The certificate download thing must be new. Usually certificates are stored in your keychain and are (automatically) placed there by Mail when you receive a signed message. That new service means you can send encrypted messages (to .Mac users who have a certificate issued to them) without them ever having sent you a signed message. That’s quite good for ease of use IMO. But of course it’s quite limited as it’ll only work for .Mac recipients…

So it looks like it’s related to Internet traffic, but not an actual attempt to access the net—possibly Mail waiting for some other background process or application to do something over the net before proceeding with its own stuff?

Also, the delay seems proportional to the size of the attachment. The larger the attachment, the longer the delay. And during the delay the activity viewer window shows “Loading message data.”

As well, if I repeat the same operation a second time immediately after the first, with the same message, this time there is no delay, as if something had now become cached.

Very strange.

I guess I’ll have to explore the more hard-core troubleshooting tools. Thanks for your suggestion. As for Mail accessing the net to check a certificate, I would expect this to be normal :).

LittleSnitch
You can download a demo of this which’ll run for an hour or so, enough to do whatever you have in mind. It can be set up to open a dialogue box whenever an application wants to make a connection, specifying the destination IP and port in the process.

If you want even more information you can get

Eavesdrop
which is free and a ‘little’ rough around the edges. It’ll log all (? anyway enough with a tendency of more than enough) of your IP traffic giving sources and destinations of connections and even letting you look at the data transferred. The good thing is it has a GUI…

… if you don’t want that, I recommend tcpdump and its man page on the command line. Some guy in my hall a few years back demonstrated to me how you can snoop all the traffic on the local (non-switched) network with that tool. He did this at the very moment that my computer was sending the password to check my e-mail, leaving me a bit shocked. If I should pinpoint the moment when I started being a bit paranoid about encrypting everything going out of my computer it’d be that one.

P.S. I just tried the Eavesdrop tool. My first hint would be that it works best if you quit as many applications with network connections as possible before running it as you’ll see all of the connections which can make it tricky to find the one you’re interested in as there doesn’t seem to be the name / PID of the application using that connection in the data.

P.P.S. I suppose that the problem you’re referring to is a different one, but that test of mine revealed that Mail does indeed open an http connection _if_ (i) the message’s recipient has a mac.com address, (ii) you have encryption enabled and (iii) you’ve checked that .Mac checkbox in your keychain preferences that I mentione It loads a page à la http://certinfo.mac.com/lookup?igot which returns the certificate for that user – apparently Mail’s way of automatically getting the certificate for you :)