifically
for GnuPG.
- If you want to switch from PGP to GnuPG, you can take over all your keys into GnuPG.
In order to do this, export your public keys and your private keys
from PGP as ASCII armored files. You can then import your keys in GnuPG
using the command gpg --import filename.asc.
Using Enigmail when reading messages
- Decrypt button in main Mail window
This button can be used for several purposes: decrypt, verify, or import
public keys. Normally decryption/verification happens automatically,
although this can be disabled through a preference. However, if this fails,
usually a short error message will appear in the Enigmail status line. If
you click the Decrypt button, you will be able to see a more detailed error
message, including the output from the GnuPG command.Pen and Key icons in Message Header display
The Pen and Key icons in the Message Header display indicate if
the message you are reading was signed and/or encrypted and if the signature is
good, i.e. the message has not been changed since it was signed. If the message
has been changed, the Pen icon will change to a Broken Pen to
indicate that the signature is bad. Right clicking on either the Pen or Key icons
will bring up a menu with the following options:
- OpenPGP Security info: allows you to view the output status from
GnuPG for the message.
- Copy OpenPGP Security info: copies the output status from GnuPG to the
clipboard; to paste into a reply message, etc.
- View OpenPGP Photo ID: allows you to view the Photo ID of the
person who sent the message, if they have a photo embedded in their Public Key.
(This option will only be enabled if a Photo ID exists in their key.)
- S/MIME Security info: allows you to view the S/MIME Security Info
for the message.
If you recieve an email with multiple public key blocks in it, Enigmail
will only import the first keyblock it finds. Should you need to import
multiple public key blocks, you will need to save each one as a separate
file and use GnuPG from the command line to import them into your keyring.
- Automatically retrieve keys from a keyserver
If you do not have keyserver-options auto-key-retrieve set in your
gpg.conf file and you read a message which is signed or encrypted,
you will see a Pen icon in the headers display area with a Question
mark on it, the Enigmail status line in the headers area will say Part
of the message signed; click pen icon for details and the message in the
Message Pane will show all the OpenPGP message block indicators and the signature
block.
You may also see this if you have keyserver-options auto-key-retrieve
set in your gpg.conf file and the OpenPGP key is not available on the default
keyserver.
Clicking on the Pen and Question mark icon will bring up a window
advising that the key is unavailable in your keyring. Clicking on OK will
bring up another window with a list of keyservers which you can select to
download the sender's public key from.
To configure the list of keyservers you wish to use, go to Enigmail ->
Preferences -> Basic tab and enter the keyserver addresses in the
Keyserver(s): box, separated by a comma. The first keyserver in the
list will be used as the default.
- Opening encrypted attachments / importing attached OpenPGP keys
Attachments named *.pgp, *.asc and *.gpg are recognized as attachments that
can be handled specially by Enigmail. Right clicking on such an attachment
enables two special menu items in the context menu: Decrypt and Open
and Decrypt and Save. Use these two menu items if you want Enigmail
to decrypt an attachment before opening or saving it. If an attachment is
recognized as a OpenPGP key file, you are offered to import the keys it into
your keyrings.
Using Enigmail when composing messages
Enigmail menu in Mail/Compose window
- Sign message: Enable/Disable sending signed mail. User is notified
if signing fails.
- Encrypt message: Enable/Disable encryption to all recipient(s) before
sending. User is notified if encryption fails.
If Display selection when necessary is set in Preferences
-> Key Selection tab, a list of keys will pop up if there are addresses
in the list of recipients for the message for whom you have no public key.
If Never display OpenPGP key selection dialog is set in Preferences
-> Key Selection tab, and there are addresses in the list of recipients for
the message for whom you have no public key, the message will be sent unencrypted.
- Use PGP/MIME for this message: Enable/Disable the use of
PGP/MIME
for this message.
- If you know the recipient(s) can read mail using the PGP/MIME format, you should use it.
- This feature is dependent on the settings in Preferences -> PGP/MIME tab
being set to Allow to use PGP/MIME or Always use PGP/MIME.
- Default composition options: Submenu
- Signing/Encryption Options...: shortcut to Account Settings -> OpenPGP Options.
- Send options...: shortcut to Preferences -> Send tab.
- Key selection options...: shortcut to Preferences -> Key Selection tab.
- PGP/MIME options...: shortcut to Preferences -> PGP/MIME tab.
- Undo encryption: If there is a failure when actually sending mail,
such as the POP server not accepting the request, Enigmail will not know
about it, and the encrypted message will continue to be displayed in the
Compose window. Choosing this menu item will undo the encryption/signing,
reverting the Compose window back to its original text.
As a temporary fix, this option may also be used to decrypt the quoted
text when replying to encrypted messages. Enigmail should automatically
decrypt the quoted message, but if that fails for some reason, you can use
this menu item to force it.
- Insert public key: insert ASCII-armored public key block at the
current cursor location in the Compose window. You will be prompted for the
email addresses of the key(s) to be inserted. Keys inserted in this manner
will automatically be recognized at the receiving end by Enigmail. After
key insertion, you may still choose to sign/encrypt the mail as
needed. Also, do not insert more than one key block in a message; just
specify multiple email addresses, separated by commas or spaces, when
prompted.
- Clear save passphrase: Clears cached passphrase. Useful if you
have multiple passphrases.
- Help: Displays Help information from the website (this page).
Tips
- How to change the HOMEDIR (where the keys are stored) in Windows?:
If you do not want to use the default directory c:\gnupg to store
your keys, you should enter a string with the directory path into the Windows
Registry under the key: \\HKEY_CURRENT_USER\Software\GNU\GnuPG\HomeDir
Note: Please use forward slashes and not the backslashes when setting filenames for
GnuPG into the Registry.
If you use a Key Manager such as
GPGshell or WinPT then these will
normally create any registry keys required to allow GnuPG to work correctly.
- Using Encrypt to self:
In order to encrypt an email, you choose public keys belonging to your recipients.
Your email message is then optionally signed then encrypted to those keys.
The Encrypt to self preference makes sure that your mail is not only encrypted
to your recipients' keys but to your own key as well. If you don't encrypt to your own
key when sending, you won't be able to read the encrypted mail after it's sent!
The key chosen for Encrypt to self be the one you set up for Enigmail to
use for the sending account or identity.
- Disable Allow flowed text (RFC 2646):
If you have trouble verifying signatures created using Enigmail,
or if you want to send ASCII art, you may want to disable the option
Allow flowed text (RFC 2646) in the Advanced Preferences panel.
Disabling this option also prevents the | symbol showing in quotes instead of
the more normal > symbol.
- Using BCC these email addresses:
If you use BCC these email addresses in Account Settings / Mail
& Newsgroups Account Settings -> Copies & Folders you must
ensure that you insert a fully qualified email address i.e. user@domain.tld
instead of just a local user name i.e. user otherwise you will get a warning
message "This message has BCC recipients..." when you click on send.
- How to transfer mail and settings to a new profile:
Although this is not exactly Enigmail-related, we have been asked how to
do this a few times, so we have put together this
new profile howto as a guide.
Known problems and workarounds
- Enigmail button icons do not line up with other icons:
Try changing your theme twice. If you are using the Modern theme, switch to the
Classic theme using the View > Apply Theme menu option, and quit Mozilla.
Restart, change back to the Modern theme and restart again.
- Using Enigmail with PGP:
Originally, Enigmail worked with some older command line versions of PGP.
But as the newer versions of PGP do not have a command line anymore, support
for PGP was dropped in favor of GnuPG.
- Enigmail and Debian Mozilla (older versions only):
The Debian Mozilla package use a patched version of Mozilla that is significantly
different from the standard Mozilla binaries available from
ftp.mozilla.org. This
can cause Debian Mozilla to crash when used with Enigmail. The solution is
to use the standard version of Mozilla, if at all possible. The alternative
would be for the Debian packagers to compile Enigmail along with the Debian
version of Mozilla.
(See Mozilla bug
133171 for more details on how Debian Mozilla differs from standard Mozilla)
- Mozilla integration:
With Mozilla Thunderbird moving a lot of the non-core functionality into
downloadable extensions, it is not very likely that OpenPGP would ever become
an integrated part of Mozilla. However, the internal interfaces of Mozilla might over
time be adapted to make it easier for Enigmail to integrate.
See mozilla bug
22687 for more information.