# Enigmail Help Information

This document provides some basic information on using Enigmail. If you encounter unexpected problems, you should also check the Troubleshooting page.

1. Getting started
2. Using Enigmail with GPG
3. Using Enigmail on Windows
4. Configuring Enigmail
5. Using Enigmail when reading messages
6. Using Enigmail when composing messages
7. Tips
8. Known problems and workarounds

### Getting started

If you are new to GnuPG (gpg) and/or Mozilla/Enigmail, we have a Beginners Manual (PDF) that gives you a good introduction for setting up gpg and using Mozilla/Enigmail.

- You need to restart the application after installation to start using Enigmail. If you installed Enigmail as the `root` user on Unix/Linux systems, your first restart should also be as `root`. (Subsequent restarts do not require root privileges.)
- If Mozilla Mail & Newsgroups/Thunderbird crashes when launching just after installing Enigmail, just restart it again. This problem has to do with the XUL cache and usually just goes away after the second or third restart. As a last resort, you may try deleting the file named `XUL.mfasl` (Unix) or `XUL.mfl` (Windows) in your user profile directory and then re-launch the application.
- The gpg executable must reside in one of the directories listed in the PATH environment variable.

- On Windows only, the following additional directories are also searched for the executable (`gpg.exe`) file: `c:\gnupg;c:\gnupg\bin;d:\gnupg;d:\gnupg\bin`
- If the GPG executable is in a non-standard directory, you should specify its location using the Enigmail Preferences panel.

- To check if Enigmail has located the GPG executable and is ready for use, go to the Enigmail menu of the mail window and click on About Enigmail
- To enable Enigmail for an account and set the signing/encryption defaults:
  - On Mozilla, use the Edit -> Mail & Newsgroups Account Settings menu in the Mail & Newsgroups window.
  - On Thunderbird, use the Tools -> Account Settings menu.

  Select the OpenPGP Security menu item below the account you want to configure.

- To set user preferences or to uninstall Enigmail, use the Enigmail -> Preferences menu choice in the Mail & Newsgroups/Thunderbird window. (The uninstall feature is yet to be enabled on the Windows platform.)
- S/MIME: You should be able to use Enigmail with S/MIME. If you do not wish to use S/MIME, you can "hide" the S/MIME button using the Advanced Preferences panel. (You will need to restart the application for this setting to take effect.)
- If you use multiple user IDs for signing, enable the use Email address of this account to identify PGP key preference. This adds the option `-u from-address` to the GPG command line using the from address for the mail message that is being sent.
- Enigmail has the facility to create a logfile for debugging errors. If you experience problems with Enigmail, enter a directory path (e.g.: `/home/tmp, c:\temp,` etc.) in the Debugging tab of Preferences. The logfile can be viewed by going to Enigmail -> View logfile.
- Enigmail creates a Decrypt button on the main Mail window. It also creates Enigmail menus on the main Mail window and the Mail/Compose window (see screenshots).
- In addition Enigmail creates pen and key icons in the status bar of the Mail/Compose windows. These icons indicate what will be done to the message (pen = sign, key = encrypt) and can be clicked on to change the function of signing or encrypting for that message only.
  These icons will also appear in the status bar of the Message Pane if reading a signed or encrypted message to indicate if it was signed and/or encrypted.
- You can use the Enigmail menu in the Mail/Compose window to generate keys, decrypt and verify messages, import keys, etc.
- There is a console to capture output from GPG. Choose the Enigmail -> View Console menu option to view the output.

### Using Enigmail with GPG

- By default, Enigmail enables the `--always-trust` option for GPG to allow outgoing mail to be encrypted to any key, even untrusted ones. If you would like to encrypt only to trusted keys, you should disable this option in Preferences. (This setting does not affect signature verification on received messages: you will always be warned if the signing key is untrusted.)

### Using Enigmail on Windows

- Enigmail no longer supports any version of PGP. Instead you should use GnuPG (GPG). If you download the version of GPG from www.nullify.org you will get a more Windows-friendly compilation and on that site you will find links to the Windows GUIs to make key management even more easy.

  If you're lost with setting up or using GPG, think about joining the PGP-Basics group who have some excellent online documents to help new users set up GPG on Windows. There is also a GnuPG Users group who offer friendly and knowledgeable support specifically for GnuPG.

  If you want to switch from PGP to GPG, you can take over all your keys into GPG. In order to do this, export your public keys and your private keys from PGP as ASCII armored files. You can then import your keys in GPG using the command `gpg --import filename.asc`.

### Using Enigmail when reading messages

- Decrypt button in main Mail window
  This button can be used for several purposes: decrypt, verify, or import public keys. Normally decryption/verification happens automatically, although this can be disabled through a preference. However, if this fails, usually a short error message will appear in the Enigmail status line. If you click the Decrypt button, you will be able to see a more detailed error message, including the output from the GPG command.
- Pen and Key icons in Message Header display
  The Pen and Key icons in the Message Header display indicate if the message you are reading was signed and/or encrypted and if the signature is good, i.e. the message has not been changed since it was signed. If the message has been changed, the Pen icon will change to a Broken Pen to indicate that the signature is bad. Right clicking on either the Pen or Key icons will bring up a menu with the following options:
  - OpenPGP Security info: allows you to view the output status from GPG for the message.
  - Copy OpenPGP Security info: copies the output status from GPG to the clipboard; to paste into a reply message, etc.
  - View PGP Photo ID: allows you to view the Photo ID of the person who sent the message, if they have a photo embedded in their Public Key. (This option will only be enabled if a Photo ID exists in their key.)
  - S/MIME Security info: allows you to view the S/MIME Security Info for the message.

  If you do not have keyserver-options auto-key-retrieve set in your `gpg.conf` file and you read a message which is signed or encrypted, you will see a Pen icon in the headers display area with a Question mark on it, the Enigmail status line in the headers area will say Part of the message signed; click pen icon for details and the message in the Message Pane will show all the PGP message block indicators and the signature block.

  You may also see this if you have keyserver-options auto-key-retrieve set in your `gpg.conf` file and the PGP key is not available on the default keyserver.

  Clicking on the Pen and Question mark icon will bring up a window advising that the key is unavailable in your keyring. Clicking on OK will bring up another window with a list of keyservers which you can select to download the sender's public key from.

  To configure the list of keyservers you wish to use, go to Enigmail -> Preferences -> Basic tab and enter the keyserver addresses in the Keyserver(s): box, separated by a comma. The first keyserver in the list will be used as the default.

- Opening encrypted attachments / importing attached PGP keys
  Attachments named *.pgp, *.asc and *.gpg are recognized as attachments that can be handled specially by Enigmail. Right clicking on such an attachment enables two special menu items in the context menu: Decrypt and Open and Decrypt and Save. Use these two menu items if you want Enigmail to decrypt an attachment before opening or saving it. If an attachment is recognized as a PGP key file, you are offered to import the keys it into your keyrings.

### Using Enigmail when composing messages

- Enigmail menu in Mail/Compose window
  - Sign message: Enable/Disable sending signed mail. User is notified if signing fails.
  - Encrypt message: Enable/Disable encryption to all recipient(s) before sending. User is notified if encryption fails.

    If Display selection when necessary is set in Preferences -> Key Selection tab, a list of keys will pop up if there are addresses in the list of recipients for the message for whom you have no public key.

    If Never display PGP key selection dialog is set in Preferences -> Key Selection tab, and there are addresses in the list of recipients for the message for whom you have no public key, the message will be sent unencrypted.

  - Use PGP/MIME for this message: Enable/Disable the use of PGP/MIME for this message.

    If you know the recipient(s) can read mail using the PGP/MIME format, you should use it.

    This feature is dependent on the settings in Preferences -> PGP/MIME tab being set to Allow to use PGP/MIME or Always use PGP/MIME.

  - Default composition options: Submenu.
    - Signing/Encryption Options...: shortcut to Account Settings -> OpenPGP Options.
    - Send options...: shortcut to Preferences -> Send tab.
    - Key selection options...: shortcut to Preferences -> Key Selection tab.
    - PGP/MIME options...: shortcut to Preferences -> PGP/MIME tab.
- Undo encryption: If there is a failure when actually sending mail, such as the POP server not accepting the request, Enigmail will not know about it, and the encrypted message will continue to be displayed in the Compose window. Choosing this menu item will undo the encryption/signing, reverting the Compose window back to its original text.
  As a temporary fix, this option may also be used to decrypt the quoted text when replying to encrypted messages. Enigmail should automatically decrypt the quoted message, but if that fails for some reason, you can use this menu item to force it.
- Insert public key: insert ASCII-armored public key block at the current cursor location in the Compose window. You will be prompted for the email addresses of the key(s) to be inserted. Keys inserted in this manner will automatically be recognized at the receiving end by Enigmail. After key insertion, you may still choose to sign/encrypt the mail as needed. Also, do not insert more than one key block in a message; just specify multiple email addresses, separated by commas or spaces, when prompted.
- Clear save passphrase: Clears cached passphrase. Useful if you have multiple passphrases.
- Help: Displays Help information from the website (this page).

### Tips

- How to change the HOMEDIR (where the keys are stored) in Windows?:
  If you do not want to use the default directory `c:\gnupg` to store your keys, you should enter a string with the directory path into the Windows Registry under the key: `\\HKEY_CURRENT_USER\Software\GNU\GnuPG\HomeDir`
  Note: Please use forward slashes and not the backslashes when setting filenames for GnuPG into the Registry.
  If you use a Key Manager such as GPGshell or WinPT then these will normally create any registry keys required to allow GPG to work correctly.
- Using Encrypt to self:
  Using the Encrypt to self preference will ensure that you can unencrypt and read any encrypted emails you send to people should you loose your secret key but still have access to your public key. If you do not Encrypt to self, you will not be able to unencrypt these mails to read them at some stage in the future without your secret key.
- Disable Allow flowed text (RFC 2646):
  If you have trouble verifying signatures created using Enigmail, or if you want to send ASCII art, you may want to disable the option Allow flowed text (RFC 2646) in the Advanced Preferences panel. Disabling this option also prevents the | symbol showing in quotes instead of the more normal > symbol.
- Using BCC these email addresses:
  If you use BCC these email addresses in Account Settings / Mail & Newsgroups Account Settings -> Copies & Folders you must ensure that you insert a fully qualified email address i.e. `user@domain.tld` instead of just a local user name i.e. `user` otherwise you will get a warning message "This message has BCC recipients..." when you click on send.

### Known problems and workarounds

- Enigmail button icons do not line up with other icons:
  Try changing your theme twice. If you are using the Modern theme, switch to the Classic theme using the View > Apply Theme menu option, and quit Mozilla. Restart, change back to the Modern theme and restart again.
- Using Enigmail with PGP:
  Originally, Enigmail worked with some older command line versions of PGP. But as the newer versions of PGP do not have a command line anymore, support for PGP was dropped in favor of GPG.
- Enigmail and Debian Mozilla (older versions only):
  The Debian Mozilla package use a patched version of Mozilla that is significantly different from the standard Mozilla binaries available from ftp.mozilla.org. This can cause Debian Mozilla to crash when used with Enigmail. The solution is to use the standard version of Mozilla, if at all possible. The alternative would be for the Debian packagers to compile Enigmail along with the Debian version of Mozilla. (See Mozilla bug 133171 for more details on how Debian Mozilla differs from standard Mozilla)
- Mozilla integration:
  With Mozilla Thunderbird moving a lot of the non-core functionality into downloadable extensions, it is not very likely that OpenPGP would ever be integrated into Mozilla. However, the internal interfaces of Mozilla over time might be adapted to make it easier for Enigmail to integrate. See mozilla bug 22687 for more information.