WKD Auto-Encryption for Replies & Sends

WKD auto-encryption encrypts outbound mail sent from an AliasFleet alias when a PGP public key exists for the recipient. This page covers the key discovery process, the per-destination enablement steps, the two encryption formats, and the header check that confirms an encrypted send.

Key discovery#

When mail is sent from an alias, or when a reply is sent to a message forwarded by AliasFleet, the mail gateway runs a key lookup in the background before sending. The lookup follows three steps:

1. WKD discovery query: The gateway hashes the local part of the recipient email address and queries the recipient domain Web Key Directory, for example https://openpgpkey.recipient-domain.com/.well-known/openpgpkey/....
2. Keyserver fallback: If the recipient domain hosts no WKD service, the gateway searches keys.openpgp.org as a backup.
3. Encryption or plain delivery: If a valid public key is found, the outbound email is encrypted before sending. If no key is found, the email is sent normally, unencrypted. A missing key does not abort a delivery attempt.

Enabling WKD auto-encryption#

WKD auto-encryption settings belong to verified destination addresses, because outbound mail originates from a real inbox. The enablement steps are:

1. Open Destinations: In the Dashboard, navigate to Settings > Destinations.
2. Open WKD Settings: Locate the destination and select WKD Settings (represented by the globe/lock icon).
3. Enable discovery: Switch Enable WKD Auto-Discovery to on.
4. Choose format and subject options: Select an encryption format and a subject-line option (see below).
5. Save: Select Save WKD Settings.

Encryption formats#

Two encryption formats are available. PGP/MIME is the recommended option for most recipients.

• PGP/MIME (recommended): Encrypts the entire email packet under RFC 3156. Attachments, embedded files, and rich HTML formatting stay encrypted. Modern secure mail clients support this format.
• Inline PGP: Encrypts only the text content of the email. This format suits recipients with older clients that do not support PGP/MIME formatting.

For subject-line privacy, turn Encrypt Subject on and add a Subject Replacement, for example [Encrypted Message]. Mail relays then see only the placeholder, and the recipient client restores the original subject line after decryption.

Verification#

Encrypted outbound mail carries the transport header X-AliasFleet-PGP: encrypted-wkd. Inspecting the headers of the sent message shows whether encryption applied. A present header means the message was encrypted with WKD. An absent header means no key was found and the message went out unencrypted.

Cases where encryption does not apply#

• Recipient has no key: The message is sent unencrypted and delivery is not aborted. Confirm that the recipient publishes a PGP key through WKD or a public keyserver before expecting encrypted delivery.
• Cached key is stale: Discovered keys are cached in memory for 1 hour, so a message sent inside that period uses the cached key. A changed recipient key is therefore picked up only once that period ends. This is a consequence of the documented cache period, not a separately verified refresh behaviour.
• Keyserver cannot be reached: The existing documentation states no separate retry behaviour for an unreachable keyserver. The header check above is the observable result: an absent X-AliasFleet-PGP header means the message was not encrypted with WKD.
• Private keys are never involved: Key discovery is an outbound, read-only query. AliasFleet does not generate, store, or transmit PGP private keys at any point.

This guide covers outbound encryption only. Inbound encryption of forwarded mail to an inbox is a separate feature; see the PGP Encryption Guide. For the wider point that an alias alone does not encrypt mail, see Are Email Aliases Safe?.