# simple question **URL:** \ **Category:** Gateway\ **Created:** [June 14, 2011, 3:39pm UTC](https://community.ciphermail.com/t/simple-question/210 "2011-06-14T15:39:16Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Claudio\_Bazan](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@Claudio\_Bazan](https://community.ciphermail.com/u/Claudio_Bazan)\ **Post date:** [June 14, 2011, 3:39pm UTC](https://community.ciphermail.com/t/simple-question/210/1 "2011-06-14T15:39:16Z")
Hi Martijn, Thanks for the quick response, now I get to read the smime-setup-guide.pdf found on the website of djigzo, if I reach in doubt about how to configure it'll be bothering you again. > **···** > > -- > Kindest Regards > Claudio. ---
**Author:** ![Brad\_Triem](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Brad\_Triem](https://community.ciphermail.com/u/Brad_Triem)\ **Post date:** [September 18, 2011, 3:49pm UTC](https://community.ciphermail.com/t/simple-question/210/2 "2011-09-18T15:49:42Z")
Hello everyone, We are using force encryption with an encryption subdomain, called encrypted.domain.com. We configured a persona as user(a)encrypted.domain.com within the user(a)domain.com account on our Zimbra email server. When I create an email with the user(a)encrypted.domain.com persona the djigzo/postfix server appears to be looking at the Return-Path when identifying who the email is coming from, which in this case is showing up as user(a)domain.com. Regardless that the From address and reply-to address are user(a)encrypted.domain.com. The result of this is that the email does not get encrypted by the djigzo system Is there a way to address this little problem within djigzo/postfix? We wanted to avoid using the keyword in the subject if possible. Thanks for your time and responses! Brad ---
**Author:** ![Nancy\_Anthracite](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nancy\_Anthracite](https://community.ciphermail.com/u/Nancy_Anthracite)\ **Post date:** [September 18, 2011, 4:00pm UTC](https://community.ciphermail.com/t/simple-question/210/3 "2011-09-18T16:00:47Z")
If you don't mind the return address being user(a)encrypted.domain.com, you can use an MX record to send all of the mail for encrypted.domain.com to domian.com and sort it that way. > **···** > > On Sunday, September 18, 2011, Brad Triem wrote: > > > Hello everyone, > > > > We are using force encryption with an encryption subdomain, called > > encrypted.domain.com. We configured a persona as user(a)encrypted.domain.com > > within the user(a)domain.com account on our Zimbra email server. > > > > When I create an email with the user(a)encrypted.domain.com persona the > > djigzo/postfix server appears to be looking at the Return-Path when > > identifying who the email is coming from, which in this case is showing up > > as user(a)domain.com. Regardless that the From address and reply-to address > > are user(a)encrypted.domain.com. The result of this is that the email does > > not get encrypted by the djigzo system > > > > Is there a way to address this little problem within djigzo/postfix? We > > wanted to avoid using the keyword in the subject if possible. > > > > Thanks for your time and responses! > > > > Brad > > > > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ > > Users mailing list > > Users(a)lists.djigzo.com > > [http://lists.djigzo.com/lists/listinfo/users](http://lists.djigzo.com/lists/listinfo/users) > > -- > Nancy Anthracite ---
**Author:** ![Brad\_Triem](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Brad\_Triem](https://community.ciphermail.com/u/Brad_Triem)\ **Post date:** [September 18, 2011, 4:13pm UTC](https://community.ciphermail.com/t/simple-question/210/4 "2011-09-18T16:13:22Z")
Gotchya. Because I have the encrypted.domain.com set as a CNAME to domain.com, the return path is based on the MX of domain.com. I see. I will replace the CNAME with a regular A record with its own MX. What you say makes sense so hopefully this change will fix the problem. Thank you! > **···** > > ----- Original Message ----- > > > From: "Nancy Anthracite" \ > > To: users(a)lists.djigzo.com, "Brad Triem" \ > > Sent: Sunday, September 18, 2011 11:00:47 AM > > Subject: Re: force encryption problem > > > > If you don't mind the return address being user(a)encrypted.domain.com, > > you can > > use an MX record to send all of the mail for encrypted.domain.com to > > domian.com and sort it that way. > > > > On Sunday, September 18, 2011, Brad Triem wrote: > > \> Hello everyone, > > \> > > \> We are using force encryption with an encryption subdomain, called > > \> encrypted.domain.com. We configured a persona as > > \> user(a)encrypted.domain.com > > \> within the user(a)domain.com account on our Zimbra email server. > > \> > > \> When I create an email with the user(a)encrypted.domain.com persona > > \> the > > \> djigzo/postfix server appears to be looking at the Return-Path when > > \> identifying who the email is coming from, which in this case is > > \> showing up > > \> as user(a)domain.com. Regardless that the From address and reply-to > > \> address > > \> are user(a)encrypted.domain.com. The result of this is that the email > > \> does > > \> not get encrypted by the djigzo system > > \> > > \> Is there a way to address this little problem within > > \> djigzo/postfix? We > > \> wanted to avoid using the keyword in the subject if possible. > > \> > > \> Thanks for your time and responses! > > \> > > \> > > \> Brad > > \> > > \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ > > \> Users mailing list > > \> Users(a)lists.djigzo.com > > \> [http://lists.djigzo.com/lists/listinfo/users](http://lists.djigzo.com/lists/listinfo/users) > > > > -- > > Nancy Anthracite ---
**Author:** ![Brad\_Triem](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Brad\_Triem](https://community.ciphermail.com/u/Brad_Triem)\ **Post date:** [September 18, 2011, 4:27pm UTC](https://community.ciphermail.com/t/simple-question/210/5 "2011-09-18T16:27:17Z")
Appears that didn't work. Below is the snippet from the djigzo maillog: Sep 18 11:20:03 secure postfix/qmgr[9933]: DF40769B35A: from=\, size=1753, nrcpt=1 (queue active) Sep 18 11:20:03 secure postfix/smtpd[8592]: disconnect from localhost.localdomain[127.0.0.1] Sep 18 11:20:05 secure postfix/smtp[8598]: DF40769B35A: to=\, relay=mail.externaldomain.net[xxx.xxx.xxx.xxx]:25, delay=1.3, delays=0.01/0.01/0.63/0.61, dsn=2.0.0, status=sent (250 ok 1316362805 qp 24043) The from= shows user(a)domain.com. But when I receive the email in my test external account, it shows the From and reply-to as user(a)encrypted.domain.com. When I look at the header of the email, at the very top it shows "Return-Path: user(a)domain.com". The mx records for encrypted.domain.com are set properly as well. Looking for a few more ideas or suggestions. Thanks again. Brad > **···** > > ----- Original Message ----- > > > If you don't mind the return address being user(a)encrypted.domain.com, > > you can > > use an MX record to send all of the mail for encrypted.domain.com to > > domian.com and sort it that way. > > > > On Sunday, September 18, 2011, Brad Triem wrote: > > \> Hello everyone, > > \> > > \> We are using force encryption with an encryption subdomain, called > > \> encrypted.domain.com. We configured a persona as > > \> user(a)encrypted.domain.com > > \> within the user(a)domain.com account on our Zimbra email server. > > \> > > \> When I create an email with the user(a)encrypted.domain.com persona > > \> the > > \> djigzo/postfix server appears to be looking at the Return-Path when > > \> identifying who the email is coming from, which in this case is > > \> showing up > > \> as user(a)domain.com. Regardless that the From address and reply-to > > \> address > > \> are user(a)encrypted.domain.com. The result of this is that the email > > \> does > > \> not get encrypted by the djigzo system > > \> > > \> Is there a way to address this little problem within > > \> djigzo/postfix? We > > \> wanted to avoid using the keyword in the subject if possible. > > \> > > \> Thanks for your time and responses! > > \> > > \> > > \> Brad > > \> > > \> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ > > \> Users mailing list > > \> Users(a)lists.djigzo.com > > \> [http://lists.djigzo.com/lists/listinfo/users](http://lists.djigzo.com/lists/listinfo/users) > > > > -- > > Nancy Anthracite ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [September 18, 2011, 5:55pm UTC](https://community.ciphermail.com/t/simple-question/210/6 "2011-09-18T17:55:04Z")
Djigzo uses the "From" header for the identity of the sender. If there is no "From" header in the message. the envelope sender is used. Sometimes the terms "from" and "sender" are used interchangeably. The MPA logs therefore uses the term "originator" for the identity of the sender. The originator by default uses the from header value. The MTA logs (i.e., the Postfix logs) only show the envelope sender. The envelope sender in the MTA logs is called "from". This is \*not\* the from header. To see which identity is used, you should look at the MPA logs (see the originator field). In your case I guess the originator is "user(a)encrypted.domain.com" and not "user(a)domain.com". You should therefore set all settings for the sender on the encrypted.domain.com domain and not on the domain.com domain. Hope this makes sense. Kind regards, Martijn Brinkers > **···** > > On 09/18/2011 06:27 PM, Brad Triem wrote: > > > Appears that didn't work. Below is the snippet from the djigzo maillog: > > > > Sep 18 11:20:03 secure postfix/qmgr[9933]: DF40769B35A: from=\, size=1753, nrcpt=1 (queue active) > > Sep 18 11:20:03 secure postfix/smtpd[8592]: disconnect from localhost.localdomain[127.0.0.1] > > Sep 18 11:20:05 secure postfix/smtp[8598]: DF40769B35A: to=\, relay=mail.externaldomain.net[xxx.xxx.xxx.xxx]:25, delay=1.3, delays=0.01/0.01/0.63/0.61, dsn=2.0.0, status=sent (250 ok 1316362805 qp 24043) > > > > The from= shows user(a)domain.com. But when I receive the email in my test external account, it shows the From and reply-to as user(a)encrypted.domain.com. When I look at the header of the email, at the very top it shows "Return-Path: user(a)domain.com". > > > > The mx records for encrypted.domain.com are set properly as well. Looking for a few more ideas or suggestions. Thanks again. > > -- > Djigzo open source email encryption ---
**Author:** ![Brad\_Triem](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Brad\_Triem](https://community.ciphermail.com/u/Brad_Triem)\ **Post date:** [September 18, 2011, 7:00pm UTC](https://community.ciphermail.com/t/simple-question/210/7 "2011-09-18T19:00:32Z")
The MPA log shows the following: 8 Sep 2011 11:20:03 | INFO checkSMIMESign | MailID: ea7621fe-10ae-4f48-b888-c05532f2c91a; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] Based on what you said, this email should be encrypted due to the originators domain, unless I have something wrong in the below configuration for the domain in djigzo: Locality: Internal Encrypt Mode: Force Encryption notification: checked Password: blank Password ID: blank Validity Interval: 0 Send to originator: checked S/MIME: not allowed Subject trigger: not enabled SMS: not enabled PDF Encryption Allowed: checked Max. message size: 52428800 Advanced Settings: PDF Reply Allowed: checked Validity Interval: 1440 Reply URL and Reply Sender configured Thanks, Brad > **···** > > ----- Original Message ----- > > > On 09/18/2011 06:27 PM, Brad Triem wrote: > > \> Appears that didn't work. Below is the snippet from the djigzo > > \> maillog: > > \> > > \> Sep 18 11:20:03 secure postfix/qmgr[9933]: DF40769B35A: > > \> from=\, size=1753, nrcpt=1 (queue active) > > \> Sep 18 11:20:03 secure postfix/smtpd[8592]: disconnect from > > \> localhost.localdomain[127.0.0.1] > > \> Sep 18 11:20:05 secure postfix/smtp[8598]: DF40769B35A: > > \> to=\, > > \> relay=mail.externaldomain.net[xxx.xxx.xxx.xxx]:25, delay=1.3, > > \> delays=0.01/0.01/0.63/0.61, dsn=2.0.0, status=sent (250 ok > > \> 1316362805 qp 24043) > > \> > > \> The from= shows user(a)domain.com. But when I receive the email in > > \> my test external account, it shows the From and reply-to as > > \> user(a)encrypted.domain.com. When I look at the header of the > > \> email, at the very top it shows "Return-Path: user(a)domain.com". > > \> > > \> The mx records for encrypted.domain.com are set properly as well. > > \> Looking for a few more ideas or suggestions. Thanks again. > > > > Djigzo uses the "From" header for the identity of the sender. If > > there > > is no "From" header in the message. the envelope sender is used. > > Sometimes the terms "from" and "sender" are used interchangeably. The > > MPA logs therefore uses the term "originator" for the identity of the > > sender. The originator by default uses the from header value. > > > > The MTA logs (i.e., the Postfix logs) only show the envelope sender. > > The > > envelope sender in the MTA logs is called "from". This is \*not\* the > > from > > header. To see which identity is used, you should look at the MPA > > logs > > (see the originator field). > > > > In your case I guess the originator is "user(a)encrypted.domain.com" > > and > > not "user(a)domain.com". You should therefore set all settings for the > > sender on the encrypted.domain.com domain and not on the domain.com > > domain. > > > > Hope this makes sense. > > > > Kind regards, > > > > Martijn Brinkers ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [September 18, 2011, 7:04pm UTC](https://community.ciphermail.com/t/simple-question/210/8 "2011-09-18T19:04:20Z")
You have set Encrypt Mode to "Force" but I think you need to set it to "Mandatory". In retrospect force should have been named differently. If you want to make encryption mandatory you should use mandatory. Hopefully this helps. Kind regards, Martijn Brinkers > **···** > > On 09/18/2011 09:00 PM, Brad Triem wrote: > > > ----- Original Message ----- > > > > > On 09/18/2011 06:27 PM, Brad Triem wrote: > > > > > > > Appears that didn't work. Below is the snippet from the djigzo > > > > maillog: > > > > > > > > Sep 18 11:20:03 secure postfix/qmgr[9933]: DF40769B35A: > > > > from=\, size=1753, nrcpt=1 (queue active) > > > > Sep 18 11:20:03 secure postfix/smtpd[8592]: disconnect from > > > > localhost.localdomain[127.0.0.1] > > > > Sep 18 11:20:05 secure postfix/smtp[8598]: DF40769B35A: > > > > to=\, > > > > relay=mail.externaldomain.net[xxx.xxx.xxx.xxx]:25, delay=1.3, > > > > delays=0.01/0.01/0.63/0.61, dsn=2.0.0, status=sent (250 ok > > > > 1316362805 qp 24043) > > > > > > > > The from= shows user(a)domain.com. But when I receive the email in > > > > my test external account, it shows the From and reply-to as > > > > user(a)encrypted.domain.com. When I look at the header of the > > > > email, at the very top it shows "Return-Path: user(a)domain.com". > > > > > > > > The mx records for encrypted.domain.com are set properly as well. > > > > Looking for a few more ideas or suggestions. Thanks again. > > > > > > Djigzo uses the "From" header for the identity of the sender. If > > > there > > > is no "From" header in the message. the envelope sender is used. > > > Sometimes the terms "from" and "sender" are used interchangeably. The > > > MPA logs therefore uses the term "originator" for the identity of the > > > sender. The originator by default uses the from header value. > > > > > > The MTA logs (i.e., the Postfix logs) only show the envelope sender. > > > The > > > envelope sender in the MTA logs is called "from". This is \*not\* the > > > from > > > header. To see which identity is used, you should look at the MPA > > > logs > > > (see the originator field). > > > > > > In your case I guess the originator is "user(a)encrypted.domain.com" > > > and > > > not "user(a)domain.com". You should therefore set all settings for the > > > sender on the encrypted.domain.com domain and not on the domain.com > > > domain. > > > > > > Hope this makes sense. > > > > > > Kind regards, > > > > > > Martijn Brinkers > > > > The MPA log shows the following: > > > > 8 Sep 2011 11:20:03 | INFO checkSMIMESign | MailID: ea7621fe-10ae-4f48-b888-c05532f2c91a; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] > > > > Based on what you said, this email should be encrypted due to the originators domain, unless I have something wrong in the below configuration for the domain in djigzo: > > > > Locality: Internal > > Encrypt Mode: Force > > Encryption notification: checked > > > > Password: blank > > Password ID: blank > > Validity Interval: 0 > > Send to originator: checked > > > > S/MIME: not allowed > > > > Subject trigger: not enabled > > > > SMS: not enabled > > > > PDF Encryption Allowed: checked > > Max. message size: 52428800 > > > > Advanced Settings: > > > > PDF Reply Allowed: checked > > Validity Interval: 1440 > > Reply URL and Reply Sender configured > > -- > Djigzo open source email encryption ---
**Author:** ![lst\_hoe021](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@lst\_hoe021](https://community.ciphermail.com/u/lst_hoe021)\ **Post date:** [September 18, 2011, 7:19pm UTC](https://community.ciphermail.com/t/simple-question/210/9 "2011-09-18T19:19:24Z")
Zitat von Brad Triem \: > **···** > > > ----- Original Message ----- > > > > > On 09/18/2011 06:27 PM, Brad Triem wrote: > > > \> Appears that didn't work. Below is the snippet from the djigzo > > > \> maillog: > > > \> > > > \> Sep 18 11:20:03 secure postfix/qmgr[9933]: DF40769B35A: > > > \> from=\, size=1753, nrcpt=1 (queue active) > > > \> Sep 18 11:20:03 secure postfix/smtpd[8592]: disconnect from > > > \> localhost.localdomain[127.0.0.1] > > > \> Sep 18 11:20:05 secure postfix/smtp[8598]: DF40769B35A: > > > \> to=\, > > > \> relay=mail.externaldomain.net[xxx.xxx.xxx.xxx]:25, delay=1.3, > > > \> delays=0.01/0.01/0.63/0.61, dsn=2.0.0, status=sent (250 ok > > > \> 1316362805 qp 24043) > > > \> > > > \> The from= shows user(a)domain.com. But when I receive the email in > > > \> my test external account, it shows the From and reply-to as > > > \> user(a)encrypted.domain.com. When I look at the header of the > > > \> email, at the very top it shows "Return-Path: user(a)domain.com". > > > \> > > > \> The mx records for encrypted.domain.com are set properly as well. > > > \> Looking for a few more ideas or suggestions. Thanks again. > > > > > > Djigzo uses the "From" header for the identity of the sender. If > > > there > > > is no "From" header in the message. the envelope sender is used. > > > Sometimes the terms "from" and "sender" are used interchangeably. The > > > MPA logs therefore uses the term "originator" for the identity of the > > > sender. The originator by default uses the from header value. > > > > > > The MTA logs (i.e., the Postfix logs) only show the envelope sender. > > > The > > > envelope sender in the MTA logs is called "from". This is \*not\* the > > > from > > > header. To see which identity is used, you should look at the MPA > > > logs > > > (see the originator field). > > > > > > In your case I guess the originator is "user(a)encrypted.domain.com" > > > and > > > not "user(a)domain.com". You should therefore set all settings for the > > > sender on the encrypted.domain.com domain and not on the domain.com > > > domain. > > > > > > Hope this makes sense. > > > > > > Kind regards, > > > > > > Martijn Brinkers > > > > The MPA log shows the following: > > > > 8 Sep 2011 11:20:03 | INFO checkSMIMESign | MailID: > > ea7621fe-10ae-4f48-b888-c05532f2c91a; Originator: > > user(a)encrypted.domain.com; Sender: user(a)domain.com; > > (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] > > > > Based on what you said, this email should be encrypted due to the > > originators domain, unless I have something wrong in the below > > configuration for the domain in djigzo: > > > > Locality: Internal > > Encrypt Mode: Force > > Encryption notification: checked > > > > Password: blank > > Password ID: blank > > Validity Interval: 0 > > Send to originator: checked > > > > S/MIME: not allowed > > Huhh?? > Should be allowed, no? > > Regards > > Andreas ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [September 18, 2011, 7:21pm UTC](https://community.ciphermail.com/t/simple-question/210/10 "2011-09-18T19:21:03Z")
I think he only wants to use PDF encryption. Or not? Kind regards, Martijn > **···** > > On 01/-10/-28163 08:59 PM, Lst\_hoe02(a)kwsoft.de wrote: > > > Zitat von Brad Triem \: > > > > > ----- Original Message ----- > > > > > > > On 09/18/2011 06:27 PM, Brad Triem wrote: > > > > \> Appears that didn't work. Below is the snippet from the djigzo > > > > \> maillog: > > > > \> > > > > \> Sep 18 11:20:03 secure postfix/qmgr[9933]: DF40769B35A: > > > > \> from=\, size=1753, nrcpt=1 (queue active) > > > > \> Sep 18 11:20:03 secure postfix/smtpd[8592]: disconnect from > > > > \> localhost.localdomain[127.0.0.1] > > > > \> Sep 18 11:20:05 secure postfix/smtp[8598]: DF40769B35A: > > > > \> to=\, > > > > \> relay=mail.externaldomain.net[xxx.xxx.xxx.xxx]:25, delay=1.3, > > > > \> delays=0.01/0.01/0.63/0.61, dsn=2.0.0, status=sent (250 ok > > > > \> 1316362805 qp 24043) > > > > \> > > > > \> The from= shows user(a)domain.com. But when I receive the email in > > > > \> my test external account, it shows the From and reply-to as > > > > \> user(a)encrypted.domain.com. When I look at the header of the > > > > \> email, at the very top it shows "Return-Path: user(a)domain.com". > > > > \> > > > > \> The mx records for encrypted.domain.com are set properly as well. > > > > \> Looking for a few more ideas or suggestions. Thanks again. > > > > > > > > Djigzo uses the "From" header for the identity of the sender. If > > > > there > > > > is no "From" header in the message. the envelope sender is used. > > > > Sometimes the terms "from" and "sender" are used interchangeably. The > > > > MPA logs therefore uses the term "originator" for the identity of the > > > > sender. The originator by default uses the from header value. > > > > > > > > The MTA logs (i.e., the Postfix logs) only show the envelope sender. > > > > The > > > > envelope sender in the MTA logs is called "from". This is \*not\* the > > > > from > > > > header. To see which identity is used, you should look at the MPA > > > > logs > > > > (see the originator field). > > > > > > > > In your case I guess the originator is "user(a)encrypted.domain.com" > > > > and > > > > not "user(a)domain.com". You should therefore set all settings for the > > > > sender on the encrypted.domain.com domain and not on the domain.com > > > > domain. > > > > > > > > Hope this makes sense. > > > > > > > > Kind regards, > > > > > > > > Martijn Brinkers > > > > > > The MPA log shows the following: > > > > > > 8 Sep 2011 11:20:03 | INFO checkSMIMESign | MailID: > > > ea7621fe-10ae-4f48-b888-c05532f2c91a; Originator: > > > user(a)encrypted.domain.com; Sender: user(a)domain.com; > > > (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] > > > > > > Based on what you said, this email should be encrypted due to the > > > originators domain, unless I have something wrong in the below > > > configuration for the domain in djigzo: > > > > > > Locality: Internal > > > Encrypt Mode: Force > > > Encryption notification: checked > > > > > > Password: blank > > > Password ID: blank > > > Validity Interval: 0 > > > Send to originator: checked > > > > > > S/MIME: not allowed > > > > Huhh?? > > Should be allowed, no? > > -- > Djigzo open source email encryption ---
**Author:** ![Brad\_Triem](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Brad\_Triem](https://community.ciphermail.com/u/Brad_Triem)\ **Post date:** [September 18, 2011, 7:22pm UTC](https://community.ciphermail.com/t/simple-question/210/11 "2011-09-18T19:22:32Z")
I'm re-reviewing my configurations but as you can see below, using mandatory didn't solve the problem at this point. I've got another domain that uses the subject trigger and it works fine. So I know the server encrypts. 18 Sep 2011 14:14:04 | INFO incoming | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; Remote address: xxx.xxx.xxx.xxx; Recipients: [externaluser(a)externaldomain.net]; Subject: testing encryption; Message-ID: \; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO external | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO postDLP | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO checkForceEncryptHeader | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO checkEncryptMode | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO checkSMIME | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO checkPDFEncrypt | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO checkMustEncrypt | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] 18 Sep 2011 14:14:05 | INFO The message could not be encrypted. The message will therefore not be sent. The sender will be notified. | MailID: 2237fffb-1f59-4a60-b5b1-52f767872de6; Originator: user(a)encrypted.domain.com; Sender: user(a)domain.com; (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] Thanks again, Brad > **···** > > ----- Original Message ----- > > > You have set Encrypt Mode to "Force" but I think you need to set it > > to > > "Mandatory". In retrospect force should have been named differently. > > If > > you want to make encryption mandatory you should use mandatory. > > > Hopefully this helps. > > > Kind regards, > > > Martijn Brinkers ---
**Author:** ![Brad\_Triem](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Brad\_Triem](https://community.ciphermail.com/u/Brad_Triem)\ **Post date:** [September 18, 2011, 7:24pm UTC](https://community.ciphermail.com/t/simple-question/210/12 "2011-09-18T19:24:32Z")
Andreas, no. I'm not using S/MIME encryption. Just PDF encryption for outbound specified transactions either by domain or by subject trigger. > **···** > > ----- Original Message ----- > > > Zitat von Brad Triem \: > > > \> ----- Original Message ----- > > \>\> On 09/18/2011 06:27 PM, Brad Triem wrote: > > \>\> \> Appears that didn't work. Below is the snippet from the djigzo > > \>\> \> maillog: > > \>\> \> > > \>\> \> Sep 18 11:20:03 secure postfix/qmgr[9933]: DF40769B35A: > > \>\> \> from=\, size=1753, nrcpt=1 (queue active) > > \>\> \> Sep 18 11:20:03 secure postfix/smtpd[8592]: disconnect from > > \>\> \> localhost.localdomain[127.0.0.1] > > \>\> \> Sep 18 11:20:05 secure postfix/smtp[8598]: DF40769B35A: > > \>\> \> to=\, > > \>\> \> relay=mail.externaldomain.net[xxx.xxx.xxx.xxx]:25, delay=1.3, > > \>\> \> delays=0.01/0.01/0.63/0.61, dsn=2.0.0, status=sent (250 ok > > \>\> \> 1316362805 qp 24043) > > \>\> \> > > \>\> \> The from= shows user(a)domain.com. But when I receive the email in > > \>\> \> my test external account, it shows the From and reply-to as > > \>\> \> user(a)encrypted.domain.com. When I look at the header of the > > \>\> \> email, at the very top it shows "Return-Path: user(a)domain.com". > > \>\> \> > > \>\> \> The mx records for encrypted.domain.com are set properly as > > \>\> \> well. > > \>\> \> Looking for a few more ideas or suggestions. Thanks again. > > \>\> > > \>\> Djigzo uses the "From" header for the identity of the sender. If > > \>\> there > > \>\> is no "From" header in the message. the envelope sender is used. > > \>\> Sometimes the terms "from" and "sender" are used interchangeably. > > \>\> The > > \>\> MPA logs therefore uses the term "originator" for the identity of > > \>\> the > > \>\> sender. The originator by default uses the from header value. > > \>\> > > \>\> The MTA logs (i.e., the Postfix logs) only show the envelope > > \>\> sender. > > \>\> The > > \>\> envelope sender in the MTA logs is called "from". This is \*not\* > > \>\> the > > \>\> from > > \>\> header. To see which identity is used, you should look at the MPA > > \>\> logs > > \>\> (see the originator field). > > \>\> > > \>\> In your case I guess the originator is "user(a)encrypted.domain.com" > > \>\> and > > \>\> not "user(a)domain.com". You should therefore set all settings for > > \>\> the > > \>\> sender on the encrypted.domain.com domain and not on the > > \>\> domain.com > > \>\> domain. > > \>\> > > \>\> Hope this makes sense. > > \>\> > > \>\> Kind regards, > > \>\> > > \>\> Martijn Brinkers > > \>\> > > \> > > \> > > \> The MPA log shows the following: > > \> > > \> 8 Sep 2011 11:20:03 | INFO checkSMIMESign | MailID: > > \> ea7621fe-10ae-4f48-b888-c05532f2c91a; Originator: > > \> user(a)encrypted.domain.com; Sender: user(a)domain.com; > > \> (mitm.application.djigzo.james.mailets.Log) [Spool Thread #0] > > \> > > \> Based on what you said, this email should be encrypted due to the > > \> originators domain, unless I have something wrong in the below > > \> configuration for the domain in djigzo: > > \> > > \> Locality: Internal > > \> Encrypt Mode: Force > > \> Encryption notification: checked > > \> > > \> Password: blank > > \> Password ID: blank > > \> Validity Interval: 0 > > \> Send to originator: checked > > \> > > \> S/MIME: not allowed > > > Huhh?? > > Should be allowed, no? > > > Regards > > > Andreas ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [September 18, 2011, 7:29pm UTC](https://community.ciphermail.com/t/simple-question/210/13 "2011-09-18T19:29:16Z")
Did you override any settings of the recipient domain? (or the global domain)? Appendix E of the administration guide contains the complete mail flow. Can you follow that step by step to see why it doesn't encrypt? Kind regards, Martijn > **···** > > On 09/18/2011 09:22 PM, Brad Triem wrote: > > > ------------------------------------------------------------------------ > > > >     You have set Encrypt Mode to "Force" but I think you need to set it to > >     "Mandatory". In retrospect force should have been named differently. If > >     you want to make encryption mandatory you should use mandatory. > > > >     Hopefully this helps. > > > >     Kind regards, > > > >     Martijn Brinkers > > > > I'm re-reviewing my configurations but as you can see below, using > > mandatory didn't solve the problem at this point. I've got another > > domain that uses the subject trigger and it works fine. So I know the > > server encrypts. > > -- > Djigzo open source email encryption ---
**Author:** ![Brad\_Triem](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@Brad\_Triem](https://community.ciphermail.com/u/Brad_Triem)\ **Post date:** [September 18, 2011, 7:56pm UTC](https://community.ciphermail.com/t/simple-question/210/14 "2011-09-18T19:56:07Z")
Ah, thank you Martijn. The flow diagram allowed me the insight I needed to solve the problem. I had the recipients on "no encryption" due to some previous configurations I did to use "subject tagging" only when I originally set this up. Thanks for being so responsive and I'll do better to review your well documented flow diagrams in the future. Brad > **···** > > ----- Original Message ----- > > > Did you override any settings of the recipient domain? (or the global > > domain)? > > > Appendix E of the administration guide contains the complete mail > > flow. > > Can you follow that step by step to see why it doesn't encrypt? > > > Kind regards, > > > Martijn ---
**Author:** ![Nancy\_Anthracite](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nancy\_Anthracite](https://community.ciphermail.com/u/Nancy_Anthracite)\ **Post date:** [September 19, 2011, 2:45am UTC](https://community.ciphermail.com/t/simple-question/210/15 "2011-09-19T02:45:29Z")
I hesitate to wade in here because I know so little, but why is the return address being set at user(a)domain.com? I suspect it is being handed to Djigzo with that set wrong and therefore not coming back with the right domain. > **···** > > On Sunday, September 18, 2011, Martijn Brinkers wrote: > > > On 09/18/2011 09:22 PM, Brad Triem wrote: > > \> ------------------------------------------------------------------------ > > \> > > \> You have set Encrypt Mode to "Force" but I think you need to set it > > \> to "Mandatory". In retrospect force should have been named > > \> differently. If you want to make encryption mandatory you should use > > \> mandatory. > > \> > > \> Hopefully this helps. > > \> > > \> Kind regards, > > \> > > \> Martijn Brinkers > > \> > > \> I'm re-reviewing my configurations but as you can see below, using > > \> mandatory didn't solve the problem at this point. I've got another > > \> domain that uses the subject trigger and it works fine. So I know the > > \> server encrypts. > > > > Did you override any settings of the recipient domain? (or the global > > domain)? > > > > Appendix E of the administration guide contains the complete mail flow. > > Can you follow that step by step to see why it doesn't encrypt? > > > > Kind regards, > > > > Martijn > > -- > Nancy Anthracite ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [September 19, 2011, 7:09pm UTC](https://community.ciphermail.com/t/simple-question/210/16 "2011-09-19T19:09:06Z")
Although in most cases, the from (header) is equal to the (envelope) sender address but this is not always the case. For example when a message is forwarded by a forwarding server, the forwarder uses a different envelope sender to make sure that bounces are handled by the forwarder. I'm not sure whether the topic starter uses a different domain for the from but this should not be a problem. Djigzo will only look at the from to determine who sent the message. Kind regards, Martijn Brinkers > **···** > > On 09/19/2011 04:45 AM, Nancy Anthracite wrote: > > > I hesitate to wade in here because I know so little, but why is the return > > address being set at user(a)domain.com? I suspect it is being handed to Djigzo > > with that set wrong and therefore not coming back with the right domain. > > -- > Djigzo open source email encryption