search

mjl- / mox

modern full-featured open source secure mail server for low-maintenance self-hosted email
https://www.xmox.nl
MIT License
3.71k stars 113 forks source link

anti-featurerequest: don't add PGP/S-MIME signing #23

Closed mpldr closed 1 year ago

mpldr commented 1 year ago

Since this is in the README

PGP or S/MIME

I just wanted to add my 2¢ and ask you not to do this. This absolutely defeats the purpose of signing outgoing mail and supports misbehaviours that some might be used to because of Exchange.

Why are messages signed? To guarantee to a degree not only that a person has access to a mailaccount, but that it is in fact the owner of a mailbox who's writing. Signing this on a server level obviously removes this and just adds a client-visible DKIM.

mjl- commented 1 year ago

I agree this is best left to clients. The question came up before, see https://news.ycombinator.com/item?id=34909525. What I had in mind was a case where someone has a mox instance for themselves. Mox would be like an extended mail client.

Thanks for bringing this up!