With Exim, you could just shove something like this in your DATA acl: deny condition = ${if !match{$message_body}{-----BEGIN PGP MESSAGE-----}} messag

With Exim, you could just shove something like this in your DATA acl: deny condition = ${if !match{$message_body}{-----BEGIN PGP MESSAGE-----}} message = We only accept encrypted mail here However, the problem here is that the plaintext has already been sent over the wire before the message is rejected.