This page covers PGP encryption for an AliasFleet destination: the setup that encrypts forwarded mail for one destination inbox. PGP encryption for a destination encrypts each forwarded message with the destination public key before delivery, so only the holder of the matching private key can read it. Setup requires a Pro or Business plan, a verified destination, and a locally generated key pair, with decryption in the mail client.
Without destination encryption, forwarded mail moves between mail servers as ordinary email, and each server that handles it can read it. Destination PGP encryption changes the leg between AliasFleet and the destination inbox: encryption takes place at the gateway, before the message leaves AliasFleet, so the forwarded copy arrives encrypted.
PGP encryption requires a Pro or Business plan and a verified destination address. A PGP key pair must already exist, generated locally on a device under the account holder's control. AliasFleet never asks for the private key.
Encryption model#
The setup follows a zero-knowledge model: AliasFleet holds no secret that could decrypt the mail.
- A key pair is created on a local device, not on a server.
- The public key alone is added to the AliasFleet dashboard.
- As each forwarded email passes through, the mail engine encrypts it with that public key.
- Decryption takes place on a computer or phone that holds the private key.
Since the private key remains on the local device at all times, the encrypted mail stays unreadable to every other party, including AliasFleet.
Key pair generation#
Key generation happens before any dashboard step, using standard open source tools:
- GnuPG (GPG): a command line utility available for Windows, macOS, and Linux.
- GPG Suite (macOS) and Kleopatra (Windows): desktop key managers.
- Mail client tools: Mozilla Thunderbird has a built-in PGP key generator.
Once the pair exists, export the public key in armored form: a text block beginning with -----BEGIN PGP PUBLIC KEY BLOCK-----. That armored block is the only material pasted into AliasFleet. No private key material, and no export containing it, belongs in the dashboard.
Public key upload#
- Open Destinations: in the dashboard, go to Settings > Destinations.
- Open the destination: locate the verified destination address and click PGP Settings.
- Paste the public key: enter the armored PGP public key in the field provided.
- Check the validation result: AliasFleet validates the key, inspects its expiration date, and displays its fingerprint. Compare that fingerprint with the fingerprint shown by the tool that generated the key.
- Save: click Save PGP Settings. From that point, forwarded mail to the destination is encrypted with the stored public key.
The setting is per destination. A destination that needs encryption needs its own public key, added by repeating the same steps.
Encryption mode#
| Mode | What it encrypts | When to use it |
|---|---|---|
| PGP/MIME (recommended) | The complete message structure under RFC 3156, including HTML layout, embedded images, and attachments | The default choice, supported by most modern clients, including Thunderbird and Canary Mail |
| Inline PGP | The plain text body only | Only for a mail client without PGP/MIME support |
Inline PGP carries a visible cost: HTML in an inbound email is converted to plain text before encryption, so formatting is lost. PGP/MIME keeps the original structure intact.
Subject encryption#
Subject lines are unencrypted by default, because mail servers use them for routing. Subject encryption hides the subject in addition to the body:
- Enable the setting: turn Encrypt Subject on in the destination PGP settings.
- Set a replacement: enter a Subject Replacement, for example
[Secure Email]. - Check the result: the replacement subject shows in the inbox list and in transit, while the original subject travels inside the encrypted envelope.
An observer in transit sees only the replacement subject. The original subject is readable only after decryption, together with the message body.
Reading encrypted mail#
Decryption requires a mail client with PGP support, with the private key imported into that client:
- Mozilla Thunderbird: PGP support is built in; the private key is imported in the End-to-End Encryption settings.
- Apple Mail (macOS): used with the GPG Suite extension.
- Outlook (Windows): set up with Gpg4win.
- Mobile clients: Canary Mail, FairEmail, and K-9 Mail (with OpenKeychain on Android).
Without the private key imported into the client in use, encrypted mail arrives as an unreadable encrypted block instead of readable text. That outcome confirms encryption is active and indicates a client setup gap, not a delivery failure.
Verification#
Send a test message to an alias that forwards to the encrypted destination, then open the message in the destination inbox:
- The message should arrive as encrypted content, and the client should ask for the private key (or its passphrase) before displaying readable text.
- A message that opens as plain readable text, with no key step, shows encryption is not active for that destination. Recheck the destination PGP settings and confirm the message reached the encrypted destination rather than a second, unencrypted destination.
Troubleshooting#
Invalid or expired key. When key validation fails at upload, export the armored public key again from the key tool and inspect the key expiration date there. An expired key needs renewal or replacement in the key tool before a fresh upload.
Key replaced. Mail encrypted before a replacement still needs the old private key. Retain the old private key until that older mail is no longer needed, and check the new fingerprint after saving the replacement.
Client cannot decrypt. Check that the mail client supports the selected mode: a client without PGP/MIME support cannot read PGP/MIME mail, and a client without the private key imported cannot read mail in either mode. A switch to Inline PGP helps only where the client supports Inline PGP and the private key is imported.
Subject placeholder after opening. The placeholder is the expected inbox list view with Encrypt Subject on. The original subject shows only inside the decrypted message. If the decrypted message still carries the placeholder as its subject, check that Encrypt Subject was already enabled when that message was forwarded, since the setting covers only mail encrypted after it is switched on.
Related guides#
- WKD Auto-Encryption: encrypt outbound replies and new mail automatically, using the same destination key setup.
- Can Your Email Provider Read Your Emails?: why stored mail on most providers stays readable, and why encryption that keeps the private key off the server changes that position.