---
summary: A delivered message has no signature, or the wrong one. Read the X-ScaiLine
  header and fix the cause.
order: 1
title: Signature missing
path: troubleshooting/signature-missing
status: published
---

# Signature missing

A message arrived without the expected signature. ScaiLine fails open by design, so a missing
signature is a configuration issue or a bug, never a sign that mail is at risk. Every processed
message says what happened in its `X-ScaiLine` header ([format](reference/x-scailine-header)).
Open the delivered message's source and look for it.

## No X-ScaiLine header at all

The message did not pass through ScaiLine, or passed through unmodified.

| Check | Fix |
|---|---|
| Postfix: is the milter attached for this path? `postconf non_smtpd_milters` and the `submission` entry in `master.cf` | Attach it as described in [Postfix and the milter](operating/postfix-milter). Mail received on port 25 is never signed, by design. |
| Postfix: is the milter running? `systemctl status scailine-milter` | While it is down, `milter_default_action = accept` delivers mail unsigned. Start it; check the settings in `/etc/scailine/.env`. |
| Milter: is the node still enrolled, and has it loaded a snapshot? | Check **Milter nodes** in the console. A revoked node keeps its last snapshot; a node that never loaded one passes all mail through. |
| Is the sender's domain registered and verified under **Domains**? | Mail from domains ScaiLine does not know passes without a header. |
| Microsoft 365: did the transport rule route the message to the connector? | Check the message trace for the *ScaiLine Outbound* connector; re-run the generated script if the rule or connectors are missing. |
| Microsoft 365: was the message rejected (`550 5.7.1` in the message trace)? | Attribution failed: verify the sending domain, and check that the Microsoft 365 tenant ID registered on the connection is yours. |
| Larger than 25 MB, or an unusual message structure (custom software, nested containers)? | Passed through on purpose. Send an anonymised sample to support if a common client produces it. |

## `o=skip`

ScaiLine saw the message and deliberately left it alone.

| Reason | What to do |
|---|---|
| The sender has no profile | Check **Profiles** for the address, including aliases. The person must be in the directory source (for ScaiKey: assigned to the ScaiLine application). |
| No rule or template applies to this sender for these recipients | Use the tester on **Rules** with the same sender and recipient. |
| The template produces nothing for this variant | For example no *internal* content; check the template's conditional blocks in the preview. |
| S/MIME, PGP or Purview-protected mail | By design: changing the message would break the signature or protection. |
| Calendar invitation or response | By design. |
| Automatic reply, delivery report, bounce | By design. |
| A skip rule matched (recipient domain, subject) | Review **Rules**. |
| The message already carried a valid `X-ScaiLine` header | It passed ScaiLine twice; only the first pass signs. |

## `o=stamped`, but no signature is visible

| Likely cause | What to do |
|---|---|
| Microsoft 365 connection in **shadow mode** | Expected: the original is delivered. Turn shadow mode off under **Platforms**. |
| The signature is below a long quoted thread | The client's reply marker was not recognised. Send an anonymised sample to support. |
| The recipient's client collapses it (Gmail's "…") | Client behaviour; the signature is there. |
| Images are missing | See [Images](troubleshooting/images). |

## `o=client`

The Outlook add-in inserted the signature while composing, and ScaiLine added only the
remaining parts (legal footer, banner). The add-in is in development.

## Wrong content in the signature

Open the person under **Profiles**. Every attribute shows its value, its source and when it was
fetched ([Attributes](concepts/attributes)). Fix the value at that source; the signature is
recompiled within seconds after the change arrives. The `b=` field of the header tells you
which compiled version a message used, and **My signature** shows the current one.