WKD Auto-Encryption for Replies & Sends

Asymmetric encryption is incredibly secure, but it has historically suffered from one major friction point: key distribution. If you wanted to send an encrypted email to a contact, you first had to manually ask for their PGP public key, verify their fingerprint, and save it in your keyring.

Web Key Directory (WKD) solves this distribution problem by allowing domains to securely publish their users' PGP public keys at a standard, predictable URL on their website.

For users on our Pro and Business plans, AliasFleet uses WKD to automatically discover your recipient's PGP public key and encrypt your outbound replies or sends on-the-fly—giving you hands-off, seamless security.

How WKD Auto-Discovery Works

When you send a new email from an alias, or reply to an email forwarded by AliasFleet, our gateway does the heavy lifting in the background:

1. WKD Discovery Query: Our mail engine hashes the local part of the recipient's email address and queries their domain's well-known directory (e.g., https://openpgpkey.recipient-domain.com/.well-known/openpgpkey/...).
2. Global Keyserver Fallback: If their domain doesn't host a WKD service, our engine automatically searches highly secure, verified global registries like keys.openpgp.org as a backup.
3. Smart Encryption: If a valid public key is found, we encrypt the outbound email before sending it. If no key is found, the email is sent normally (unencrypted). No delivery attempt is aborted.

Setting Up WKD Auto-Encryption

Since outbound emails originate from your real email inbox, WKD auto-encryption settings are tied directly to your verified destination addresses:

1. Go to your Dashboard and navigate to Settings > Destinations.
2. Locate your destination and click WKD Settings (represented by the globe/lock icon).
3. Switch Enable WKD Auto-Discovery to on.
4. Choose your encryption format and subject-line options (see below).
5. Click Save WKD Settings.

Outbound Encryption Preferences

We offer several options to tailor how your encrypted outbound emails are sent:

1. Encryption Mode

• PGP/MIME (Recommended): This encrypts the entire email packet (RFC 3156). Outgoing attachments, embedded files, and rich HTML formatting remain secure. This is supported by modern secure mail clients.
• Inline PGP: Only encrypts the text content of your email. Choose this if you're frequently emailing recipients with older clients that don't support modern PGP MIME formatting.

2. Subject Line Encryption

To protect your recipient's metadata as well as the email body:

• Turn Encrypt Subject on.
• Add a Subject Replacement (e.g., [Encrypted Message]).
• Mail relays will only see the placeholder, but once your recipient decrypts the email, their client will automatically restore your original subject line.

Behind the Scenes

• High Performance Caching: To prevent outbound mail delays, we cache discovered public keys in memory for 1 hour. We won't keep hitting your recipient's domain for consecutive messages.
• Zero Transmission of Private Keys: Key discovery is an outbound, read-only query. At no point do we generate, store, or transmit PGP private keys.
• Delivery Verification: All successfully encrypted outbound emails will contain the transport header X-AliasFleet-PGP: encrypted-wkd so you can verify the secure transmission.

Want to learn how to encrypt incoming forwarded emails to your inbox? Take a look at our PGP Encryption Guide.