Add an explicit server-encryption marker header for at-rest encrypted messages

Feature Ideas
1

Hi Stalwart team,

I’d like to propose adding an explicit marker for messages encrypted by the server at rest, such as a header like:

X-Encrypted-By: Server

or a similar server-added tag.

Right now, when at-rest encryption is enabled, it appears to be impossible for a user to reliably distinguish a message that was:

  1. already end-to-end encrypted by the sender, from
  2. encrypted by Stalwart for storage at rest.

That makes it difficult to know whether a message was protected end-to-end from the start, or simply wrapped by the server for zero-access storage.

I believe this is a meaningful missing feature for transparency and security auditing. A simple, explicit indicator would be enough:

  • X-Encrypted-By: Server
  • X-Stalwart-Encrypted-At-Rest: true
  • or another equivalent server-only header/metadata field

This would allow users to:

  • distinguish genuine E2E mail from server-side encryption,
  • avoid false assumptions about message confidentiality.