diff --git a/src/chatlist.rs b/src/chatlist.rs
index 534dccf91..ccb36d40c 100644
--- a/src/chatlist.rs
+++ b/src/chatlist.rs
@@ -473,6 +473,7 @@ mod tests {
         add_contact_to_chat, create_broadcast, create_group, get_chat_contacts,
         remove_contact_from_chat, send_text_msg, set_chat_name,
     };
+    use crate::config::Config;
     use crate::receive_imf::receive_imf;
     use crate::securejoin::get_securejoin_qr;
     use crate::stock_str::StockMessage;
@@ -665,6 +666,7 @@ mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn test_search_single_chat() -> anyhow::Result<()> {
         let t = TestContext::new_alice().await;
+        t.set_config(Config::ProcessUnencrypted, Some("1")).await?;
 
         // receive a one-to-one-message
         receive_imf(
@@ -725,6 +727,7 @@ mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn test_search_single_chat_without_authname() -> anyhow::Result<()> {
         let t = TestContext::new_alice().await;
+        t.set_config(Config::ProcessUnencrypted, Some("1")).await?;
 
         // receive a one-to-one-message without authname set
         receive_imf(
diff --git a/src/config.rs b/src/config.rs
index f0ca2fafb..447b47f92 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -486,6 +486,11 @@ pub enum Config {
     /// Experimental option denoting that the current profile is shared between multiple team members.
     /// For now, the only effect of this option is that seen flags are not synchronized.
     TeamProfile,
+
+    /// Process unencrypted messages.
+    ///
+    /// Unencrypted messages are fetched and processed only if this setting is explicitly enabled.
+    ProcessUnencrypted,
 }
 
 impl Config {
diff --git a/src/context.rs b/src/context.rs
index 95ce3c777..ff559fb86 100644
--- a/src/context.rs
+++ b/src/context.rs
@@ -1056,6 +1056,12 @@ impl Context {
             "team_profile",
             self.get_config_bool(Config::TeamProfile).await?.to_string(),
         );
+        res.insert(
+            "process_unencrypted",
+            self.get_config_bool(Config::ProcessUnencrypted)
+                .await?
+                .to_string(),
+        );
 
         let elapsed = time_elapsed(&self.creation_time);
         res.insert("uptime", duration_to_str(elapsed));
diff --git a/src/imap.rs b/src/imap.rs
index 892253bc2..09c89eda3 100644
--- a/src/imap.rs
+++ b/src/imap.rs
@@ -1996,12 +1996,21 @@ pub(crate) async fn prefetch_should_download(
     // prevent_rename=true as this might be a mailing list message and in this case it would be bad if we rename the contact.
     // (prevent_rename is the last argument of from_field_to_contact_id())
 
+    let is_encrypted = if let Some(content_type) = headers.get_header_value(HeaderDef::ContentType)
+    {
+        mailparse::parse_content_type(&content_type).mimetype == "multipart/encrypted"
+    } else {
+        false
+    };
+
     if flags.any(|f| f == Flag::Draft) {
         info!(context, "Ignoring draft message");
         return Ok(false);
     }
 
-    let should_download = !blocked_contact || maybe_ndn;
+    let should_download = maybe_ndn
+        || (!blocked_contact
+            && (is_encrypted || context.get_config_bool(Config::ProcessUnencrypted).await?));
     Ok(should_download)
 }
 
diff --git a/src/imap/session.rs b/src/imap/session.rs
index 8d4e7e087..e1e397574 100644
--- a/src/imap/session.rs
+++ b/src/imap/session.rs
@@ -21,6 +21,7 @@ const PREFETCH_FLAGS: &str = "(UID RFC822.SIZE BODY.PEEK[HEADER.FIELDS (\
                               DATE \
                               X-MICROSOFT-ORIGINAL-MESSAGE-ID \
                               FROM \
+                              CONTENT-TYPE \
                               CHAT-VERSION \
                               CHAT-IS-POST-MESSAGE \
                               AUTOCRYPT-SETUP-MESSAGE\
diff --git a/src/receive_imf.rs b/src/receive_imf.rs
index 35b60002e..fc5b4dac9 100644
--- a/src/receive_imf.rs
+++ b/src/receive_imf.rs
@@ -505,6 +505,11 @@ pub(crate) async fn receive_imf_inner(
         Ok(mime_parser) => mime_parser,
     };
 
+    if !mime_parser.was_encrypted() && !context.get_config_bool(Config::ProcessUnencrypted).await? {
+        warn!(context, "Fetched unencrypted message, ignoring");
+        return trash().await;
+    }
+
     let rfc724_mid_orig = &mime_parser
         .get_rfc724_mid()
         .unwrap_or(rfc724_mid.to_string());