Note: As of June 2019, DefaultEncrypt is maintained on GitLab.

Gnus supports GnuPG via the insertion of so-called MML secure tags, which contain encryption instructions to be performed before a message is sent. However, by default those tags need to be added manually, which can easily be forgotten. In contrast, DefaultEncrypt aims to insert those tags automatically if public keys for all recipients are available.

I assume that you are familiar with GnuPG support for Gnus messages as described in Info node `(message) Security'. Moreover, DefaultEncrypt is based on EasyPG, the default interface of Emacs for OpenPGP and S/MIME, see Info node `(epa)'.

DefaultEncrypt (file jl-encrypt.el) aims for automatic insertion of an MML secure encryption tags into messages if public keys (either GnuPG public keys or S/MIME certificates) for all recipients are available. In addition, before a message is sent, the user is asked whether plaintext should really be sent unencryptedly when public keys for all recipients are available.

The above works by adding ‘mml-secure-encrypt-if-possible’ to ‘gnus-message-setup-hook’ and ‘mml-secure-check-encryption-p’ to ‘message-send-hook’.

Note that with EasyPG, e-mail is not encrypted to (a key for) the From address (see Info node `(epa) Mail-mode integration’). Instead, to make sure that you can decrypt your own e-mails, typical options are

If you are interested in S/MIME then I suggest that you read this: If you are still interested in S/MIME afterwards, take a look at ExtendSMIME (file jl-smime.el) in addition to file jl-encrypt.el.


Files jl-encrypt.el and jl-smime.el are maintained on GitLab. The master branch is meant for Emacs 25.1 and later, while branch emacs24 is meant for Emacs up to 24.x. Signed versions are available over there.

Put file jl-encrypt.el into your load-path and add the following to ~/.emacs.

(require 'jl-encrypt)

If you share my preferences, no further configuration should be necessary.

Customizable variables defined in this file are ‘mml-secure-insert-signature’, ‘mml-secure-pgp-without-mime’.

In addition, as explained in the following ‘mml-default-encrypt-method’ and ‘mml-default-sign-method’ influence whether to prefer S/MIME or GnuPG in certain situations, and the value of ‘gnus-message-replysignencrypted’ may be changed by this code. If ‘mml-secure-insert-signature’ is nil (the default), ‘gnus-message-replysignencrypted’ will be set to nil to avoid signatures for reply messages. You may manually add MML sign tags any time, of course, but the whole point of this file is to create MML tags automatically (e.g., by customizing ‘mml-secure-insert-signature’). If GnuPG and S/MIME keys are both available for the given recipients and no MML tag is present, ‘mml-default-encrypt-method’ determines what method to prefer. If ‘mml-secure-insert-signature’ is set to ‘always’, ‘mml-default-sign-method’ determines what method to prefer upon message creation.

Sanity check

Without any further configuration, send a GnuPG encrypted e-mail to yourself as follows. Enter your own e-mail address after To, choose some Subject, and enter ‘M-x spook’ in the body, which will insert suitable text. Then press ‘C-c C-c’ to send the e-mail as usual (forgetting to encrypt). If you own a GnuPG public for the To e-mail address then you will be asked whether you really want to send that e-mail as plaintext. Answering ‘no’ will insert an MML secure tag for you. Press ‘C-c C-c’ again, and an encrypted e-mail will be sent. If you receive that e-mail with garbled attachments read the comment for ‘mml-secure-pgp-without-mime’.

Comment for `mml-secure-pgp-without-mime'

Control whether MML encryption should use MIME Security with OpenPGP. RFC 3156 specifies how OpenPGP (and, thus, GnuPG) and MIME work together. In Gnus, ‘mml-secure-message-encrypt-pgpmime’ follows that standard. An alternative is ‘mml-secure-message-encrypt-pgp’, which represents a less powerful approach. If you (like me in the past) happen to send e-mails in an environment using broken M$ SMTP servers, then your beautiful e-mails produced by ‘mml-secure-message-encrypt-pgpmime’, following RFC 3156, will be corrupted along the way. E.g., the SMTP server at my department throws away the e-mail’s Content-Type ‘multipart/encrypted’ and its `protocol=“application/pgp-encrypted”’ and inserts a meaningless ‘multipart/mixed’ one. Thus, the recipient will have a hard time figuring out what the e-mail’s strange attachments are good for. FUBAR.

If this variable is set to nil (the default) then your e-mails are built according to RFC 3156. I suggest that you send an encrypted e-mail to yourself. Complain to your IT department if you receive garbled attachments. Then set this variable to non-nil, while they are setting up a reasonable SMTP server.

If you are signing all your e-mails with GnuPG you probably also want to set ‘mml-default-sign-method’ to “pgp” (instead of “pgpmime”).

CategoryGnus EncryptingMail