MIMEGPG(1)

✨ NAME ✨

mimegpg — the MIME-GPG utility, and yes bestie, this is mimegpg(1) we're talking about 💖 she's the little Courier Mail Server queen who signs, encrypts and decrypts your MIME email by bossing GnuPG around. no cap.

---

🎀 SYNOPSIS 🎀

mimegpg [-s] [-E] [-e] [-c] [-d] [-p n] {--} {gpg options...}

---

🌸 DESCRIPTION 🌸

okay so. mimegpg signs, encrypts, or decrypts MIME-formatted E-mail messages using GnuPG. and here's the thing — mimegpg does not contain any encryption code of its own, like, zero, she outsources all of it. every single encryption and decryption function is handled by the GnuPG utility. girl is a project manager 💅

The -s option signs an E-mail message. The -E or the -e option encrypts the E-mail message. Specifying both -E/-e and -s encrypts and signs the E-mail message in a single step, iconic. The -d option decrypts the message. The -c option checks signatures.

mimegpg works as a filter, periodt. It reads an E-mail message from standard input, which must be a MIME-formatted message. Then mimegpg signs, encrypts, and/or decrypts the message, and writes the encrypted, signed, or decrypted MIME message on standard output. in through the front door, out through the back 🦋

The standard input to mimegpg must be a MIME E-mail message, with a Mime Version: 1.0 header — even if the message does not contain any attachments. If the message contains any attachments, they are also signed and/or encrypted, individually. every little attachment gets its own moment ✨

mimegpg automatically runs GnuPG, with the required options. mimegpg's options may also be followed by a single -- option; any remaining command line options are passed as additional options to GnuPG. The -E/-e option usually requires at least one -r GnuPG option, which may be specified in this fashion.

The -p option specifies a file descriptor that contains any required passphrase. Any other valid GnuPG options may follow a double-dash, --, as long as it makes sense for this operation — note that mimegpg automatically adds any GnuPG options that are needed to perform the given operation. The --no-tty option can be useful when mimegpg is used in a non-interactive mode.

🚨 as always, secret keys that are password-protected secret keys cannot be used in the --no-tty mode, unless the -p option is used. that's not a vibe, that's just the rules.

---

🔐 SIGNING AND ENCRYPTING MESSAGES 🔐

Use the -s option to sign MIME message content. Use the -E option to encrypt it. Use both options to both sign and encrypt. Follow with --, then any other GnuPG options. The -E option will require at least one -r GnuPG option — no -r, no encryption, sorry not sorry 🫶

The -E option encapsulates the message content and all the attachments into a single encrypted MIME object. real "everything in one bag" energy. but heads up: some mail software cannot handle encapsulated content 😭 The -e option encrypts each attachment separately, without encapsulation — more lil parcels instead of one big box 📦

If a secret key used for signing is password protected, the prompt to enter the password will be issued directly by GnuPG. Note that the -s and the -e (but not -E) options may issue multiple password prompts in interactive mode. mimegpg runs GnuPG multiple times if the MIME message contains attachments. GnuPG will be invoked separately for each attachment in the MIME message, and each invocation will prompt for any required key password. so yeah, get comfy if your inbox is full of attachments, bestie 💀

Note that the initial message headers are not signed and/or encrypted, except for the MIME headers themselves. However, any message/rfc822 MIME content — attached messages — are encrypted/signed in their entirety, headers and content. whole thing, no crumbs left behind 🌈

---

🕵️ DECRYPTING AND CHECKING SIGNATURES 🕵️

The -d option attempts to decrypt any encrypted content in a MIME message. The -c option attempts to verify signatures of any signed content. Both -c and -d can be specified at the same time, they're friends. -d looks for any multipart/encrypted MIME content, then attempts to decrypt it. -c looks for any multipart/signed MIME content, then attempts to verify the signature.

The -c and -d options replace the multipart/signed and multipart/encrypted MIME content with a multipart/x-mimepgp section, that contains an additional attribute called xpgpstatus. The value of the attribute is set to the exit code of GnuPG. Successfully decrypting the message and/or verifying the signature sets the exit code to 0. A non-zero exit code indicates that the signature could not be verified, or the message could not be decrypted. 🚩

The first section in this multipart/x-mimepgp is a text/plain section that contains any messages from GnuPG. The second section is any decrypted or signed content. mimegpg will include the signed content even if the signature could not be verified — so go check that xpgpstatus, bestie 👀 Encrypted content that could not be decrypted will not be included (obviously). like, there's nothing to include, it's a mystery box with no box 💀

Note — any existing x-mimegpg MIME section will have its content-type quietly reset to multipart/mixed, in order to avoid confusion (except when this is what got decrypted). she's keeping things tidy, no drama 💅

---

👑 SEE ALSO 👑

• reformime(1)[1].

---

💜 AUTHOR 💜

Sam Varshavchik

• Author

---

🌟 NOTES 🌟

1. reformime(1) — http://www.courier-mta.org/reformime.html

---

and that's the whole page, babes 🎀 this was Courier Mail Server, dated 01/10/2026 — mwah, go sign something, slay ✨👑