X-ScaiLine header
Every message that passes through ScaiLine (milter, hosted relay, ScaiSend stage) and belongs to
an organisation ScaiLine knows leaves with exactly one X-ScaiLine header, unless the message was
passed through unmodified. The header tells you, per delivered message, what ScaiLine did. Mail
from a domain that no organisation has registered passes the milter without a header.
Format#
1 | |
| Field | Meaning |
|---|---|
v |
Header format version. Currently 1. |
t |
Organisation id (tnt_…). |
b |
Version of the compiled bundle that was used; 0 when no bundle applied (skip). |
o |
Outcome: stamped, client, skip or bypass (see below). |
ts |
Unix time of processing. |
mac |
HMAC-SHA256 truncated to 128 bits over `t |
Outcomes#
o= |
What happened to the body |
|---|---|
stamped |
The signature variant (external.new, external.reply, internal.new, internal.reply) was inserted into the HTML and text parts. |
client |
The Outlook add-in or a native integration had already inserted the signature (it set X-ScaiLine-Client); only the remaining components (legal footer, banner) were applied. |
skip |
Deliberately left alone: signed or encrypted mail, calendar traffic, automatic replies and reports, a sender without a profile, a skip rule, already processed, or no signature for this recipient scope. Body unchanged, header present. |
bypass |
The engine could not safely touch the message (oversize, deadline exceeded, unknown MIME structure, internal error). Body unchanged. A bypass does not add the header: the message is byte-identical to the input. |
In shadow mode (hosted relay only) the outcome is computed and recorded, and the original message is delivered.
Why the MAC#
The header doubles as loop prevention: a message that already carries a valid X-ScaiLine
for the same tenant is treated as already processed and skipped. Only a valid MAC is trusted.
The Exchange Online transport-rule exception can only look at the header's text (it matches
v=\d), so a sender who writes a fake header can at most suppress their own signature.
Reading it#
Message headers are visible in every client ("View source", "Show original", or less on the
.eml). For support questions, quote the whole header line; the tenant id, bundle version and
timestamp identify the exact template and directory state that was in force.
See Signature missing for what to do per outcome.