diff --git a/deltachat-jsonrpc/src/api.rs b/deltachat-jsonrpc/src/api.rs
index 3bf828850..a1cc8699a 100644
--- a/deltachat-jsonrpc/src/api.rs
+++ b/deltachat-jsonrpc/src/api.rs
@@ -571,6 +571,30 @@ impl CommandApi {
         ctx.delete_transport(&addr).await
     }
 
+    // TODO not sure if that's a good API design,
+    // but I'm also not sure about an alternative - Adding to EnteredLoginParam?
+    async fn set_transport_unpublished(
+        &self,
+        account_id: u32,
+        addr: String,
+        unpublished: bool,
+    ) -> Result<()> {
+        let ctx = self.get_context(account_id).await?;
+        ctx.set_transport_unpublished(addr, unpublished).await
+    }
+
+    // TODO not sure if that's a good API design,
+    // but I'm also not sure about an alternative - Adding to EnteredLoginParam?
+    async fn get_transport_unpublished(
+        &self,
+        account_id: u32,
+        addr: String,
+        unpublished: bool,
+    ) -> Result<()> {
+        let ctx = self.get_context(account_id).await?;
+        ctx.get_transport_unpublished(addr, unpublished).await
+    }
+
     /// Signal an ongoing process to stop.
     async fn stop_ongoing_process(&self, account_id: u32) -> Result<()> {
         let ctx = self.get_context(account_id).await?;
diff --git a/src/config.rs b/src/config.rs
index f524efb64..c842b41ba 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -974,7 +974,23 @@ impl Context {
             .await
     }
 
+    /// Returns all published self addresses, newest first.
+    /// See TODO API
+    pub(crate) async fn get_published_self_addrs(&self) -> Result<Vec<String>> {
+        self.sql
+            .query_map_vec(
+                "SELECT addr FROM transports WHERE published=1 ORDER BY add_timestamp DESC",
+                (),
+                |row| {
+                    let addr: String = row.get(0)?;
+                    Ok(addr)
+                },
+            )
+            .await
+    }
+
     /// Returns all secondary self addresses.
+    // TODO this function might be refactored out
     pub(crate) async fn get_secondary_self_addrs(&self) -> Result<Vec<String>> {
         self.sql.query_map_vec("SELECT addr FROM transports WHERE addr NOT IN (SELECT value FROM config WHERE keyname='configured_addr')", (), |row| {
             let addr: String = row.get(0)?;
@@ -982,6 +998,23 @@ impl Context {
         }).await
     }
 
+    /// Returns all published secondary self addresses.
+    /// See TODO API
+    pub(crate) async fn get_published_secondary_self_addrs(&self) -> Result<Vec<String>> {
+        self.sql
+            .query_map_vec(
+                "SELECT addr FROM transports
+                WHERE published=1
+                AND addr NOT IN (SELECT value FROM config WHERE keyname='configured_addr')",
+                (),
+                |row| {
+                    let addr: String = row.get(0)?;
+                    Ok(addr)
+                },
+            )
+            .await
+    }
+
     /// Returns the primary self address.
     /// Returns an error if no self addr is configured.
     pub async fn get_primary_self_addr(&self) -> Result<String> {
diff --git a/src/key.rs b/src/key.rs
index 101c03518..3e50f922d 100644
--- a/src/key.rs
+++ b/src/key.rs
@@ -296,7 +296,7 @@ pub(crate) async fn load_self_public_key_opt(context: &Context) -> Result<Option
         .await?
         .context("No transports configured")?;
     let addr = context.get_primary_self_addr().await?;
-    let all_addrs = context.get_all_self_addrs().await?.join(",");
+    let all_addrs = context.get_published_self_addrs().await?.join(",");
     let signed_public_key =
         secret_key_to_public_key(context, signed_secret_key, timestamp, &addr, &all_addrs)?;
     *lock = Some(signed_public_key.clone());
diff --git a/src/smtp.rs b/src/smtp.rs
index e84b77dd1..aca1f46ea 100644
--- a/src/smtp.rs
+++ b/src/smtp.rs
@@ -706,7 +706,7 @@ pub(crate) async fn add_self_recipients(
         // them. Normally the user should have a non-chatmail primary transport to send unencrypted
         // messages.
         if encrypted {
-            for addr in context.get_secondary_self_addrs().await? {
+            for addr in context.get_published_secondary_self_addrs().await? {
                 recipients.push(addr);
             }
         }
diff --git a/src/sql/migrations.rs b/src/sql/migrations.rs
index 5a23581c3..1b13d0a23 100644
--- a/src/sql/migrations.rs
+++ b/src/sql/migrations.rs
@@ -2343,6 +2343,24 @@ ALTER TABLE contacts ADD COLUMN name_normalized TEXT;
         .await?;
     }
 
+    // Add a `published` flag to transports.
+    // Unpublished transports are not advertised to contacts,
+    // and self-sent messages are not sent there.
+    // The default is published, but when updating,
+    // existing secondary transports are set to unpublished,
+    // so that an existing transport address doesn't suddenly get spammed with a lot of messages.
+    inc_and_check(&mut migration_version, 149)?;
+    if dbversion < migration_version {
+        sql.execute_migration(
+            "ALTER TABLE transports ADD COLUMN published INTEGER DEFAULT 1;
+            UPDATE transports SET published=0 WHERE addr!=(
+                SELECT value FROM config WHERE keyname='configured_addr'
+            )",
+            migration_version,
+        )
+        .await?;
+    }
+
     let new_version = sql
         .get_raw_config_int(VERSION_CFG)
         .await?