Docs / Obsidian Suite / Reference
Message headers
Obsidian Suite adds these headers to the mail it delivers (when the policy's Add X-Obsidian headers is on). Mail platforms use them to route tagged mail to Junk; administrators use them to find a message in Message trace.
| Header | Meaning |
|---|---|
X-Obsidian-Verdict | Final verdict: clean, bulk, spam, phish, bec, virus, malware, blocked or policy. |
X-Obsidian-Score | Total score with one decimal. |
X-Obsidian-Spam | Yes when the message was delivered but judged spam / phishing / BEC (tagged). Use this in Junk rules. |
X-Obsidian-Bulk | Yes for newsletters / marketing mail. |
X-Obsidian-Rules | The strongest rules that fired, with their points. |
X-Obsidian-ID | Message ID in Obsidian Suite - paste it into Message trace search. |
X-Obsidian-AI | The AI verdict and risk when the model reviewed the message. |
X-Obsidian-AI-Review | 'released' on mail released automatically after an AI hold. |
X-Obsidian-Released | Who released the message from quarantine and when. |
X-Obsidian-Relay-Key | Secret stamped by the tenant's outbound rule; checked and removed by the gateway, never delivered. |
Authentication-Results | SPF, DKIM, DMARC and ARC results as seen by the gateway. |
Example
X-Obsidian-Verdict: spam
X-Obsidian-Score: 6.4
X-Obsidian-Spam: Yes
X-Obsidian-Bulk: No
X-Obsidian-Rules: BODY_SCAM_LANGUAGE=2.4, SPF_SOFTFAIL=1, URL_SHORTENER=1, ...
X-Obsidian-ID: 5fdd5be358454c4a92c4732de73b588b
Authentication-Results: mx1.obsidiansuite.net; spf=softfail [email protected]; dkim=none; dmarc=none header.from=example.net; arc=noneRouting tagged mail to Junk
| Platform | Rule |
|---|---|
| Microsoft 365 | Exchange admin center > Mail flow > Rules > new rule: A message header matches X-Obsidian-Spam = Yes, then Modify the message properties > set the spam confidence level (SCL) to 6. |
| Google Workspace | Gmail > Spam, phishing and malware > Inbound gateway > Message is spam if the following header regexp matches: X-Obsidian-Spam: Yes. |
| Exchange Server | Transport rule: header X-Obsidian-Spam includes Yes, then set the SCL to 6. |
Optionally treat X-Obsidian-Bulk: Yes the same way, or send it to a "Newsletters" folder with an inbox rule.