There's a difference-- point-to-point encryption is what you're talking about. Anytime a message is transferred, it's done via TLS, but you can't be guaranteed

There's a difference-- point-to-point encryption is what you're talking about. Anytime a message is transferred, it's done via TLS, but you can't be guaranteed that at any one point the message is kept encrypted. You can have this today -- just about any MTA has a configuration to only allow TLS connections, and then you can set up an IMAP server to only allow encrypted connections. End-to-end encryption is the system whereby the moment the message leaves the sender's hands (phone, desktop, whatever) it's encrypted until it gets into the receiver's hands. This is your OpenPGP/etc. You could think of that as "Signal for email". This is apparently not what Magma is doing. Here's the relevant line from Github: https://github.com/lavabit/magma/blob/develop/src/providers/checkers/clamav.c#L387 https://github.com/lavabit/magma/blob/develop/src/providers/... You can see that Magma is writing the email message to a file and instructing ClamAV to scan the file. This is actually worse than writing to a clamd socket, since (imho) it would be easier for someone to monitor a directory in a filesystem on a compromised Magma server. Compare this to how SpamAssassin communicates with ClamAV-- it streams to either the port or socket: https://wiki.apache.org/spamassassin/ClamAVPlugin https://wiki.apache.org/spamassassin/ClamAVPlugin