// Load a MimeMessage from a stream
var message = MimeMessage.Load (stream);

// Load a MimeMessage from a file path
var message = MimeMessage.Load ("message.eml");

// Load a MimeMessage from a stream
var parser = new MimeParser (stream, MimeFormat.Entity);
var message = parser.ParseMessage ();

// Load every message from a Unix mbox
var parser = new MimeParser (stream, MimeFormat.Mbox);
while (!parser.IsEndOfStream) {
    var message = parser.ParseMessage ();

    // do something with the message
}

var attachments = new List<MimePart> ();
var multiparts = new List<Multipart> ();
var iter = new MimeIterator (message);

// collect our list of attachments and their parent multiparts
while (iter.MoveNext ()) {
    var multipart = iter.Parent as Multipart;
    var part = iter.Current as MimePart;

    if (multipart != null && part != null && part.IsAttachment) {
        // keep track of each attachment's parent multipart
        multiparts.Add (multipart);
        attachments.Add (part);
    }
}

// now remove each attachment from its parent multipart...
for (int i = 0; i < attachments.Count; i  )
    multiparts[i].Remove (attachments[i]);

foreach (var part in message.BodyParts) {
   // do something
}

// This will get the name of the file as specified by the sending mail client.
// Note: this value *may* be null, so you'll want to handle that case in your code.
var fileName = part.FileName;

using (var stream = File.Create (fileName)) {
    part.Content.DecodeTo (stream);
}

using (var stream = part.Content.Open ()) {
    // At this point, you can now read from the stream as if it were the original,
    // raw content. Assuming you have an image UI control that could load from a
    // stream, you could do something like this:
    imageControl.Load (stream);
}

var message = new MimeMessage ();
message.From.Add (new MailboxAddress ("Joey", "[email protected]"));
message.To.Add (new MailboxAddress ("Alice", "[email protected]"));
message.Subject = "How you doin?";

message.Body = new TextPart ("plain") {
    Text = @"Hey Alice,

What are you up to this weekend? Monica is throwing one of her parties on
Saturday and I was hoping you could make it.

Will you be my  1?

-- Joey
"
};

var message = new MimeMessage ();
message.From.Add (new MailboxAddress ("Joey", "[email protected]"));
message.To.Add (new MailboxAddress ("Alice", "[email protected]"));
message.Subject = "How you doin?";

// create our message text, just like before (except don't set it as the message.Body)
var body = new TextPart ("plain") {
    Text = @"Hey Alice,

What are you up to this weekend? Monica is throwing one of her parties on
Saturday and I was hoping you could make it.

Will you be my  1?

-- Joey
"
};

// create an image attachment for the file located at path
var attachment = new MimePart ("image", "gif") {
    Content = new MimeContent (File.OpenRead (path), ContentEncoding.Default),
    ContentDisposition = new ContentDisposition (ContentDisposition.Attachment),
    ContentTransferEncoding = ContentEncoding.Base64,
    FileName = Path.GetFileName (path)
};

// now create the multipart/mixed container to hold the message text and the
// image attachment
var multipart = new Multipart ("mixed");
multipart.Add (body);
multipart.Add (attachment);

// now set the multipart/mixed as the message body
message.Body = multipart;

var attachment = CreateAttachment ();
var plain = CreateTextPlainPart ();
var html = CreateTextHtmlPart ();

// Note: it is important that the text/html part is added second, because it is the
// most expressive version and (probably) the most faithful to the sender's WYSIWYG 
// editor.
var alternative = new Multipart ("alternative");
alternative.Add (plain);
alternative.Add (html);

// now create the multipart/mixed container to hold the multipart/alternative
// and the image attachment
var multipart = new Multipart ("mixed");
multipart.Add (alternative);
multipart.Add (attachment);

// now set the multipart/mixed as the message body
message.Body = multipart;

var message = new MimeMessage ();
message.From.Add (new MailboxAddress ("Joey", "[email protected]"));
message.To.Add (new MailboxAddress ("Alice", "[email protected]"));
message.Subject = "How you doin?";

var builder = new BodyBuilder ();

// Set the plain-text version of the message text
builder.TextBody = @"Hey Alice,

What are you up to this weekend? Monica is throwing one of her parties on
Saturday and I was hoping you could make it.

Will you be my  1?

-- Joey
";

// generate a Content-Id for the image we'll be referencing
var contentId = MimeUtils.GenerateMessageId ();

// Set the html version of the message text
builder.HtmlBody = string.Format (@"<p>Hey Alice,<br>
<p>What are you up to this weekend? Monica is throwing one of her parties on
Saturday and I was hoping you could make it.<br>
<p>Will you be my  1?<br>
<p>-- Joey<br>
<center><img src=""cid:{0}"" alt=""selfie.jpg""></center>", contentId);

// Since selfie.jpg is referenced from the html text, we'll need to add it
// to builder.LinkedResources and then set the Content-Id header value
builder.LinkedResources.Add (@"C:\Users\Joey\Documents\Selfies\selfie.jpg");
builder.LinkedResources[0].ContentId = contentId;

// We may also want to attach a calendar event for Monica's party...
builder.Attachments.Add (@"C:\Users\Joey\Documents\party.ics");

// Now we just need to set the message body and we're done
message.Body = builder.ToMessageBody ();

using System.Data.SQLite;
using MimeKit.Cryptography;

using MyAppNamespace {
    class MySecureMimeContext : DefaultSecureMimeContext
    {
        public MySecureMimeContext () : base (OpenDatabase ("C:\\wherever\\certdb.sqlite"))
        {
        }

        static IX509CertificateDatabase OpenDatabase (string fileName)
        {
            var builder = new SQLiteConnectionStringBuilder ();
            builder.DateTimeFormat = SQLiteDateFormats.Ticks;
            builder.DataSource = fileName;

            if (!File.Exists (fileName))
                SQLiteConnection.CreateFile (fileName);

            var sqlite = new SQLiteConnection (builder.ConnectionString);
            sqlite.Open ();

            return new SqliteCertificateDatabase (sqlite, "password");
        }
    }
}

CryptographyContext.Register (typeof (MySecureMimeContext));

using MimeKit.Cryptography;

namespace MyAppNamespace {
    class MyGnuPGContext : GnuPGContext
    {
        public MyGnuPgContext () : base ()
        {
        }

        protected override string GetPasswordForKey (PgpSecretKey key)
        {
            // prompt the user (or a secure password cache) for the password for the specified secret key.
            return "password";
        }
    }
}

CryptographyContext.Register (typeof (MyGnuPGContext));

var joey = new MailboxAddress ("Joey", "[email protected]");
var alice = new MailboxAddress ("Alice", "[email protected]");

var message = new MimeMessage ();
message.From.Add (joey);
message.To.Add (alice);
message.Subject = "How you doin?";

// create our message body (perhaps a multipart/mixed with the message text and some
// image attachments, for example)
var body = CreateMessageBody ();

// now to encrypt our message body using our custom S/MIME cryptography context
using (var ctx = new MySecureMimeContext ()) {
    // Note: this assumes that "Alice" has an S/MIME certificate with an X.509
    // Subject Email identifier that matches her email address. If she doesn't,
    // try using a SecureMailboxAddress which allows you to specify the
    // fingerprint of her certificate to use for lookups.
    message.Body = ApplicationPkcs7Mime.Encrypt (ctx, message.To.Mailboxes, body);
}

if (entity is ApplicationPkcs7Mime) {
    var pkcs7 = (ApplicationPkcs7Mime) entity;

    if (pkcs7.SecureMimeType == SecureMimeType.EnvelopedData)
        return pkcs7.Decrypt ();
}

var joey = new MailboxAddress ("Joey", "[email protected]");
var alice = new MailboxAddress ("Alice", "[email protected]");

var message = new MimeMessage ();
message.From.Add (joey);
message.To.Add (alice);
message.Subject = "How you doin?";

// create our message body (perhaps a multipart/mixed with the message text and some
// image attachments, for example)
var body = CreateMessageBody ();

// now to encrypt our message body using our custom PGP/MIME cryptography context
using (var ctx = new MyGnuPGContext ()) {
    // Note: this assumes that "Alice" has a public PGP key that matches her email
    // address. If she doesn't, try using a SecureMailboxAddress which allows you
    // to specify the fingerprint of her public PGP key to use for lookups.
    message.Body = MultipartEncrypted.Encrypt (ctx, message.To.Mailboxes, body);
}

if (entity is MultipartEncrypted) {
    var encrypted = (MultipartEncrypted) entity;

    return encrypted.Decrypt ();
}

var joey = new MailboxAddress ("Joey", "[email protected]");
var alice = new MailboxAddress ("Alice", "[email protected]");

var message = new MimeMessage ();
message.From.Add (joey);
message.To.Add (alice);
message.Subject = "How you doin?";

// create our message body (perhaps a multipart/mixed with the message text and some
// image attachments, for example)
var body = CreateMessageBody ();

// now to digitally sign our message body using our custom S/MIME cryptography context
using (var ctx = new MySecureMimeContext ()) {
    // Note: this assumes that "Joey" has an S/MIME signing certificate and private key
    // with an X.509 Subject Email identifier that matches Joey's email address.
    message.Body = MultipartSigned.Create (ctx, joey, DigestAlgorithm.Sha1, body);
}

// now to digitally sign our message body using our custom S/MIME cryptography context
using (var ctx = new MySecureMimeContext ()) {
    var certificate = GetJoeysX509Certificate ();
    var signer = new CmsSigner (certificate);
    signer.DigestAlgorithm = DigestAlgorithm.Sha1;

    message.Body = MultipartSigned.Create (ctx, signer, body);
}

// now to digitally sign our message body using our custom OpenPGP cryptography context
using (var ctx = new MyGnuPGContext ()) {
    // Note: this assumes that "Joey" has a PGP key that matches his email address.
    message.Body = MultipartSigned.Create (ctx, joey, DigestAlgorithm.Sha1, body);
}

// now to digitally sign our message body using our custom OpenPGP cryptography context
using (var ctx = new MyGnuPGContext ()) {
    var key = GetJoeysPrivatePgpKey ();
    message.Body = MultipartSigned.Create (ctx, key, DigestAlgorithm.Sha1, body);
}

if (entity is MultipartSigned) {
    var signed = (MultipartSigned) entity;

    foreach (var signature in signed.Verify ()) {
        try {
            bool valid = signature.Verify ();

            // If valid is true, then it signifies that the signed content has not been
            // modified since this particular signer signed the content.
            //
            // However, if it is false, then it indicates that the signed content has
            // been modified.
        } catch (DigitalSignatureVerifyException) {
            // There was an error verifying the signature.
        }
    }
}

if (entity is ApplicationPkcs7Mime) {
    var pkcs7 = (ApplicationPkcs7Mime) entity;

    if (pkcs7.SecureMimeType == SecureMimeType.SignedData) {
        // extract the original content and get a list of signatures
        MimeEntity extracted;

        // Note: if you are rendering the message, you'll want to render the
        // extracted mime part rather than the application/pkcs7-mime part.
        foreach (var signature in pkcs7.Verify (out extracted)) {
            try {
                bool valid = signature.Verify ();

                // If valid is true, then it signifies that the signed content has not
                // been modified since this particular signer signed the content.
                //
                // However, if it is false, then it indicates that the signed content
                // has been modified.
            } catch (DigitalSignatureVerifyException) {
                // There was an error verifying the signature.
            }
        }
    }
}

var headers = new HeaderId[] { HeaderId.From, HeaderId.Subject, HeaderId.Date };
var signer = new DkimSigner ("privatekey.pem", "example.com", "brisbane", DkimSignatureAlgorithm.RsaSha256) {
	HeaderCanonicalizationAlgorithm = DkimCanonicalizationAlgorithm.Simple,
	BodyCanonicalizationAlgorithm = DkimCanonicalizationAlgorithm.Simple,
	AgentOrUserIdentifier = "@eng.example.com",
	QueryMethod = "dns/txt",
};

// Prepare the message body to be sent over a 7bit transport (such as older versions of SMTP).
// Note: If the SMTP server you will be sending the message over supports the 8BITMIME extension,
// then you can use `EncodingConstraint.EightBit` instead.
message.Prepare (EncodingConstraint.SevenBit);

signer.Sign (message, headers);

using System;
using System.IO;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using System.Collections.Generic;

using Heijden.DNS;

using Org.BouncyCastle.Crypto;

using MimeKit;
using MimeKit.Cryptography;

namespace DkimVerifierExample
{
	// Note: By using the DkimPublicKeyLocatorBase, we avoid having to parse the DNS TXT records
	// in order to get the public key ourselves.
	class DkimPublicKeyLocator : DkimPublicKeyLocatorBase
	{
		readonly Dictionary<string, AsymmetricKeyParameter> cache;
		readonly Resolver resolver;

		public DkimPublicKeyLocator ()
		{
			cache = new Dictionary<string, AsymmetricKeyParameter> ();

			resolver = new Resolver ("8.8.8.8") {
				TransportType = TransportType.Udp,
				UseCache = true,
				Retries = 3
			};
		}

		AsymmetricKeyParameter DnsLookup (string domain, string selector, CancellationToken cancellationToken)
		{
			var query = selector   "._domainkey."   domain;
			AsymmetricKeyParameter pubkey;

			// checked if we've already fetched this key
			if (cache.TryGetValue (query, out pubkey))
				return pubkey;

			// make a DNS query
			var response = resolver.Query (query, QType.TXT);
			var builder = new StringBuilder ();

			// combine the TXT records into 1 string buffer
			foreach (var record in response.RecordsTXT) {
				foreach (var text in record.TXT)
					builder.Append (text);
			}

			var txt = builder.ToString ();

                        // DkimPublicKeyLocatorBase provides us with this helpful method.
                        pubkey = GetPublicKey (txt);
			
			cache.Add (query, pubkey);
			
			return pubkey;
		}

		public AsymmetricKeyParameter LocatePublicKey (string methods, string domain, string selector, CancellationToken cancellationToken = default (CancellationToken))
		{
			var methodList = methods.Split (new char[] { ':' }, StringSplitOptions.RemoveEmptyEntries);
			for (int i = 0; i < methodList.Length; i  ) {
				if (methodList[i] == "dns/txt")
					return DnsLookup (domain, selector, cancellationToken);
			}

			throw new NotSupportedException (string.Format ("{0} does not include any suported lookup methods.", methods));
		}

		public Task<AsymmetricKeyParameter> LocatePublicKeyAsync (string methods, string domain, string selector, CancellationToken cancellationToken = default (CancellationToken))
		{
			return Task.Run (() => {
				return LocatePublicKey (methods, domain, selector, cancellationToken);
			}, cancellationToken);
		}
	}

	class Program
	{
		public static void Main (string[] args)
		{
			if (args.Length == 0) {
				Help ();
				return;
			}

			for (int i = 0; i < args.Length; i  ) {
				if (args[i] == "--help") {
					Help ();
					return;
				}
			}

			var locator = new DkimPublicKeyLocator ();
			var verifier = new DkimVerifier (locator);

			for (int i = 0; i < args.Length; i  ) {
				if (!File.Exists (args[i])) {
					Console.Error.WriteLine ("{0}: No such file.", args[i]);
					continue;
				}

				Console.Write ("{0} -> ", args[i]);

				var message = MimeMessage.Load (args[i]);
				var index = message.Headers.IndexOf (HeaderId.DkimSignature);

				if (index == -1) {
					Console.WriteLine ("NO SIGNATURE");
					continue;
				}

				var dkim = message.Headers[index];

				if (verifier.Verify (message, dkim)) {
					// the DKIM-Signature header is valid!
					Console.ForegroundColor = ConsoleColor.Green;
					Console.WriteLine ("VALID");
					Console.ResetColor ();
				} else {
					// the DKIM-Signature is invalid!
					Console.ForegroundColor = ConsoleColor.Red;
					Console.WriteLine ("INVALID");
					Console.ResetColor ();
				}
			}
		}

		static void Help ()
		{
			Console.WriteLine ("Usage is: DkimVerifier [options] [messages]");
			Console.WriteLine ();
			Console.WriteLine ("Options:");
			Console.WriteLine ("  --help               This help menu.");
		}
	}
}

using System;
using System.Linq;
using System.Threading;
using System.Threading.Tasks;
using System.Collections.Generic;

using MimeKit;
using MimeKit.Cryptography;

namespace ArcSignerExample
{
	class MyArcSigner : ArcSigner
	{
		public MyArcSigner (string fileName, string domain, string selector, DkimSigningAlgorithm algorithm = DkimSignatureAlgorithm.RsaSha256)
		       : base (fileName, domain, selector, algorithm)
		{
		}

		/// <summary>
		/// Generate the ARC-Authentication-Results header.
		/// </summary>
		/// <remarks>
		/// The ARC-Authentication-Results header contains information detailing the results of
		/// authenticating/verifying the message via ARC, DKIM, SPF, etc.
		///
		/// In the following implementation, we assume that all of these authentication results
		/// have already been determined by other mail software that has added some Authentication-Results
		/// headers containing this information.
		///
		/// Note: This method is used when ArcSigner.Sign() is called instead of ArcSigner.SignAsync().
		/// </remarks>
		protected override AuthenticationResults GenerateArcAuthenticationResults (FormatOptions options, MimeMessage message, CancellationToken cancellationToken)
		{
			const string AuthenticationServiceIdentifier = "lists.example.com";

			var results = new AuthenticationResults (AuthenticationServiceIdentifier);

			for (int i = 0; i < message.Headers.Count; i  ) {
				var header = message.Headers[i];

				if (header.Id != HeaderId.AuthenticationResults)
					continue;

				if (!AuthenticationResults.TryParse (header.RawValue, out AuthenticationResults authres))
					continue;

				if (authres.AuthenticationServiceIdentifier != AuthenticationServiceIdentifier)
					continue;

				// Merge any authentication results that aren't already known.
				foreach (var result in authres.Results) {
					if (!results.Results.Any (r => r.Method == result.Method))
						results.Results.Add (result);
				}
			}

			return results;
		}

		/// <summary>
		/// Generate the ARC-Authentication-Results asynchronously.
		/// </summary>
		/// <remarks>
		/// The ARC-Authentication-Results header contains information detailing the results of
		/// authenticating/verifying the message via ARC, DKIM, SPF, etc.
		///
		/// In the following implementation, we assume that we have to verify all of the various
		/// authentication methods ourselves.
		///
		/// Note: This method is used when ArcSigner.SignAsync() is called instead of ArcSigner.Sign().
		/// </remarks>
		protected override async Task<AuthenticationResults> GenerateArcAuthenticationResultsAsync (FormatOptions options, MimeMessage message, CancellationToken cancellationToken)
		{
			const string AuthenticationServiceIdentifier = "lists.example.com";

			var results = new AuthenticationResults (AuthenticationServiceIdentifier);
			var locator = new DkimPublicKeyLocator (); // from the DKIM example above
			var dkimVerifier = new DkimVerifier (locator);
			var arcVerifier = new ArcVerifier (locator);
			AuthenticationMethodResult method;

			// Add the ARC authentication results
			try {
				var arc = await arcVerifier.VerifyAsync (message, cancellationToken);
				var result = arc.Chain.ToString ().ToLowerInvariant ();

				method = new AuthenticationMethodResult ("arc", result);
				results.Results.Add (method);
			} catch {
				// Likely a DNS error
				method = new AuthenticationMethodResult ("arc", "fail");
				method.Reason = "DNS error";
				results.Results.Add (method);
			}

			// Add authentication results for each DKIM signature
			foreach (var dkimHeader in message.Headers.Where (h => h.Id == HeaderId.DkimSignature)) {
				string result;

				try {
					if (await dkimVerifier.VerifyAsync (message, cancellationToken)) {
						result = "pass";
					} else {
						result = "fail";
					}
				} catch {
					result = "fail";
				}

				method = new AuthenticationMethodResult ("dkim", result);

				// Parse the DKIM-Signature header so that we can add some
				// properties to our method result.
				var params = dkimHeader.Value.Replace (" ", "").Split (new char[] { ';' });
				var i = params.FirstOrDefault (p => p.StartsWith ("i=", StringComparison.Ordinal));
				var b = params.FirstOrDefault (p => p.StartsWith ("b=", StringComparison.Ordinal));

				if (i != null)
					method.Parameters.Add ("header.i", i.Substring (2));

				if (b != null)
					method.Parameters.Add ("header.b", b.Substring (2, 8));

				results.Results.Add (method);
			}

			return results;
		}
	}
}

var headers = new HeaderId[] { HeaderId.From, HeaderId.Subject, HeaderId.Date };
var signer = new MyArcSigner ("privatekey.pem", "example.com", "brisbane", DkimSignatureAlgorithm.RsaSha256) {
	HeaderCanonicalizationAlgorithm = DkimCanonicalizationAlgorithm.Relaxed,
	BodyCanonicalizationAlgorithm = DkimCanonicalizationAlgorithm.Relaxed,
	AgentOrUserIdentifier = "@eng.example.com"
};

// Prepare the message body to be sent over a 7bit transport (such as older versions of SMTP).
// Note: If the SMTP server you will be sending the message over supports the 8BITMIME extension,
// then you can use `EncodingConstraint.EightBit` instead.
message.Prepare (EncodingConstraint.SevenBit);

signer.Sign (message, headers); // or SignAsync

var verifier = new ArcVerifier (new DkimPublicKeyLocator ());
var results = await verifier.VerifyAsync (message);

// The Chain results are the only real important results.
Console.WriteLine ("ARC results: {0}", results.Chain);