The signature was not added

Work down this list in order. The first four cover almost every case, and each takes a minute to check in the portal. Apart from the last one, none of them affects delivery: a message that cannot be signed is delivered, just without the signature.

If your organisation uses the Outlook add-in only

Only mail written in Outlook with the add-in is signed, so check these first, then work through the list below:

• The message was not written in Outlook with the add-in. Mail sent from phones, including Outlook for iOS and Android, and from other programs and devices, goes without a signature.
• The add-in has not reached the person. It must be deployed to them, and it can take a few hours to appear after deploying. The add-in is not showing
• The add-in could not sign the message. The Coverage page under Insights gives the reason for each message the add-in sent without a signature, such as a signature too large for Outlook, or a rule the add-in cannot decide. Using the Outlook add-in only

1. Setup has not finished

With mail flow, mail is not signed until the connectors and transport rules exist in Exchange Online. With the Outlook add-in only, it is not signed until the add-in is deployed.

Check: open Getting started (open it). The first two steps, Authorise Microsoft 365 access and Configure Exchange Online, must both show Done. With the Outlook add-in only, the second shows Not needed for add-in only, and step 4, Deploy the Outlook add-in, must show Done.

Fix: finish the setup wizard. If it says Setup didn't finish, see Setup did not finish.

2. No rule matches the sender

A signature reaches a person only through a signature rule. If no enabled rule covers them, their mail goes out unsigned.

Check: go to Signatures, then Signature rules, and select Test a rule. Pick the person and the email type, type the recipients' addresses, and select Test. If it says No rule matched for that person, that is the cause.

You can also see the scale of the problem on Analytics (open it). The Mailboxes sending without one card lists mailboxes that sent mail in the last 30 days with no signature applied.

Fix: add the person, their group or their department to a rule, or add a rule for All users at the bottom of the list as a catch-all. The fallback rule

3. The rule is switched off, or does not cover this kind of message

Check: on Signature rules, look at the Status column and at the rule's From, To and When lines. A blue Starts pill means the rule's schedule has not reached its dates yet. Then open the rule:

• Email type, under When: a rule set to New emails only does not sign replies or forwards.
• Runs, under When: a rule On a schedule does not sign mail sent outside its dates, days or hours. Run a rule on a schedule
• Recipient type, under Who it goes to: a rule set to Every recipient internal does not sign mail to anyone outside your organisation, and Any external recipient does not sign mail between colleagues.
• Only when recipients include and Except when recipients include: the recipients must be on the first and not on the second, whether an entry is an address, a domain, a wildcard or one of your recipient lists. Rules for particular recipients and Keep lists of recipients to reuse
• And only when and Except these senders, under Who sends it: the sender's directory details must meet the conditions, and the sender must not be excepted.

Test a rule names the part that was not met for each rule it checked. Test a rule

Fix: switch the rule on with Enabled, widen what it asks for, or add another rule for the mail it leaves out. Different signatures for replies

4. The template has never been saved

A template made with New template has no content until it is saved in the editor for the first time. Until then, any rule using it is skipped as though it were not there, and the next rule down, if any, applies instead.

Fix: open the template, check it looks right and select Save.

5. The person is not in the directory yet

Footer365 needs to find the sender in your synced directory. When a new sender is not there yet, Footer365 asks Microsoft 365 for that one person as the message passes through, so a new starter is usually signed straight away. If that lookup cannot find them, or they have been deleted from your directory, the message goes out unsigned. An account that is only blocked from signing in, such as a shared mailbox, is still signed. With the Outlook add-in only there is no lookup on the spot: a new person is signed once the directory sync has brought them in.

Check: go to Directory, then Users and groups, and search for the person.

Fix: select Sync now. The directory also syncs on its own every 4 hours. How directory sync works

Outside the sync scope, or waiting for approval. If your organisation chose who is synced under Sync settings on Users and groups, someone the scope leaves out is never signed. Coverage gives the reason Outside the sync scope for 30 days after they leave it, and Not found in the directory once Footer365 has deleted them, or for someone new who was outside it from the start. If Approve new starters before they are signed is on, a new starter is not signed until someone approves them, and Coverage gives Waiting for approval. Check the outside the sync scope and waiting for approval figures above the list on Users and groups: add the person to a group the scope includes, or approve them. How directory sync works

6. Footer365 has lost access to Microsoft 365

If the portal shows Action needed: reconnect Footer365 to Microsoft 365, directory changes stop reaching Footer365. With mail flow, after about a week without access, signatures stop being added altogether, because Footer365 can no longer confirm your email domains. With the Outlook add-in only, the add-in may be unable to sign people in at all. The reconnect banner

7. Signatures are paused for billing

If the portal shows Signatures are paused while a payment is outstanding, every message is delivered unsigned until the invoice is settled or a card is added. Signatures are paused

8. The message is encrypted or digitally signed

S/MIME and sensitivity labels that encrypt protect the message before it reaches Footer365, and so does an encryption mail flow rule placed above Footer365's rules. A protected message is always delivered exactly as it was sent, with no signature. Encrypted or signed mail

9. The message is a kind Footer365 never signs

Delivery reports, bounce messages and read receipts are never signed. A message with no text or HTML body to write into, or one built from more than 500 separate parts, is also passed through untouched, and so is a notification a Microsoft 365 service sends from someone's mailbox, such as a Planner task comment or a voicemail. Automatic replies, meetings and notifications

10. The sending domain is not set up for email

With mail flow, Footer365 only signs mail sent from one of your domains that Microsoft 365 lists as used for email, and it re-reads your domains every night. A domain added to Microsoft 365 today is not known until the next night's check, and mail sent from it before then is refused rather than just left unsigned. Mail delayed or bounced

11. The sender used a message keyword

If your organisation has message keywords, a code such as #nosig typed in the subject sends that one message without a signature, and a keyword can also leave out the campaign banner or choose another template. The keyword is removed before the message is delivered, so the recipient's copy does not show it. The sender's own copy in Sent Items still shows it when the mail relay removed it, and the message's entry in the audit log names the keyword. Keywords are listed under Account, then Message keywords. Message keywords

Still stuck

If your portal has an Audit log under Insights, search it for the sender's address. An entry reading "passed through without a signature" gives the reason for that message. Then check the status page and contact support with the sender, a recipient and the time sent.