Which messages get a signature

Every message a Footer365 rule routes to the relay is delivered. The only question is whether it gets a signature on the way. This article lists what decides that, in the order the relay checks it.

Messages that never reach the relay

• Mail the Outlook add-in has already signed. The add-in marks the message with X-Footer365-Processed: true while it is being written, and the Footer365 rule skips it. The signature the recipient sees is the add-in's, and so is any campaign above the message, which Outlook adds as the message is sent. Where Outlook cannot add one, the add-in leaves the message unmarked, so the relay signs it and adds the campaign instead. One kind of add-in reply does reach the relay: a reply or forward that quotes an earlier message Footer365 signed, when your organisation tidies long conversations. The add-in sets the header to tidy: followed by a code, the rule routes the message to the relay, and the relay tidies the quoted part, signs nothing and hands it back marked true. See Tidying the quoted part of a reply below. And a message the add-in signed in which someone typed a marker that places the signature reaches it too: the add-in removes its own signature as the message is sent and leaves the message unmarked, so the relay signs it where the marker is. See A marker in the body below.
• Mail from outside your organisation. The Footer365 rules only match mail whose sender is inside your organisation. Inbound mail is never touched.
• Mail whose envelope sender is not on one of your domains. The envelope sender is the address mail servers return undeliverable mail to, and it is often not the address in the From line. The Footer365 rules only pick up a message whose envelope sender is on one of your organisation's accepted domains, because Exchange Online would not take any other message back from Footer365. Such a message is sent on without a signature. The usual example is an app that sends as one of your people but uses its own bounce address on its own domain. An app's mail is signed when it is sent from the person's mailbox, or relayed with the person's own address as the envelope sender. See What Footer365 creates in Exchange Online, and for setting up a CRM or another app so its mail is signed, Choose how your CRM or app sends its mail and Mail from your CRM and other apps.
• Automatic replies, delivery reports and read receipts. Exchange Online sends these with an empty envelope sender, which is on none of your domains, so the Footer365 rules leave them to Exchange.
• Messages larger than 24 MB. The Footer365 rules leave any message over 24 MB to Exchange, which sends it on without a signature. Large attachments are the usual reason. Without this, a message too large for the relay would be returned to its sender instead of being delivered.
• Calendar messages inside your organisation. Meeting requests, responses and cancellations between your own mailboxes stay inside Exchange, so room and resource mailboxes book as they always have. The Outlook add-in still signs an invitation as it is written.
• Anything your own rules route elsewhere first. Only possible if a rule of yours has been moved above the Footer365 rules; see Encryption and rule priority.

Messages passed through unsigned

How the sender is found

The relay looks up the envelope sender in your synced directory. If the address is an alias that is not yet known, it asks Microsoft Graph for that one person, so a new starter or an alias is usually signed on the first message. If the sender is a mail-enabled group (for example someone using Send As on a group address), the group itself is treated as the sender, and personal fields such as job title are left empty. Shared mailboxes send with the signature assigned to the mailbox, not the person typing; see Shared mailbox signature.

New messages, replies and forwards

The relay decides what kind of message it is, so a rule can apply to new messages, replies or forwards only:

• a subject starting FW:, FWD: or Fwd: is a forward;
• otherwise, In-Reply-To or References headers, a reply prefix such as RE:, AW: or SV:, or quoted content from Outlook, Gmail or another client make it a reply;
• anything else is a new message.

Your organisation can add its own reply prefixes, forward prefixes and quote markers to these on the Replies and forwards card in Account > Settings, for mail apps that use other words, such as TR: in French. They are added to the built-in ones, compared as plain text and never as a pattern, and change nothing in the message. See Add your own reply and forward words.

On replies and forwards the signature is placed above the quoted text rather than at the very bottom, unless a marker in the new part of the message places it, as below. See A different signature for replies.

The same answer decides a campaign's Which messages choice, such as New messages only, so a campaign set that way is left off replies and forwards. The Outlook add-in asks Outlook whether the message being written is new, a reply or a forward, and decides it in the same way. A campaign placed above the message goes at the top of the email, above the reply and never inside the quoted text. See "Which messages" in Create a banner campaign.

Every kind of message the relay passes through unsigned, listed above, gets no campaign above it either.

A marker in the body

A message can say where its signature goes with a marker: the empty element <span data-footer365-signature></span> in HTML, or the text {{Footer365 signature here}}, which also works in plain text. It is meant for the email templates of a CRM or another app, and someone can type the text form into a message too.

• Where it fits. Once the relay has decided to sign a message, and built its signature exactly as it would anyway, it looks in the new part of the message for a marker. The signature goes where the first one is, in place of the positions described above. Anything that goes under the signature, such as a campaign banner or a disclaimer, goes with it; a campaign placed above the message still goes at the top.
• Only the new part counts. In a reply or forward, a marker in the quoted part is never used.
• Every other marker is removed, quoted ones included, so a reply never collects a second signature. A message with no marker is signed exactly as it always was.
• Unsigned messages too. When the relay passes a message through unsigned for one of the reasons above, it still removes every marker, so none reaches a recipient. The messages it returns without opening keep any marker: delivery reports, messages it has already processed, messages of more than 500 MIME parts, protected messages and Microsoft 365 notifications. So does a message that carries a winmail.dat, unless the relay removes the winmail.dat to add a disclaimer or sign the message, as described in Outlook Rich Text and winmail.dat below. The HTML form cannot be seen, but the text form shows.

The two forms, and how to use them in an app's templates, are described in Mail from your CRM and other apps.

Tidying the quoted part of a reply

When the relay signs a reply or forward, it first tidies the quoted part as your Long conversations setting in Account > Settings says. By default it removes the campaign banners Footer365 added to your organisation's earlier messages, and keeps their signatures; it can also shorten each earlier signature to one line or remove it. It recognises only your organisation's own signatures and banners, by invisible marks only your organisation's Footer365 can make, never touches a disclaimer or anything a person wrote, and leaves alone anything someone edited. A new message is never tidied, and neither is any message the relay passes through unsigned, listed above. Tidying changes the body, so any DKIM-Signature the message carried is removed, as it is whenever the relay changes a message. See Earlier signatures and banners in long conversations.

Message keywords in the subject

Once a message has passed the loop check, and before anything else is decided about it, the relay looks in the subject for your organisation's message keywords, such as #nosig, and removes every one it finds, with the space beside it. This happens even to a message that is then passed through unsigned for one of the reasons above, such as a protected message, so a keyword is never delivered. It reads subjects written in any character set, including encoded and folded subject lines, and writes back only the subject (and Outlook's matching Thread-Topic header). A message whose subject holds no keyword is left exactly as it was. Removing a keyword changes the message, so any DKIM-Signature it already carried is removed too, as it would no longer verify. The keyword then decides the signature, as described in Message keywords, and the processing log records the keyword and what it did, never the subject.

Internal mail

Mail between people in your organisation is routed to the relay by the Footer365 Internal Routing rule and signed like any other message. A message counts as internal only when every recipient is at one of your own domains; otherwise the external signature applies. See Internal and external signatures.

Automatic replies and calendar items

Automatic replies are not signed. Exchange Online sends them with an empty sender address on the envelope, like a delivery report, so the Footer365 rules do not pick them up and Exchange sends them on as they are. If one does reach the relay, the relay hands it back unchanged.

Meeting requests to people inside your organisation never reach the relay, as above. One sent outside goes through exactly the same checks as any other message, so whether it is signed depends on the sender, the rules that apply and the shape of its body.

For meeting invitations sent from Outlook on the web, Windows or Mac, the Outlook add-in inserts the signature into the invitation as it is created. If you see unexpected results, see Automatic replies and calendar.

Microsoft 365 notifications

Some Microsoft 365 services send their notifications from the mailbox of the person who caused them, so they reach the relay like a message that person wrote. The relay recognises two kinds by headers Microsoft 365 puts on them, and hands them back to your Exchange exactly as they arrived, without a signature:

• Planner task comments. When someone comments on a task in a plan, Planner emails the comment to the plan's members from that person's mailbox. Exchange Online marks these messages with PlannerComment in the X-MS-TrafficTypeDiagnostic header.
• Voicemail and missed call notices. A message whose Content-Class header is voice, voice-ca, voice-uc or missedcall is a voicemail or missed call notice. A voicemail someone forwards is their own message and is signed as usual.

This is always on, like the other kinds of message on this page, and there is no setting to change it. Each one is recorded in the processing log, counted on the Coverage page against the person whose mailbox sent it under the reason "Microsoft 365 notification", and written to your audit log with the header that identified it.

The relay only believes these headers in the form Microsoft 365 writes them, and only when the message carries a single copy of the header. Outlook gives nobody a way to add a header to a message they write. A program sending with someone's own sign-in could add one, and the relay cannot tell that apart from Microsoft's, which is why each one is recorded against the person in Coverage and the audit log, so an unexpected run of them stands out.

Replies people write to these notifications in Outlook do not carry the headers, so they are signed as usual. Notifications Teams, SharePoint and other services send from Microsoft's own addresses never reach the relay at all, because the Footer365 rules only pick up mail whose envelope sender is on one of your domains.

The Outlook add-in plays no part in this: these notifications are not written in Outlook.

Outlook Rich Text and winmail.dat

A message sent in Outlook's Rich Text format carries its body as a winmail.dat part, which Exchange would use to rebuild the body and lose the signature. Exchange also packs a message written in Outlook's plain-text format this way when it goes to someone inside your own organisation, such as a colleague you Bcc. The relay removes the winmail.dat before signing:

• If it holds an HTML body, the message is signed in that HTML.
• If it holds only plain text, either as text or as the Rich Text copy Exchange makes of plain text, the relay takes the text and any attachments out of it, then treats the message like any other plain-text email: it is converted to HTML and signed, or kept as plain text with the text-only signature, according to your plain-text email setting.
• If it holds Rich Text that someone formatted, the message is passed on as it arrived, because removing the winmail.dat would lose that formatting.
• If nothing readable can be taken out of it, the message is also passed on as it arrived.

The audit entry notes which of these happened.

Checking one message

Open the received message's headers. If X-Footer365-Relay-Id is present, the relay handled it; quote that value to support. If it is absent, the message either did not go through Footer365 or was signed by the add-in. A reply the add-in signed and the relay only tidied carries it too, and is recorded in the processing log as a message the add-in signed.

If a message is held rather than delivered, see Delivery status codes.