--- summary: From zero to a signed outgoing message on a Postfix server, using the ScaiLine milter. order: 3 title: Quickstart path: quickstart status: published --- # Quickstart This walks you from nothing to a first message that leaves your Postfix server with its signature. It takes about half an hour plus DNS propagation. For Microsoft 365, see [Microsoft 365](operating/microsoft-365) instead; steps 1 to 4 are the same. You need: * access to ScaiLine for your organisation (your organisation is managed in ScaiKey, and your account must be assigned to the ScaiLine application there); * a sending domain whose DNS you control; * a Postfix server you administer (grommunio, Mailcow or your own). ## 1. Sign in and add your domain Open the console at `https://scailine.scailabs.ai/console/` and sign in with your ScaiKey account. Under **Domains**, add the domain you send from. **Internal** decides which signature variant is used: mail whose recipients are all on internal domains gets the *internal* variant (often shorter), anything else gets the *external* one. You can change it later. Publish the TXT record the console shows, then click **Verify**: ``` _scailine.example.com. TXT "scailine-verify=" ``` The domain moves from `pending` to `verified`. Use the copy button next to the record; the token is long and easy to truncate by hand. ## 2. Connect your directory Under **Directory**, add a source. **ScaiKey** needs no configuration: ScaiLine reads the users assigned to the ScaiLine application and keeps them in sync. Wait for the first sync, then open **Profiles**: every user is listed with their attributes and, per attribute, where the value came from. Tenant administrators can install the **attribute pack** under **Attributes**. It adds the fields signatures need but directories rarely hold (a LinkedIn URL, a signature-specific title, the legal entity) to your ScaiKey directory, so you can fill them there. [Attributes](concepts/attributes) explains the model. ## 3. Design a template Create a **Brand kit** first (logo, colours, fonts), then a template under **Templates**. The designer works with rows, columns and elements: text, directory fields, images, the user's photo, social icons, buttons, dividers, a campaign banner and a legal disclaimer. The preview shows the result for any person in your directory in all four variants: new message or reply, to internal or external recipients. **Publish** when you are happy; every publish is a version you can return to. See [Templates](concepts/templates). ## 4. Add a rule A template does nothing until a rule applies it. Under **Rules**, add a rule for all senders and all recipients that applies your template. The tester on the same page takes a sender and a recipient address and shows which rule and template apply, and why. To pilot with a few people first, limit the rule to a group ([Rules](concepts/rules)). Open **My signature** to see your own compiled signature. ## 5. Enrol your mail server Under **Platforms**, add a **Postfix milter** connection. Then, under **Milter nodes**, enrol the server. The console shows the configuration lines once, including a token that is not shown again: ``` MILTER_API_BASE_URL=https://scailine.scailabs.ai MILTER_ENROLMENT_TOKEN=smn_… MILTER_SNAPSHOT_PUBLIC_KEY=… ``` ## 6. Install the milter ScaiLabs provides `scailine-milter` during onboarding (a Debian package is planned). It runs as the systemd service `scailine-milter` under its own user and reads `/etc/scailine/.env`. Add the lines from step 5 and the socket location: ```bash # /etc/scailine/.env (owned by root, readable by the milter's group only) MILTER_API_BASE_URL=https://scailine.scailabs.ai MILTER_ENROLMENT_TOKEN=smn_… MILTER_SNAPSHOT_PUBLIC_KEY=… MILTER_SOCKET=/var/spool/postfix/scailine/milter.sock MILTER_SNAPSHOT_DIR=/var/lib/scailine-milter ``` ```bash systemctl enable --now scailine-milter systemctl status scailine-milter ``` The milter downloads a signed copy of your organisation's signatures, checks the signature on it and keeps it on disk. It keeps working with that copy if ScaiLine's control plane is unreachable. ## 7. Attach it to Postfix Only **outgoing** mail may pass the milter. Attach it to local submission and to the submission port, and leave port 25 alone, or incoming mail would be signed too: ```bash postconf -e 'non_smtpd_milters = unix:scailine/milter.sock' \ 'milter_default_action = accept' \ 'milter_protocol = 6' \ 'milter_connect_timeout = 5s' \ 'milter_command_timeout = 15s' \ 'milter_content_timeout = 30s' # master.cf, on the submission (587) service only: # submission inet n - y - - smtpd # -o smtpd_milters=unix:scailine/milter.sock postfix reload ``` The socket path is relative to Postfix's queue directory (`/var/spool/postfix`), which also works when Postfix runs chrooted. On grommunio, outgoing mail from the web client and from Outlook via MAPI enters Postfix through local submission, which `non_smtpd_milters` covers. `milter_default_action = accept` is the important line: if the milter is stopped, slow or failing, Postfix delivers the mail without a signature instead of holding it. [Postfix and the milter](operating/postfix-milter) has the details. ## 8. Send a message and read the result Send a message from a user with a profile to an external address and look at the delivered message's source: ``` X-ScaiLine: v=1; t=tnt_01J8…; b=12; o=stamped; ts=1757665800; mac=… ``` `o=stamped` means the signature was inserted. If the signature is missing, the header tells you why ([Signature missing](troubleshooting/signature-missing)).