Encrypted or digitally signed emails go out without a signature

A protected message can be read only by its recipients, and a digitally signed one must arrive exactly as it was signed. Footer365 cannot open the first and must not change the second. So when a message reaches Footer365 already protected, it is delivered exactly as it was sent, with no signature. It is never delayed, held or bounced because of its protection.

This applies to mail flow. With the Outlook add-in only, no message reaches Footer365 after it is sent, so nothing on this page applies: the add-in adds the signature while the message is being written, or not at all. Using the Outlook add-in only

Which messages are affected

Why S/MIME is never touched. An S/MIME digital signature covers the exact content of the message. If Footer365 added a signature, every recipient's mail app would report the message as tampered with. Leaving it alone keeps the digital signature valid.

How to confirm this is the cause

If your portal has an Audit log under Insights, search for the sender's address using the Search box (Action, entity or detail...). An entry for the message says it "passed through without a signature" because "the message content is protected", and names the protection found.

On Analytics, these messages are included in the Skipped (no rule) figure, which counts every message sent without a signature for any reason.

Getting a signature and encryption from a mail flow rule

If your organisation encrypts mail with an Exchange mail flow rule, you can have both. The signature has to be added before the message is encrypted, which is a question of the order of rules in your own Exchange Online.

Footer365 creates its two routing rules at the top of your list, at priority 0 and 1, with "Stop processing more rules" set. A message then flows like this:

1. On the way out, the Footer365 rule matches first and sends the message to Footer365. Because it stops rule processing, your encryption rule does not run yet.
2. Footer365 adds the signature and hands the message back to Exchange, marked as processed.
3. On the way back, the Footer365 rule does not match again, because it has an exception for that mark. Your encryption rule now matches and encrypts the signed message.

So the recipient gets a signed, encrypted message, as long as:

• Your encryption rule sits below the Footer365 rules. Leave Footer365's rules at the top.
• Your encryption rule has no exception for the X-Footer365-Processed header. That exception belongs on the Footer365 rules only. Added to the encryption rule, it means signed mail is never encrypted at all.

Check: in the Exchange admin centre, go to Mail flow, then Rules, and look at the order and the exceptions on your encryption rule. Encryption and rule priority

Sensitivity labels and S/MIME from Outlook

When the sender applies an encrypting sensitivity label or S/MIME in Outlook, the message is protected before it leaves their computer. No order of rules can change that, so these messages always pass Footer365 without a signature.

The answer here is the Outlook add-in. It puts the signature into the message while it is being written, before Outlook protects it, so the signature is inside the protected message. Deploy the Outlook add-in

What rule order cannot change

• Data loss prevention and auto-labelling policies run after mail flow rules. An auto-labelling policy that encrypts outbound mail does so after Footer365 has signed it, which is the order you want.
• Journal and archive copies taken before Footer365 signed the message hold the unsigned version. That is expected, not a fault.

Related

• The signature was not added
• Which messages are signed