Mail filter plugin can read an email from any storage supported by Dovecot
and modify the mail in some way. Note that IMAP protocol requires that
emails never change, so the output must be predictable. If the output
changes you'll probably see some errors about Dovecot's cache file being
corrupted and the IMAP client may also become confused if it has already
cached some of the mail data.

dovecot.conf:

mail_plugins = $mail_plugins mail_filter
plugin {
 mail_filter = mail-filter
}
service mail-filter {
 executable = script /usr/local/bin/mail-filter.sh
 user = dovecot # run unprivileged
 unix_listener mail-filter {
   # enough permissions to give imap/pop3/etc processes access to this socket
   mode = 0600
   user = vmail
 }
}

Where the mail-filter.sh have something like:

#!/bin/sh

cat > tempfile # need to save the mail first to a temp file or it can hang
gpg -d tempfile
rm -f tempfile
