Forum Bashkësie Thunderbird

Microsoft Outlook Client emails are legally valid in a court of law, but Thunderbird emails are not. Can we start taking baby steps towards making Thunderbird emails a little more viable in legal applications?

While I do not understand these things in the depth required, can we start taking baby steps towards achieving legal validity of emails downloaded from Thunderbird?

I am presenting below a conversation that I had with chat GPT regarding this matter for the help of anyone who wishes to take this up.

Chat GPT:

QUESTION 1: 1. As per my limited knowledge, Outlook client emails are legally valid because the header cannot be edited. This however, is not true of Thunderbird emails. Do I understand correctly? 2. What are the challenges in making Thunderbird header not user editable, so that Thunderbird emails also have the same benefit?

Chat GPT: Your question touches on email authenticity and legal validity—especially in regulated or evidence-sensitive contexts. Let's break it down:

Is it true that Outlook headers are immutable and Thunderbird’s are not?

Partially True — but needs clarification.

Email headers in both Outlook and Thunderbird

Can be viewed by recipients, but cannot be edited after the email has been sent. Only during composition can certain headers (like `From`, `Reply-To`) be changed, depending on the setup.

What you cannot change post-sending:

After an email is sent (from any client), the core SMTP headers (`Date`, `From`, `Message-ID`, etc.) are locked. These are generated by the sending server and cryptographically traceable via server logs or DKIM.

Outlook’s extra layer:

Outlook integrates closely with Microsoft Exchange, which stores server-side logs, message tracking, and non-editable audit trails (e.g., via journaling). That’s what gives Outlook/Exchange emails more evidentiary credibility, not just the client itself. In contrast, Thunderbird usually connects via standard IMAP/SMTP, without server-side logging, unless used with a corporate mail server like Postfix + Dovecot + journaling.

In Summary: Table Feature Outlook (w/ Exchange) Thunderbird Headers editable during composition Yes (some fields) Yes (same) Headers editable after sending No No Built-in server-side logging Yes (Exchange) No (unless configured) Strong evidentiary trail Common in enterprise Requires external setup

What are the challenges in making Thunderbird headers non-editable during composition?

The challenge lies not in technical impossibility, but in the design philosophy of Thunderbird:

a. Open Source & User Control

Thunderbird is open source, so users can customize or even extend the client to manipulate headers (via extensions or config changes). This is powerful for advanced users, but not ideal in regulated or high-trust environments.

b. Lack of Server-Side Enforcement

Thunderbird relies on whatever SMTP/IMAP servers it connects to. Unless the server enforces policies (like DKIM signing, DMARC, or header filtering), client settings are only soft limits.

c. Missing Native Audit Features

Outlook/Exchange logs metadata like when a message was sent, delivered, read, etc. Thunderbird lacks that unless paired with enterprise-grade backends. How Could Thunderbird Improve Legal Trustworthiness?

1. Header Locking During Composition

  	Disable or grey out fields like `From`, `Date`, `Message-ID`.
  	Possible via extension, but not enforced by default.

2. Enforced Server-Side Signing (e.g., DKIM)

  	Ensure outgoing mail is cryptographically signed to verify integrity.
  	Requires a properly configured mail server, not just Thunderbird.

3. Journaling or BCC Archiving

  	Auto-BCC all sent mail to a tamper-proof archival system.
  	Thunderbird can do this via rules or server configuration.

4. Extension or Mode for “Forensic Compliance”

  	Custom Thunderbird modes that restrict editing headers, disable extensions, log actions, etc.

Final Thoughts

You're correct in understanding that Thunderbird offers less baked-in legal reliability than Outlook + Exchange. But this isn’t due to insecure design—rather, it's due to Thunderbird’s flexibility and lack of tight server integration. Thunderbird can be made trustworthy with the right server configuration (DKIM, archiving) and possibly some custom add-ons.

If you’re looking to build or propose a “forensic-grade” Thunderbird environment, I can help design one with proper technical constraints and audit trails. Let me know!

QUESTION 2: My legal Counsel has told me that emails downloaded from the Gmail server into the outlook client are legally valid. So even without Microsoft Exchange and all the other server side logging, Outlook emails are legally viable. Chat GPT

Yes — your legal counsel is broadly correct, and here’s the nuanced explanation:

Emails Downloaded via Outlook (from Gmail) Can Be Legally Valid

Even without Microsoft Exchange, emails downloaded into Outlook (say via IMAP or POP from Gmail) can still be legally viable evidence, because:

1. Outlook stores email in a tamper-evident format

Outlook saves emails in `.pst` or `.ost` files. These files have a structured, proprietary binary format that is hard to tamper with without detection. Courts often accept these files (with chain of custody) as original records.

2. Outlook preserves server headers

Even when connected to Gmail, Outlook does not modify or fake headers. It shows server-signed headers (like `Message-ID`, `Date`, etc.) exactly as received. These headers can be verified independently against:

Gmail’s “Show Original” → raw headers DKIM/DMARC authentication

3. Integrity from Gmail itself

Gmail assigns unique `Message-ID`s and signs outgoing mail with DKIM. DKIM proves the message has not been tampered with since it left Google’s servers. So even if Outlook is the client, the source of trust is Gmail + DKIM, not just the software.

In Legal Contexts

4. What courts typically require is:

 A copy of the original message as received (headers intact)
 Some form of chain of custody (who had access, how was it stored)
 Optionally, confirmation from the mail server logs (if challenged)
 Outlook is often used in corporate/legal environments because:

It does not let users easily forge full headers The data format is harder to manipulate Legal teams and forensic experts are familiar with `.pst` files

So even without Exchange, emails received and stored in Outlook are trusted, provided:

The full headers are intact The `.pst` or `.ost` file has not been tampered with

5. How This Differs from Thunderbird

Thunderbird also preserves headers and stores messages locally — but: Table: Aspect Outlook Thunderbird Storage format `.pst`/`.ost` (proprietary) `.mbox` or plain text Header immutability Enforced by format Editable via text file (with effort) Forensic familiarity High (in legal circles) Moderate Tamper-evidence Strong (binary format) Weak (editable with text editors)

So Thunderbird messages can technically be altered more easily after download, especially if stored in `.mbox` or `.eml` formats. That’s why they are viewed with more caution in legal settings.

Conclusion

Yes — emails downloaded into Outlook, even from Gmail, are generally accepted as legally valid, provided the headers are intact and the file has not been manipulated. Outlook's storage format and market reputation contribute to its legal trustworthiness — even without Exchange.

If you want to achieve similar legal credibility with Thunderbird, the focus should be on:

Enforcing DKIM-signing (from Gmail, already done) Locking down `.eml` or `.mbox` file access Possibly archiving in tamper-evident formats

Let me know if you’d like a workflow to export Thunderbird emails into a legally robust format similar to `.pst`.

I'm trying to send encrypted email to a recipient who I have a certificate for, but Thunderbird states:

End-to-end encryption requires resolving certificate issues for ....

That's rather unhelpful - what issues exactly? I've imported the CA certs into the system and they are shown in TB. openssl verify on the cert returns OK. I'm at a loss as to what might be the issue.

Stolen laptop .Thunderbird had saved all my accounts passwords . I had no master password. Accounts were synced with my desktop .Now I installed Primary Password and, changed all my accounts passwords . Can the thief still access my accounts on stolen laptop. I backed up my profiles. Can messages on laptop be deleted . If I delete all messages from my desktop, will all messages also be deleted from stolen laptop if thief access thunderbird

I'm trying to send an OpenPGP-encrypted email from a Linux Mint machine using msmtp, relaying through the smtp server, to another Linux machine, to myself, running Thunderbird (with the sender's (my) imported private key already loaded and working in Thunderbird).

The encrypted test message is composed manually as a file (email.eml) and sent using msmtp from the command line. The email successfully passes through the SMTP relay, is received and decrypted by Thunderbird (so the OpenPGP decryption part works that much I know ... ), but the plain text content is not rendered properly and the email is displayed blank, no plain text as expected. Thunderbird has decrypted the message, but it’s not being displayed or rendered.

This makes me think the issue lies in the structure or MIME headers/parts of the .eml file itself — specifically how the encrypted message body is wrapped. This is not something I'm entirely familiar with, and even less so with what Thunderbird expects for a PGP encrypted message...

I suspect the issue is due to incorrect MIME formatting or missing headers (Content-Type, Content-Transfer-Encoding, Charset, or boundaries etc.) needed for Thunderbird to correctly render the decrypted body into plain text once it receives it. Since I’m assembling the .eml manually (and eventually by a script whej I get to it), I may be overlooking certain structural requirements that typical mail clients (say Thunderbird or similar) or gpg front-ends (like mutt, mailx ...) would handle automatically.

My questions are: Is there a correct MIME structure or format expected by Thunderbird for OpenPGP-encrypted emails ? Is this documented anywhere specifically for Thunderbird ? Or, are there publicly available examples or specs that describe how such an email should be structured (e.g., RFCs or working .eml templates)?

Is there a known way to validate or "lint" .eml files for OpenPGP compatibility ? That would be nice ;-)

As I said the internals or MIME formatting is not my thing usually. Any pointers to Th.B. documentation, sample files, or tools that help with .eml structure validation would be grately appreciated.

Thanks in advance, cheers MM

Hi all,

for signing PDFs with my SMIME certificate, another 3rd party software (LibreOffice) uses the Thunderbird profile folder (nssdb stored which is located there). After some investigation by myself, it could be a problem within Thunderbird certificate management itself.

Situation: I've a current and some outdated SMIME certificates for my mail address. But all for one mail address.

Because the current SMIME certificate is not accessible for LibreOffice, I removed temporary all of my outdated SMIME certificates from Thunderbird by the builtin certificate management, i.e. the list of my personal certificates was set to one entry (=the current certificate) in Thunderbird. But even then, LibreOffice lists only an outdated certificate (which is not visible anymore in the Thunderbird builtin certificate management).

Therefore I've checked with certutil the nssdb entries in the Thunderbird profile folder. Surprisingly, there is an outdated SMIME to my mail address contained (no further, even not the current one). Even after removal of those outdated certificates via the builtin certificate management. The current certificate is never listed; always only an outdated one.

This looks like a difference between builtin certificate management and nssdb within the profile folder (or may for another storage location of the certificates)?

certutil -L -d ~/.thunderbird/myprofilefolder --email mymailaddress

Thanks in advance!

Environment OS: Ubuntu 24.04.2 LTS Thunderbird: 128.12.0esr (64-Bit)

Trying to use Thunderbird after break of some years and want to use Proton Mail. Every time I try to set it up I get message 'the certificate 127.0.0.1does not come from trusted source'. Previous experience of Thunderbird was that there were frequent issues like this arising.

I have been using Thunderbird forr many years and earthlink is my server. After doing many emails this morning Thunderbird stopped sending emails and showed a Security Certificate alert problem for smtpauth.earthlink.net:587 that i had nor seen before. I tried to over ride but could not. I can still receive emails. dan_doherty@earthlink.net

I've been using Thunderbird for my earthlink.net accounts for years. Now I'm getting an Error that "Peer's Certificate issuer is not recognized. My earthlink.net settings have not changed. Help.

Hello! i havent used Thunderbird or anything like it ever before and have a huge issue at hand! somebody hacked my google account and linked a thunderbird/POP/IMAP or whatever it is called. in my google/ Gmail account i have disabled all POP/IMAP, or other devices that are not mine yet the hacker keeps receiving the emails from the email i have resecured and can look at them. One of them is a EA account which he has used to recover everything on it. Now my actual question, is it possible to remove a Thunderbird IMAP/POP link through google itself or is that not doable? best regards and in hopes of someone quickly finding this, as a lot of money was spent.

Thanks in advance

Unable to receive new emails sending works fine. Receiving emails works with no security but do not wish to continue with this mode. No errors for ssl/tls, just doesn't receive emails. I tried switching to oAuth2 but no go either. Version: 128.10.2esr. This started on the 21st of May.

Thunderbird has started repeated prompting me for a security exception on a certificate supposedly issued by www.b-g.k12.ky.us (a site associated with my grandson's school system). This site is not one of my email servers. So why is Thunderbird complaining about its certificate?

I have spent some time digging through your messages about how to fix this issue. I get the general "where to" enable SSL/TLS but no trouble shooting to this specific level.

Spectrum (charter) Internet on May-30-25 a pop up "Add Security Exception" on wife's account (Image #1 below). We have same Internet provider and same server config's (except email name & password or course).

 This Security Exception has happened before, as well as on my account in the past. 

Although, I never got the Exception this time. We did "Confirm Security Exception" 2x on her account and she is up and running again. No issues.

  However, I can't receive e-mails with the Account Settings / Server Settings / Security Settings

"Connection Security" set to SSL/TLS" it must be set to "None" When set to SSL/TLS and I push the "Get Mail" button, the server isn't even banged as there's no msg in lower left frame of TB. I have gmail account and it does bang that one like it should. If set to "None" I get the msg in lower left TB frame showing connection to Charter server and I receive any outstanding e-mails. But I don't want to continue without a password.

 Under [Settings/ Privacy & security / Manage Certificates]

hers (Image #2 below) looks different than mine (Image #3 below). She has the 2 confirmed Security Exceptions, but also has a "View" and "Export" button that are bolded when the specific line item is highlighted. I do not have a View or Export button shown. How do I enable the SSL/TLS with password and actually receive emails?

 I am using TB 128.11.0esr (64-bit)

thx in advance Gene

Greetings. I'm using Thunderbird with SendGrid. I have three accounts I'm trying to send mail through. SendGrid uses a username of "apikey" and a long key as the password. I read the instructions here: https://support.mozilla.org/en-US/questions/1495483 which seems to suggest this is possible. I've set up accounts for each of the three and they all work as long as I don't save the password. When I save the password the smtp saved password is saved for whichever one I'm using. I can't seem to save all three. If I save one and then move to the next account, the old password is used.

Can anyone confirm if this is possible? And if so can I get some suggestions about what I may be doing wrong?

I've read several of the threads that suggest that most people go wrong when they select the smtp server. I have followed the directions to select from the Outgoing Server list at the bottom of the left pane. Each copy of the smtp server has a unique description. I suspect its because the username is the same for each one. Which is required by SendGrid. Thanks!

I am pestered by emails which I don't want, I have tried setting up filters but some do not seem to work as the emails are not deleted before going into my Bulk folder. One of the most persistent ones is cloud@hotmail.com, which is something I do not use. How can I stop all these spam (fraud) emails for once and for all, please put it in simple language as I am not very computer savvy.

Geoff

Hello

I've been setting up Thunderbird on MacOS. I was adding few Gmail accounts. Every account was using 2FA so I had to enter new verification code each time. When I was adding 3rd or 4th account and was entering Google verification code into the form it suggested one of the codes I used before. Codes had same first two numbers so I guess I know why this form suggested one of the old codes but where does Thunderbird store these codes? I've deleted search history and cache in Thunderbird and attempted adding another gmail account but this time when I was asked for 2FA code I started with older verification codes and this form remembered all of them. Is there a way to remove them? Where does Thunderbird store these codes?

Thanks for any suggestions

Hi. I donate 20 bucks a month to Thunderbird. Love it.

Was wondering if there is a way to disable the "support thunderbird" pop ups that always occur upon launch.

Much obliged.

I've finished setting up the S/MIME encryption in Thunderbird, and imported all the certificates needed. When people with the certificates emailed me, I could receive and read all the emails. However, when I replied to the same people, I got the error message saying 'End-to-end encryption requires resolving cerficiate issues'. My colleagues imported the same certificates without any issues. Do you have any suggestions for me to solve the issue? Thank you very much!

When I logged in today after a few days away I realised I was not getting any Task Reminders, although there should have been several for repeating tasks which were due whilst I was away. On looking in the Calendar window I found that all the Tasks had disappeared. How do I get them back? (I do have the computer backed up with Macrium Reflect, so I could restore the file(s) from last week, but I have no idea where the Calendar data is stored.)

The body of the email marked "junk" is blank, so how can I determine whether or not it's actually junk? Other email programs I've used show at least the basic plain text content, blocking images and links.