hmLoadTopic({
hmKeywords:"Decryption,Encryption,Keys,Keys Encryption,Keys Private,Keys Public,MDPGP,OpenPGP,PGP,Private keys,Public keys",
hmTitle:"MDPGP",
hmDescription:"OpenPGP is an industry standard protocol for exchanging encrypted data, and there are a variety of OpenPGP plugins for email clients that make it possible for users to send and...",
hmPrevLink:"dynamic-screening_domain-nat-exemptions.html",
hmNextLink:"sp_outbreak_protection.html",
hmParentLink:"security_menu.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a>",
hmTitlePath:"Security Menu > MDPGP",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">MDPGP<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:39.1250rem;height:31.3125rem;border:none\" src=\".\/images\/mdpgp.png\"\/><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">OpenPGP is an industry standard protocol for exchanging encrypted data, and there are a variety of OpenPGP plugins for email clients that make it possible for users to send and receive encrypted messages. MDPGP is MDaemon\'s integrated OpenPGP component that can provide encryption, decryption, and basic key management services for your users without requiring them to use an email client plugin.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">MDPGP encrypts and decrypts emails using a public-key\/private-key system. To do this, when you wish to use MDPGP to send a private and secure message to someone, MDPGP will encrypt that message using a &quot;key&quot; that you previously obtained from that person (i.e. his &quot;public key&quot;) and imported into MDPGP. Conversely, if he wishes to send a private message to you, then he must encrypt the message using your public key, which he obtained from you. Giving the sender your public key is absolutely necessary, because without it he can\'t send you an OpenPGP encrypted message. Your unique public key must be used to encrypt the message because your unique private key is what MDPGP will use to decrypt the message when it arrives.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">In order for MDPGP to manage signing, encrypting, and decrypting messages, it maintains two stores of keys (i.e. keyrings)—one for public keys and one for private keys. MDPGP can generate your users\' keys automatically as needed, or you can create them manually for specific users. You can also import keys that were created elsewhere. Further, MDaemon can look for public keys attached to authenticated messages from local users, and then import those keys automatically. That way a user can request a public key from someone and then email that key to himself so that MDPGP will detect it and then import it into the public keyring. MDPGP will never store multiple copies of the same key, but there can be multiple different keys for a single address. Finally, whenever a message arrives for an address that has a key in a keyring, MDPGP will sign, encrypt, or decrypt the message as needed, according to your settings. If an address has multiple keys, MDPGP will use the one you have designated as the preferred key to encrypt the message. If no preferred key has been designated then MDPGP will use the first one. When decrypting a message MDaemon will try each one.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">You can configure MDPGP\'s signing and encryption services to operate either automatically or manually. When set to operate automatically, MDPGP will automatically sign and encrypt messages whenever possible. When set to operate manually, MDPGP will only sign or encrypt a message when the sending user inserts a special command into the message\'s Subject. In any case messages will only be signed or encrypted (or decrypted) when the account has been given permission to use those services.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">The OpenPGP specification is outlined in RFCs <a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc4880\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-4880\">4880<\/a> and <a href=\"https:\/\/datatracker.ietf.org\/doc\/rfc3156\/\" target=\"_blank\" class=\"weblink\" title=\"RFC-4880\">3156<\/a>.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Enabling MDPGP<\/span><\/h2>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable MDPGP<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">MDPGP is enabled by default, but it will still not sign, encrypt, or decrypt any messages until you create or import keys into its keyrings, or until you use the option below to set MDPGP to <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Create keys automatically<\/span><span class=\"f_ControlIndent\">.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Enable encryption &amp; signing services<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">By default messages can be signed and encrypted when the required keys are in the keyring. Disable this option if you do not wish to allow MDPGP to sign or encrypt messages.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Messages can be signed without being encrypted, but any message that is encrypted by MDPGP will always be signed as well.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Enable decryption &amp; verification services<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">By default incoming encrypted messages will be decrypted if the recipient\'s private key is known. Further, MDPGP will also verify embedded signatures in unencrypted messages. Note, however, that both the recipient and sender must be authorized to use the decryption and verification services, either through the &quot;<\/span><span class=\"f_ControlIndent2\" style=\"font-style: italic;\">Authorize all...<\/span><span class=\"f_ControlIndent2\">&quot; options or &quot;<\/span><span class=\"f_ControlIndent2\" style=\"font-style: italic;\">Configure exactly who...<\/span><span class=\"f_ControlIndent2\">&quot; option below (everyone is authorized by default). Disable this option if you do not wish to verify embedded signatures or allow MDPGP to decrypt any messages, for example if you want all of your users to handle their own decryption via an email client plugin. When disabled, any incoming encrypted message will be handled like a normal message and placed in the recipient\'s mailbox.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Collect public-keys from DNS (pka1) and cache for [xx] hours<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you want MDPGP to query for message recipient public-keys over DNS using PKA1. This is useful because it automates the process of obtaining some recipients\' public keys, preventing you or your users from having to obtain and import them manually in order to send encrypted messages. When PKA1 queries are made, any key URI found is immediately collected, validated, and added to the key-ring. Keys successfully collected and imported to the key-ring using this method are tracked in a file called <\/span><span class=\"f_PlainText\">fetchedkeys.txt<\/span><span class=\"f_ControlIndent\">, and these keys will automatically expire after the number of hours specified in this option or according to the TTL value of the PKA1 record that referred them, whichever value is greater. Therefore the value specified here is the minimum length of time that a key will be cached. The default value is 12 hours and the lowest value allowed is 1 hour.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">If you wish to publish your own public-keys to DNS then you must create special TXT records. For example, for the user <\/span><span class=\"f_PlainText\">frank@example.com<\/span><span class=\"f_Notes\"> with the key-id: <\/span><span class=\"f_PlainText\">0A2B3C4D5E6F7G8H<\/span><span class=\"f_Notes\">, in the DNS for domain &quot;<\/span><span class=\"f_PlainText\">example.com<\/span><span class=\"f_Notes\">&quot; you would create a <\/span><span class=\"f_PlainText\">TXT<\/span><span class=\"f_Notes\"> record at &quot;<\/span><span class=\"f_PlainText\">frank._pka.example.com<\/span><span class=\"f_Notes\">&quot; (replacing the <\/span><span class=\"f_PlainText\">@<\/span><span class=\"f_Notes\"> in the email address with the string &quot;<\/span><span class=\"f_PlainText\">._pka.<\/span><span class=\"f_Notes\">&quot;). The data for the <\/span><span class=\"f_PlainText\">TXT<\/span><span class=\"f_Notes\"> record would look something like this: &quot;<\/span><span class=\"f_PlainText\">v=pka1;<\/span><span class=\"f_Notes\"> <\/span><span class=\"f_PlainText\">fpr=&lt;key\'s full fingerprint&gt;; uri=&lt;Webmail-URL&gt;\/WorldClient.dll?view=mdpgp&amp;k=0A2B3C4D5E6F7G8H<\/span><span class=\"f_Notes\">&quot; where <\/span><span class=\"f_PlainText\">&lt;key\'s full fingerprint&gt;<\/span><span class=\"f_Notes\"> is the full fingerprint of the key (40 characters long representing the full 20 byte fingerprint value). You can see a key\'s full fingerprint value by double clicking on the key in the MDPGP GUI. <\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Trade public-keys using HTTP (Webmail)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish to use Webmail as a basic public-key server; Webmail will honor requests for your users\' public-keys. The format of the URL to make the request looks like this: &quot;<\/span><span class=\"f_PlainText\">http:\/\/&lt;Webmail-URL&gt;\/WorldClient.dll?View=MDPGP&amp;k=&lt;Key-ID&gt;<\/span><span class=\"f_ControlIndent\">&quot;. Where <\/span><span class=\"f_PlainText\">&lt;Webmail-URL&gt;<\/span><span class=\"f_ControlIndent\"> is the path to your Webmail server (for example, &quot;<\/span><span class=\"f_PlainText\">http:\/\/wc.example.com<\/span><span class=\"f_ControlIndent\">&quot;) and <\/span><span class=\"f_PlainText\">&lt;Key-ID&gt;<\/span><span class=\"f_ControlIndent\"> is the sixteen character key-id of the key you want (for example, &quot;<\/span><span class=\"f_PlainText\">0A1B3C4D5E6F7G8H<\/span><span class=\"f_ControlIndent\">&quot;). &nbsp;The key-id is constructed from the last 8 bytes of the key fingerprint - 16 characters in total.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Trade public-keys during SMTP mail sessions (MDaemon)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Check this box if you wish to enable the automatic transmission of public keys as part of the SMTP message delivery process. To do so, MDaemon\'s SMTP server will honor an SMTP command called RKEY. When sending an email to a server that supports RKEY, MDaemon will offer to transmit the sender\'s current, Preferred public-key to the other host. That host will respond indicating that it either already has that key (&quot;250 2.7.0 Key already known&quot;) or that it needs that key, in which case the key is immediately transferred in ASCII armored form (&quot;354 Enter key, end with CRLF.CRLF&quot;) just like an email message. Keys that are expired or revoked are never transmitted. If MDaemon has multiple keys for the sender it will always send the key that is currently marked as preferred. If no key is preferred then the first one found is sent. If no valid keys are available then nothing is done. Only public-keys that belong to local users are offered.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Public-key transfers happen as part of the SMTP mail session that delivers the message from the user. In order for the public-keys transmitted in this way to be accepted, the public-key must be sent along with a message that has been <a href=\"security--dkim_sign.html\" class=\"topiclink\">DKIM signed<\/a> by the domain of the key owner with the i= set to the address of the key owner, which also must exactly match the From: header address of which there can be only one. The &quot;key owner&quot; is taken from within the key itself. Also, the message must arrive from a host in the sender\'s <a href=\"security--spf__sender_id.html\" class=\"topiclink\">SPF path<\/a>. Finally, the key owner (or his entire domain via use of wildcards) must be authorized for RKEY by adding an appropriate entry to the MDPGP rules file (instructions are in the rules file for this) indicating that the domain can be trusted for key exchange. All this checking is done automatically for you but you must have <a href=\"security--domainkeys_identified_mail.html\" class=\"topiclink\">DKIM<\/a> and <a href=\"security--spf__sender_id.html\" class=\"topiclink\">SPF verification<\/a> enabled or no work can be done.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">The MDPGP log shows the results and details of all keys imported or deleted, and the SMTP session log also tracks this activity. This process tracks the deletion of existing keys and the selection of new preferred keys and updates all participating servers it sends mail to when these things change.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Authorize all local MDaemon users for all services<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default all local MDaemon user accounts are authorized to use any of the MDPGP services that you have enabled: signing, encryption, decryption, and verification. If there are specific users whom you do not wish to allow to use one or more of those services, you can use the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Configure exactly who can and can not use MDPGP services<\/span><span class=\"f_ControlIndent\">&quot; option below to exclude them. Disable this option if you only wish to authorize specific local users. In that case use the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Configure exactly who can and can not use MDPGP services<\/span><span class=\"f_ControlIndent\">&quot; option below to grant access to whomever you choose.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Authorize all non-local (foreign) users for decrypt\/verify services<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default any incoming encrypted message for a local recipient from a non-local sender can be decrypted if MDPGP knows the local recipient\'s private key. Similarly, MDPGP will verify embedded signatures in incoming messages from non-local users. If there are certain non-local senders whose messages you do not wish to decrypt or verify, then you can use the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Configure exactly who can and can not use MDPGP services<\/span><span class=\"f_ControlIndent\">&quot; option below to restrict those senders from those services. Disable this option if you do not wish to decrypt messages or verify embedded signatures when the sender is a non-local address. In that case you can still use the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Configure exactly who can and can not use MDPGP services<\/span><span class=\"f_ControlIndent\">&quot; option below to specify exceptions to that restriction.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Configure exactly who can and can not use MDPGP services<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to open the <\/span><span class=\"f_PlainText\">rules.txt<\/span><span class=\"f_ControlIndent\"> file for configuring user permissions for MDPGP. Using this file you can specify who is allowed to sign messages, encrypt messages, and have messages decrypted. You can also specifically restrict users from these options. For example, you could use the rule &quot;<\/span><span class=\"f_PlainText\">+*@example.com<\/span><span class=\"f_ControlIndent\">&quot; to allow all <\/span><span class=\"f_PlainText\">example.com<\/span><span class=\"f_ControlIndent\"> users to encrypt messages, but then add &quot;<\/span><span class=\"f_PlainText\">-frank@example.com<\/span><span class=\"f_ControlIndent\">&quot; to specifically prevent <\/span><span class=\"f_PlainText\">frank@example.com<\/span><span class=\"f_ControlIndent\"> from being able to do so. See the text at the top of the <\/span><span class=\"f_PlainText\">rules.txt<\/span><span class=\"f_ControlIndent\"> file for examples and instructions.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Rules.txt Notes and Syntax<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Only SMTP authenticated email from users of this MDaemon server are eligible for encryption service. You can, however, specify non-local addresses that you wish restrict from the encryption service, meaning that MDPGP will <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">not<\/span><span class=\"f_List12\"> encrypt messages to them, even if the public key is known.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">If there is a conflict between the settings in <\/span><span class=\"f_PlainText\">rules.txt<\/span><span class=\"f_List12\"> and the global &quot;<\/span><span class=\"f_List12\" style=\"font-style: italic;\">Authorize all local MDaemon users for all services<\/span><span class=\"f_List12\">&quot; option, the <\/span><span class=\"f_PlainText\">rules.txt<\/span><span class=\"f_List12\"> setting is used.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">If there is a conflict between the settings in <\/span><span class=\"f_PlainText\">rules.txt<\/span><span class=\"f_List12\"> and the global &quot;<\/span><span class=\"f_List12\" style=\"font-style: italic;\">Authorize all non-local (foreign) users for decrypt\/verify services<\/span><span class=\"f_List12\">&quot; option, the <\/span><span class=\"f_PlainText\">rules.txt<\/span><span class=\"f_List12\"> setting is used.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Text after # on a line is ignored.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Separate multiple email addresses on the same line with a space.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Wildcards (* and ?) in email addresses are permitted.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Even though MDPGP encrypted messages are <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">always<\/span><span class=\"f_List12\"> signed, granting encryption permission to a user doesn\'t also grant that user permission to sign unencrypted messages. In order to sign an unencrypted message the account must be given signing permission.<\/span><\/p>\n\r<p class=\"p_List12_LastItem\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12_LastItem\">Each email address must be prefixed with one of the following tags:<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_List2\" style=\"font-weight: bold;\">+<\/span><span class=\"f_List2\"> (plus) - address can use MDPGP encryption service.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_List2\" style=\"font-weight: bold;\">-<\/span><span class=\"f_List2\"> (minus) - address <\/span><span class=\"f_List2\" style=\"font-weight: bold;\">cannot<\/span><span class=\"f_List2\"> use MDPGP encryption service.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_List2\" style=\"font-weight: bold;\">!<\/span><span class=\"f_List2\"> (exclamation) - address can use MDPGP decryption service.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_List2\" style=\"font-weight: bold;\">~<\/span><span class=\"f_List2\"> (tilde) - address <\/span><span class=\"f_List2\" style=\"font-weight: bold;\">cannot<\/span><span class=\"f_List2\"> use MDPGP decryption service.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_List2\" style=\"font-weight: bold;\">^<\/span><span class=\"f_List2\"> (caret) - address can use MDPGP signing service.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_List2\" style=\"font-weight: bold;\">=<\/span><span class=\"f_List2\"> (equal) - address <\/span><span class=\"f_List2\" style=\"font-weight: bold;\">cannot<\/span><span class=\"f_List2\"> use MDPGP signing service.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_List2\">\$ (dollar) - address can use MDPGP verification service.<\/span><\/p>\n\r<p class=\"p_List2_LastItem\"><span class=\"f_List2_LastItem\">&amp; (ampersand)<\/span><span class=\"f_List2\"> - <\/span><span class=\"f_List2_LastItem\">address <\/span><span class=\"f_List2_LastItem\" style=\"font-weight: bold;\">cannot<\/span><span class=\"f_List2_LastItem\"> use MDPGP verification service.<\/span><\/p>\n\r<p class=\"p_List12\"><span class=\"f_List12\">Examples:<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_PlainText\">+*@*<\/span><span class=\"f_List2\"> — all users of all domains can encrypt.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_PlainText\">!*@*<\/span><span class=\"f_List2\"> — all users of all domains can decrypt.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_PlainText\">^*@*<\/span><span class=\"f_List2\"> — all users of all domains can sign.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_PlainText\">^*@example.com<\/span><span class=\"f_List2\"> — all users of example.com can sign.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_PlainText\">+frank@example.com ~frank@example.com<\/span><span class=\"f_List2\"> — the user can encrypt but not decrypt.<\/span><\/p>\n\r<p class=\"p_List2\"><span class=\"f_PlainText\">+GROUP:EncryptingUsers<\/span><span class=\"f_List2\"> — members of MDaemon\'s <\/span><span class=\"f_PlainText\">EncryptingUsers<\/span><span class=\"f_List2\"> group can encrypt<\/span><\/p>\n\r<p class=\"p_List2_LastItem\"><span class=\"f_PlainText\">^GROUP:Signers<\/span><span class=\"f_List2_LastItem\"> — members of MDaemon\'s <\/span><span class=\"f_PlainText\">Signers<\/span><span class=\"f_List2_LastItem\"> group can sign<\/span><\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Encryption\/Signing Modes<\/span><\/h2>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\">Automatic Mode<\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Use the Settings options to configure MDPGP to sign and encrypt messages automatically for accounts permitted to do so. When an account sends an authenticated message and MDPGP knows the required key, the message will be signed or encrypted according to the settings below.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">The special Subject codes outlined in the Manual Mode section below always take precedence over the Automatic Mode options. Therefore if one of these options is disabled, an account that is permitted to sign or encrypt messages can still manually cause a message to be signed or encrypted by using one of the codes.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Settings<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Encrypt mail automatically if recipient\'s public key is known<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default, if an account is allowed to encrypt messages, MDPGP will encrypt them automatically if the recipient\'s public key is known. Disable this option if you do not wish to encrypt them automatically; messages can still be encrypted manually by using the special codes outlined in the Manual Mode section below.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Sign mail automatically if sender\'s private key is known<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this option if you want MDPGP to sign messages automatically when the sending account\'s private key is known, if the account is allowed to sign messages. Even when this option is disabled, messages can still be signed manually by using the special codes outlined in the Manual Mode section below.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Encrypt\/Sign mail between users of the same domain<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">When MDPGP is set to encrypt or sign messages automatically, this option causes MDPGP to do this even when messages are sent between users of the same domain, provided the required keys are known. This option is enabled by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Encrypt\/Sign mail between users of local MDaemon domains<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">When MDPGP is set to encrypt or sign messages automatically, this option causes MDPGP to do this even when messages are being sent between users of local MDaemon domains, provided the required keys are known. For example, if your MDaemon domains include &quot;example.com&quot; and &quot;example.net,&quot; then messages sent between those domains\' users will be automatically encrypted or signed. This option is enabled by default. <\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Encrypt\/Sign mail sent to self<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">When MDPGP is set to encrypt or sign messages automatically, this will be done even when the MDaemon user is sending a message to himself (e.g. frank@example.com sending to frank@example.com). Therefore if the account has permission to use both encryption and decryption (the default settings) then MDPGP will accept the user\'s message, encrypt it, and then immediately decrypt it and place it in the same user\'s mailbox. If, however, the account isn\'t configured for decryption, this will cause the message to be encrypted and then placed in the same user\'s mailbox still encrypted. This option is enabled by default.<\/span><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\">Manual Mode<\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">When you have disabled the <\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Sign mail automatically...<\/span><span class=\"f_BodyText\"> and <\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Encrypt mail automatically...<\/span><span class=\"f_BodyText\"> options outlined above, you are using MDPGP in Manual Mode. MDPGP will not sign or encrypt any messages except those that are authenticated and have one of the following codes in the message\'s Subject header:<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0.6250rem 0.7500rem 0.6250rem;\"><table style=\"width:40.6250rem; border:none; border-spacing:0.1250rem;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:8.6875rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\" style=\"text-align: right;\"><span class=\"f_BodyText\" style=\"font-weight: bold;\">--pgps<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:31.3125rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\"><span class=\"f_BodyText\">Sign this message if possible. Code can be placed at the beginning or end of the Subject.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:8.6875rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\" style=\"text-align: right;\"><span class=\"f_BodyText\" style=\"font-weight: bold;\">--pgpe<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:31.3125rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\"><span class=\"f_BodyText\">Encrypt this message if possible. Code can be placed at the beginning or end of the Subject.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:8.6875rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\" style=\"text-align: right;\"><span class=\"f_BodyText\" style=\"font-weight: bold;\">--pgpx<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:31.3125rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\"><span class=\"f_BodyText\">The message <\/span><span class=\"f_BodyText\" style=\"font-weight: bold;\">MUST<\/span><span class=\"f_BodyText\"> be encrypted. If it cannot be encrypted (e.g. because the recipient\'s key isn\'t known) then do not deliver it; the message will be bounced\/returned to the sender. Code can be placed at the beginning or end of the Subject.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:8.6875rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\" style=\"text-align: right;\"><span class=\"f_BodyText\" style=\"font-weight: bold;\">--pgpk<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:31.3125rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\"><span class=\"f_BodyText\">Send me my public key. The user places this code at the beginning of the Subject and sends the message to himself. MDPGP will then email the user his public key.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr>\n\r<td style=\"vertical-align:top; width:8.6875rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\" style=\"text-align: right;\"><span class=\"f_BodyText\" style=\"font-weight: bold;\">--pgpk&lt;Email&gt;<\/span><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; width:31.3125rem; padding:0.0625rem; border:none\"><p class=\"p_BodyText\"><span class=\"f_BodyText\">Send me this address\' public key. The user places this code at the beginning of the Subject and sends the message to himself. MDPGP will then email the user the address\' public key.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Example:<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_PlainText\">Subject: --pgpk&lt;frank@example.com&gt;<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\">Key Management<\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Public and private keys are managed using the options on the bottom half of the MDPGP dialog. There is an entry for each key, and you can right-click any entry to export the key, delete it, enable\/disable it, set it as a Preferred Key (see &quot;<\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Trade public-keys during SMTP mail sessions<\/span><span class=\"f_BodyText\">&quot; above), or set it as a Domain\'s Key (see below). When you click <\/span><span class=\"f_BodyText\" style=\"font-weight: bold;\">Export Key<\/span><span class=\"f_BodyText\"> it will be saved to the <\/span><span class=\"f_PlainText\">\\MDaemon\\Pem\\_mdpgp\\exports\\<\/span><span class=\"f_BodyText\"> folder and you can optionally email the public key to an email address. &quot;Show Local\/Remote&quot; and &quot;Filter&quot; options are provided to help you locate certain addresses or groups.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Using a Domain Key<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Optionally you can use a single key to encrypt all messages going to a specific domain, regardless of the sender. This is useful if, for example, one of your domains and a domain hosted elsewhere wish to encrypt all emails sent between them, but they do not wish to setup and manage individual encryption keys for every user account within the domain. There are multiple ways to accomplish this:<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">If you already have a public key for another domain and you wish to use that key for encrypting all outbound messages going to it, right-click the key and click <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">Set as Domain\'s Key<\/span><span class=\"f_List12\">. Then enter the domain name and click <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">OK<\/span><span class=\"f_List12\">. This will create a Content Filter rule to cause all messages &quot;To:&quot; that domain to be encrypted using the designated key.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">If the domain\'s public key has been provided to you but isn\'t yet in the list, click <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">Import Domain\'s Key<\/span><span class=\"f_List12\">, enter the domain name and click OK, then navigate to the domain\'s <\/span><span class=\"f_PlainText\">public.asc<\/span><span class=\"f_List12\"> file and click <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">Open<\/span><span class=\"f_List12\">. This also will create the Content Filter rule for encrypting messages to the domain.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12\">Customize your Content Filter rules as needed to modify exactly which messages get encrypted before sending to the domains.<\/span><\/p>\n\r<p class=\"p_List12_LastItem\" style=\"text-indent: 0; padding-left: 1.0000rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:1.0000rem;margin-left:-1.0000rem\">&#8226;<\/span><span class=\"f_List12_LastItem\">To create a new key for one of your domains, to give to another domain for encrypting messages being sent to you, follow the instructions under the &quot;<\/span><span class=\"f_List12_LastItem\" style=\"font-style: italic;\">Create keys for a specific user<\/span><span class=\"f_List12_LastItem\">&quot; option below, selecting &quot;<\/span><span class=\"f_PlainText\">_Domain Key (domain.tld)_ &lt;anybody@domain.tld&gt;<\/span><span class=\"f_List12_LastItem\">&quot; from the list. <\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Do not use a key to encrypt outbound messages for which you also have the corresponding private key. If you do, MDPGP will encrypt a message and then immediately see that the decryption key is known and promptly decrypt that very same message.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Email details of encryption failures to sender (--pgpe command)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When someone uses the --pgpe command to send encrypted mail and that encryption fails (for example, because no encryption key is found), then this option will cause a notification email to be sent back to the sender informing him or her of the failure. This option is disabled by default, meaning no failure notification message will be sent.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Email public-keys<\/span><span class=\"f_ControlHeading\"> when mail sent to self (--pgpk command)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When a user sends an email to himself with &quot;<\/span><span class=\"f_PlainText\">--pgpk&lt;email address&gt;<\/span><span class=\"f_ControlIndent\">&quot; as the subject (e.g. <\/span><span class=\"f_PlainText\">--pgpk&lt;frank@example.com&gt;<\/span><span class=\"f_ControlIndent\">). If a public-key for &lt;email address&gt; exists it will be emailed back to the requester.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Auto-import public-keys sent from authenticated users<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default, when an authenticated user sends an email message with a public key in <\/span><span class=\"f_BodyText\">ASCII armored format <\/span><span class=\"f_ControlIndent\">attached, MDPGP will import that public key into the keyring. This is a simple way for a user to get a contact\'s public key into MDPGP, by emailing the public key to himself as an attachment. Disable this option if you do not wish to auto-import public keys.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Create keys automatically<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you want MDPGP to create a public\/private key pair automatically for each MDaemon user. Rather than generate them all at once, however, MDPGP will create them over time, creating each user\'s key pair the next time a message is processed for that user. This option is disabled by default to conserve resources and avoid needlessly generating keys for accounts that may never use MDPGP.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Key size<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to specify the key size for keys that MDPGP generates. You can set the key size to 1024, 2048, or 4096. The default setting is 2048 bit keys.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Expires in [xx] days (0=never)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option to specify the number of days from creation date that a key generated by MDPGP will be valid before it expires. Set the option to &quot;0&quot; if you do not want keys to expire. The default setting is 0.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Create keys for a specific user<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">To manually generate a key pair for an account:<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.2500rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"display:inline-block;width:1.2500rem;margin-left:-1.2500rem\">1.<\/span><span class=\"f_List12\">Click <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">Create keys for a specific user<\/span><span class=\"f_List12\">.<\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.2500rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"display:inline-block;width:1.2500rem;margin-left:-1.2500rem\">2.<\/span><span class=\"f_List12\">Select the account from the drop-down list.<\/span><span class=\"f_List12\"> If you wish to create a single key to apply to all of a domain\'s accounts, choose the &quot;<\/span><span class=\"f_PlainText\">_Domain Key (domain.tld)_ &lt;anybody@domain.tld&gt;<\/span><span class=\"f_List12\">&quot; option from the list. <\/span><\/p>\n\r<p class=\"p_List12\" style=\"text-indent: 0; padding-left: 1.2500rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"display:inline-block;width:1.2500rem;margin-left:-1.2500rem\">3.<\/span><span class=\"f_List12\" style=\"font-weight: bold;\">Optional:<\/span><span class=\"f_List12\"> Check the box <\/span><span class=\"f_List12\" style=\"font-weight: bold;\">Email public key to key owner...<\/span><span class=\"f_List12\"> if you wish to send the key to the user as an email attachment.<\/span><\/p>\n\r<p class=\"p_List12_LastItem\" style=\"text-indent: 0; padding-left: 1.2500rem; margin-left: 3.6250rem;\"><span class=\"f_List12\" style=\"display:inline-block;width:1.2500rem;margin-left:-1.2500rem\">4.<\/span><span class=\"f_List12_LastItem\">Click <\/span><span class=\"f_List12_LastItem\" style=\"font-weight: bold;\">Ok<\/span><span class=\"f_List12_LastItem\">.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><img style=\"margin:0;width:31.4375rem;height:22.8125rem;border:none\" src=\".\/images\/mdpgp_create-keys.png\"\/><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Encrypt outbound mail based on receiving IP<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If you wish to use a specific encryption key to encrypt all messages destined for a certain IP address, enable this option and click <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">Setup<\/span><span class=\"f_ControlIndent\"> to open the MDaemon Message Transport Encryption file, in which you can list the IP address and associated key ID. Any outbound SMTP session delivering a message to one of the listed IPs will encrypt the message using the associated key just prior to transmission. If the message is already encrypted by some other key then this step will be skipped.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Import keys<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If you wish to import a key file into MDPGP manually, click this button, locate the key file, and click <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">Open<\/span><span class=\"f_ControlIndent\">. When importing a private key file, you do not need to import the corresponding public key, as it is included in the private key. If you are importing a private key protected by a passphrase then MDPGP will prompt you to enter the passphrase. Without the passphrase you cannot import the private key. After importing a private key, MDaemon will change that key\'s passphrase to whichever passphrase MDPGP is currently using.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Import Domain\'s key<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If a public encryption key has been provided to you to encrypt all messages being sent to a certain domain, click this button, enter the domain name, click <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">OK<\/span><span class=\"f_ControlIndent\">, and then navigate the domain\'s <\/span><span class=\"f_PlainText\">public.asc<\/span><span class=\"f_ControlIndent\"> file and click <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">Open<\/span><span class=\"f_ControlIndent\">. This will add the domain\'s public key to the list and create a Content Filter rule to encrypt all outbound messages for that domain, regardless of the sender.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Change passphrase<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Private keys are protected at all times by a passphrase. When attempting to import a private key, you must enter its passphrase. When exporting a private key, that exported key will still be protected by the passphrase, and it cannot be used or imported elsewhere without it. MDPGP\'s default passphrase is <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">MDaemon<\/span><span class=\"f_ControlIndent\">. For security reasons you should change this passphrase after you begin using MDPGP, because until you do so, every key created by or successfully imported into MDPGP will have its passphrase set (or changed) to <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">MDaemon<\/span><span class=\"f_ControlIndent\">. You can change the passphrase at any time by clicking <\/span><span class=\"f_ControlIndent\" style=\"font-weight: bold;\">Change passphrase<\/span><span class=\"f_ControlIndent\"> on the MDPGP screen. When you change the passphrase, every private key on the keyring is updated to the new passphrase.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Backup data files<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to make a backup of your current <\/span><span class=\"f_PlainText\">Keyring.private<\/span><span class=\"f_ControlIndent\"> and <\/span><span class=\"f_PlainText\">Keyring.public<\/span><span class=\"f_ControlIndent\"> keyring files. By default the backup files will be copied to: &quot;<\/span><span class=\"f_PlainText\">\\MDaemon\\Pem\\_mdpgp\\backups<\/span><span class=\"f_ControlIndent\">&quot; and have a date and <\/span><span class=\"f_PlainText\">.bak<\/span><span class=\"f_ControlIndent\"> extension appended to the filenames.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">&nbsp;<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\" style=\"text-indent: 0; padding-left: 0.8125rem; margin-left: 0;\"><span class=\"f_Notes\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">&#8226;<\/span><span class=\"f_Notes\">Forwarded messages are not encrypted.<\/span><\/p>\n\r<p class=\"p_Notes\" style=\"text-indent: 0; padding-left: 0.8125rem; margin-left: 0;\"><span class=\"f_Notes\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">&#8226;<\/span><span class=\"f_Notes\">Autoresponder messages are not encrypted.<\/span><\/p>\n\r<p class=\"p_Notes\" style=\"text-indent: 0; padding-left: 0.8125rem; margin-left: 0;\"><span class=\"f_Notes\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">&#8226;<\/span><span class=\"f_Notes\">Key servers and key revocation are not supported, except as outlined in the &quot;<\/span><span class=\"f_Notes\" style=\"font-style: italic;\">Collect public-keys from DNS (pka1) and cache for [xx] hours<\/span><span class=\"f_Notes\">&quot; and &quot;<\/span><span class=\"f_Notes\" style=\"font-style: italic;\">Send public-keys over HTTP (Webmail)<\/span><span class=\"f_Notes\">&quot; options above.<\/span><\/p>\n\r<p class=\"p_Notes\" style=\"text-indent: 0; padding-left: 0.8125rem; margin-left: 0;\"><span class=\"f_Notes\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">&#8226;<\/span><span class=\"f_Notes\">The Content Filter encrypt action does not act on messages already encrypted, and the encrypt and decrypt actions are subject to all MDPGP configuration requirements.<\/span><\/p>\n\r<p class=\"p_Notes\" style=\"text-indent: 0; padding-left: 0.8125rem; margin-left: 0;\"><span class=\"f_Notes\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">&#8226;<\/span><span class=\"f_Notes\">The drop-down lists that display MDaemon accounts show the first 500 accounts by default. You can set <\/span><span class=\"f_PlainText\">MaxUsersShown=0<\/span><span class=\"f_Notes\"> in <\/span><span class=\"f_PlainText\">plugins.dat<\/span><span class=\"f_Notes\"> to view all accounts. This may take longer to load for very large user lists.<\/span><\/p>\n\r<p class=\"p_Notes\" style=\"text-indent: 0; padding-left: 0.8125rem; margin-left: 0;\"><span class=\"f_Notes\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">&#8226;<\/span><span class=\"f_PlainText\">MDPGPUtil.exe<\/span><span class=\"f_Notes\"> is a tool that can encrypt and decrypt via command line options. Run MDPGPUtil with no arguments from a command line shell for help.<\/span><\/p><\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r"
})
