Quickstart

This walks you from nothing to a first message that leaves your Postfix server with its signature. It takes about half an hour plus DNS propagation. For Microsoft 365, see Microsoft 365 instead; steps 1 to 4 are the same.

You need:

• access to ScaiLine for your organisation (your organisation is managed in ScaiKey, and your account must be assigned to the ScaiLine application there);
• a sending domain whose DNS you control;
• a Postfix server you administer (grommunio, Mailcow or your own).

1. Sign in and add your domain#

Open the console at https://scailine.scailabs.ai/console/ and sign in with your ScaiKey account. Under Domains, add the domain you send from.

Internal decides which signature variant is used: mail whose recipients are all on internal domains gets the internal variant (often shorter), anything else gets the external one. You can change it later.

Publish the TXT record the console shows, then click Verify:

1

_scailine.example.com.   TXT   "scailine-verify=<token>"

The domain moves from pending to verified. Use the copy button next to the record; the token is long and easy to truncate by hand.

2. Connect your directory#

Under Directory, add a source. ScaiKey needs no configuration: ScaiLine reads the users assigned to the ScaiLine application and keeps them in sync. Wait for the first sync, then open Profiles: every user is listed with their attributes and, per attribute, where the value came from.

Tenant administrators can install the attribute pack under Attributes. It adds the fields signatures need but directories rarely hold (a LinkedIn URL, a signature-specific title, the legal entity) to your ScaiKey directory, so you can fill them there. Attributes explains the model.

3. Design a template#

Create a Brand kit first (logo, colours, fonts), then a template under Templates. The designer works with rows, columns and elements: text, directory fields, images, the user's photo, social icons, buttons, dividers, a campaign banner and a legal disclaimer. The preview shows the result for any person in your directory in all four variants: new message or reply, to internal or external recipients. Publish when you are happy; every publish is a version you can return to. See Templates.

4. Add a rule#

A template does nothing until a rule applies it. Under Rules, add a rule for all senders and all recipients that applies your template. The tester on the same page takes a sender and a recipient address and shows which rule and template apply, and why. To pilot with a few people first, limit the rule to a group (Rules).

Open My signature to see your own compiled signature.

5. Enrol your mail server#

Under Platforms, add a Postfix milter connection. Then, under Milter nodes, enrol the server. The console shows the configuration lines once, including a token that is not shown again:

1
2
3

MILTER_API_BASE_URL=https://scailine.scailabs.ai
MILTER_ENROLMENT_TOKEN=smn_…
MILTER_SNAPSHOT_PUBLIC_KEY=…

6. Install the milter#

ScaiLabs provides scailine-milter during onboarding (a Debian package is planned). It runs as the systemd service scailine-milter under its own user and reads /etc/scailine/.env. Add the lines from step 5 and the socket location:

1
2
3
4
5
6

# /etc/scailine/.env  (owned by root, readable by the milter's group only)
MILTER_API_BASE_URL=https://scailine.scailabs.ai
MILTER_ENROLMENT_TOKEN=smn_…
MILTER_SNAPSHOT_PUBLIC_KEY=…
MILTER_SOCKET=/var/spool/postfix/scailine/milter.sock
MILTER_SNAPSHOT_DIR=/var/lib/scailine-milter

1
2

systemctl enable --now scailine-milter
systemctl status scailine-milter

The milter downloads a signed copy of your organisation's signatures, checks the signature on it and keeps it on disk. It keeps working with that copy if ScaiLine's control plane is unreachable.

7. Attach it to Postfix#

Only outgoing mail may pass the milter. Attach it to local submission and to the submission port, and leave port 25 alone, or incoming mail would be signed too:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

postconf -e 'non_smtpd_milters = unix:scailine/milter.sock' \
            'milter_default_action = accept' \
            'milter_protocol = 6' \
            'milter_connect_timeout = 5s' \
            'milter_command_timeout = 15s' \
            'milter_content_timeout = 30s'
# master.cf, on the submission (587) service only:
#   submission inet n - y - - smtpd
#     -o smtpd_milters=unix:scailine/milter.sock
postfix reload

The socket path is relative to Postfix's queue directory (/var/spool/postfix), which also works when Postfix runs chrooted. On grommunio, outgoing mail from the web client and from Outlook via MAPI enters Postfix through local submission, which non_smtpd_milters covers.

milter_default_action = accept is the important line: if the milter is stopped, slow or failing, Postfix delivers the mail without a signature instead of holding it. Postfix and the milter has the details.

8. Send a message and read the result#

Send a message from a user with a profile to an external address and look at the delivered message's source:

1

X-ScaiLine: v=1; t=tnt_01J8…; b=12; o=stamped; ts=1757665800; mac=…

o=stamped means the signature was inserted. If the signature is missing, the header tells you why (Signature missing).