email server, that can digitally sign outgoing emails with smime reddit / selfhosted ---------------------------------------------------------------------- lullorz · 2023-12-22 22:26 Hello Im looking for a solution, that can digitally sign outgoing emails with a smime certficate. None of the opensource solution that exists really supports it in any way, as far as my google searches have taken me Im not looking to encrypt the emails, just sign them so the receiver knows that its coming from a trusted source. ---------------------------------------------------------------------- ex800 · 2023-12-22 22:39 if you just need to sign why not use DKIM instead of S/MIME? ---------------------------------------------------------------------- lullorz · 2023-12-22 22:39 I already use DKIM, but that does not give the green checkmark in mail clients for the receiver. ---------------------------------------------------------------------- CjKing2k · 2023-12-22 23:39 You can probably implement your own filter to do this, but you would need a private key and cert for each of your users which defeats the end-to-end nature of S/MIME. ---------------------------------------------------------------------- adamshand · 2023-12-23 02:52 Not quite what you're looking for, but this might be useful: > Encryption at Rest is designed to protect your data when it's stored, or 'at rest,' on your server. This new feature introduces the ability to automatically encrypt plain-text email messages with OpenPGP (Pretty Good Privacy) or S/MIME (Secure/Multipurpose Internet Mail Extensions) before being written to disk. https://stalw.art/blog/encryption-openpgp-smime ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-23 06:05 The smtp protocol isn't designed that way. Use dkim for smtp signing and a proper email client to sign your messages SMIMe isn't very popular since it requires a setup and exchange of public keys ---------------------------------------------------------------------- Mike22april · 2023-12-23 07:56 Since OP is solely asking for email signing, there is no need for exchange of keys. Ref DKIM: you may like this recent article https://sec- consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ ---------------------------------------------------------------------- Mike22april · 2023-12-23 08:01 If you want your outgoing emails to be signed using the visible checkmark in the email client, then you will need S/MIME for digital signing. Other than signing on your email client, you can also centrally S/MIME sign emails using an email gateway. One of the best free S/MIME gateways is CipherMail. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-23 09:22 Thank you 👍 ---------------------------------------------------------------------- lullorz · 2023-12-23 09:49 Yup, its the green checkmark im looking for, so receivers can easily spot that the email is legitimatly from us. I have looked at ciphermail before, but i was hoping there was more alternatives out there, because ciphermail is very cryptic to setup and we never got it to work properly last time, because we do dkim signing also but that happens before cipermail receives the email, so it kinda breaks it. ---------------------------------------------------------------------- ex800 · 2023-12-23 10:37 DKIM must be performed on the last MTA before the internet, so use CipherMail before your mail gateway, of do DKIM on CipherMail. ---------------------------------------------------------------------- Mike22april · 2023-12-23 11:02 There are some very good S/MIME cert automated request, management, deployment and mailclient configuration solutions out there. Even as a cloud service, but these cost roughly 60 EUR per email address per year. Arguably that price includes a 1 year valid public trusted S/MIME cert from either DigiCert or GlobalSign. Theres no minimal amount so you could just use it for 1 or 3 email addresses. The main downside is that these solutions require MDM to have the S/MIME be auto enrolled to mobile devices. Windows, Mac , Linux are properly covered without MDM ---------------------------------------------------------------------- lullorz · 2023-12-23 22:36 Well basicly i want to only sign outgoing emails from 1 single email, but i need to send the emails via SMTP from out client panel / accounting platform. Im not interested in sending via any mobile devices or stand alone emails clients. I also dont mind it costing money ---------------------------------------------------------------------- Mike22april · 2023-12-23 23:05 In that case I believe CipherMail Community Edition gateway is your best bet ---------------------------------------------------------------------- lullorz · 2023-12-27 18:18 Just to follow up on the case, i've setup ciphermail, and its currently working as expected, all outgoing emails are digitally signed with smime :) ---------------------------------------------------------------------- Mike22april · 2023-12-27 18:39 Glad to read it works