Last updated: March 15, 2026

To use GPG signed emails, generate a key pair with gpg --gen-key, configure your email client to sign outgoing messages with your private key, and share your public key with recipients. They can then verify that incoming emails genuinely came from you by checking the digital signature, the email client typically displays a green checkmark for valid signatures. Verification proves both authenticity (the sender controls that private key) and integrity (the message wasn’t modified after signing).

Table of Contents

Why GPG Sign Your Emails?

Email spoofing is trivial to perform. Attackers can easily forge the “From” header to appear as anyone. GPG signing adds a cryptographic layer that proves:

For developers communicating about code, infrastructure, or sensitive topics, GPG signatures provide assurance that you’re interacting with the genuine party.

Prerequisites

Ensure you have GPG installed on your system:

macOS
brew install gnupg

Debian/Ubuntu
sudo apt-get install gnupg

Fedora/RHEL
sudo dnf install gnupg

Verify the installation:

gpg --version

Step 1 - Generate Your GPG Key Pair

If you don’t already have a GPG key, generate one specifically for email use:

gpg --full-generate-key

Select RSA and RSA (default), choose a key size of 4096 bits for better security, and set an expiration date, two years is reasonable for email keys. Enter your name and email address associated with the email account you’ll sign from.

After generation, list your keys to confirm:

gpg --list-secret-keys

Note the key ID (the hexadecimal string after sec rsa4096/). You’ll need this for configuration.

Step 2 - Configure Your Email Client

Thunderbird

Thunderbird has native GPG support. Open Settings → Account Settings → End-to-End Encryption. Click “Add Key” and select your newly created key. Enable “Digitally Sign” by default for outgoing messages.

For each account, ensure “Digitally sign outgoing messages” is checked under the account’s Security Settings.

Command-Line with Mutt

If you prefer a terminal-based email client, configure Mutt:

Add to ~/.muttrc
set crypt_use_gpgme = yes
set crypt_default_keys = "0xYOURKEYID"
set sig_dashed = yes
set crypt_autosign = yes

Replace 0xYOURKEYID with your actual key ID (without the 0x prefix).

Apple Mail

Apple Mail requires the GPG Suite plugin. After installation, enable signing in Preferences → GPG Suite. You can also set default behavior to always sign.

Step 3 - Signing Outgoing Emails

Once configured, signing happens automatically for outgoing messages. You can also sign manually in clients that support it.

To sign a message from the command line (useful for scripts or automated emails):

Create a signed message
echo "Your message content here" | gpg --clearsign --local-user 0xYOURKEYID > signed_message.txt

For actual email sending, most clients handle the signing transparently after initial configuration.

Step 4 - Verify Incoming Signed Emails

Verification is where GPG provides real value. When you receive a signed email, your client checks the signature against the sender’s public key.

Using the Command Line

Save the signed portion of an email (the block between -----BEGIN PGP SIGNED MESSAGE----- and -----BEGIN PGP SIGNATURE-----) to a file, then verify:

gpg --verify signed_email.txt

Successful verification output looks like:

gpg: Signature made Mon 16 Mar 2026 10:30:00 EST
gpg:                using RSA key ABC123DEF456
gpg: Good signature from "Your Name <your@email.com>"

Importing Sender Public Keys

For verification to work, you need the sender’s public key. Several methods exist:

Fetch from a keyserver
gpg --keyserver keyserver.ubuntu.com --search-keys sender@example.com

Import from a file
gpg --import sender_public_key.asc

Fetch from a keyserver by key ID
gpg --keyserver keyserver.ubuntu.com --recv-keys ABC123DEF456

Many developers publish their keys on their websites or include them in email signatures. The OpenPGP Keyserver network (keys.openpgp.org) is a reliable choice.

Thunderbird Verification

Thunderbird displays a verification icon next to signed messages. A green checkmark indicates a valid signature. Clicking the icon shows signature details, including the key used and any warnings.

Step 5 - Handling Signature Failures

When verification fails, investigate the cause:

“No public key”: The sender’s public key is not in your keyring. Obtain and import it using the methods above.

“BAD signature”: The message was modified after signing. Do not trust the content.

“Key expired”: The sender’s key has expired. Contact them to obtain a renewed key.

“Untrusted signature”: The key is valid but not trusted. This happens with new keys or keys not signed by someone you trust. Manually verify the key fingerprint through another channel:

gpg --fingerprint sender@example.com

Confirm the fingerprint via a different communication channel (phone, in-person) before marking the key as trusted.

Step 6 - Automate Verification in Scripts

For automated workflows, verify PGP signatures in shell scripts:

#!/bin/bash

Verify a signed file
verify_signature() {
    local file="$1"
    if gpg --verify "$file" 2>/dev/null; then
        echo "Signature verified successfully"
        return 0
    else
        echo "Signature verification FAILED" >&2
        return 1
    fi
}

Usage
verify_signature "message.txt"

This pattern works well for CI/CD pipelines that validate commit signatures or package release announcements.

Key Management Best Practices

Maintain your GPG keys properly:

Backup your secret key: Export to a secure location, preferably encrypted:

gpg --export-secret-keys 0xYOURKEYID | gpg --armor --output backup.asc

Use subkeys for daily signing - Create subkeys for signing and encryption while keeping your master key offline. This limits damage if a subkey is compromised.

Revoke certificates - Generate a revocation certificate when you create your key:

gpg --gen-revoke 0xYOURKEYID > revocation_cert.asc

Store this securely. If you lose access to your key, the revocation certificate notifies others not to trust messages signed with that key.

Step 7 - Integrate with Git

Many developers use the same GPG key for Git commits. Configure Git to use your signing key:

git config --global user.signingkey 0xYOURKEYID
git config --global commit.gpgsign true

This provides verified commit provenance, complementary to signed emails.

Getting Started

Start by generating a GPG key if you don’t have one. Configure your primary email client to sign outgoing messages by default. Import keys from frequent correspondents, and verify signatures on all signed messages you receive. Over time, building this habit creates a web of cryptographic trust.

GPG signing adds friction to email communication, but the authenticity guarantees are valuable for technical collaboration. Start with low-stakes communications to build familiarity before relying on signatures for sensitive matters.

Troubleshooting

Configuration changes not taking effect

Restart the relevant service or application after making changes. Some settings require a full system reboot. Verify the configuration file path is correct and the syntax is valid.

Permission denied errors

Run the command with sudo for system-level operations, or check that your user account has the necessary permissions. On macOS, you may need to grant terminal access in System Settings > Privacy & Security.

Connection or network-related failures

Check your internet connection and firewall settings. If using a VPN, try disconnecting temporarily to isolate the issue. Verify that the target server or service is accessible from your network.

Frequently Asked Questions

Who is this article written for?

This article is written for developers, technical professionals, and power users who want practical guidance. Whether you are evaluating options or implementing a solution, the information here focuses on real-world applicability rather than theoretical overviews.

How current is the information in this article?

We update articles regularly to reflect the latest changes. However, tools and platforms evolve quickly. Always verify specific feature availability and pricing directly on the official website before making purchasing decisions.

Are there free alternatives available?

Free alternatives exist for most tool categories, though they typically come with limitations on features, usage volume, or support. Open-source options can fill some gaps if you are willing to handle setup and maintenance yourself. Evaluate whether the time savings from a paid tool justify the cost for your situation.

How do I get started quickly?

Pick one tool from the options discussed and sign up for a free trial. Spend 30 minutes on a real task from your daily work rather than running through tutorials. Real usage reveals fit faster than feature comparisons.

What is the learning curve like?

Most tools discussed here can be used productively within a few hours. Mastering advanced features takes 1-2 weeks of regular use. Focus on the 20% of features that cover 80% of your needs first, then explore advanced capabilities as specific needs arise.

Related Articles