signplume
Start free

Handbook › The admin screens

Server-side signing

Server-side signing (/admin/server-signing) sets up the relay. With it, outbound mail leaves your mail platform, passes through signplume, has the signature stamped into the message, and goes back to your platform for delivery. Nobody installs anything, and there is no DNS change on your side.

The relay is optional. The Setup guide lists it last, as Optional: stamp signatures on the way out.

1. Issue relay credentials

Press Issue relay credentials. The screen then shows your relay endpoint: the relay host, the ports it listens on, your relay hostname and your header secret. Treat the header secret like a password: anyone who has it can have signplume stamp your signature onto their mail.

2. Register your mail platform's IP ranges

The relay accepts your organisation's mail only from your platform's published outgoing IP ranges. The screen lists them, with the date they were fetched, and Register these ranges adds them. Until they are registered, the relay turns every message away. If the screen has no ranges on file, contact signplume support and we will register them for you.

3. Route outbound mail through the relay

For Google Workspace, in the Google Admin console:

  1. Open Apps → Google Workspace → Gmail → Hosts and choose Add route. Name it, set the host to the relay host from the screen and the port to the one the screen names for Google Workspace, and tick Require secure transport (TLS). Google cannot use port 465; the port the screen gives starts unencrypted and switches to TLS straight away.
  2. Open Routing and add an Outbound rule for your domain. Under Also deliver to / Route, change the route to the host you just added.
  3. In the same rule, under Headers, choose Add custom headers and add X-Signplume-Tenant with your header secret as its value. This is how the relay recognises your organisation's mail; it removes the header before the message travels on.
  4. Accept the mail coming back. Allow the relay's address in your inbound gateway, so stamped mail is delivered rather than refused on your own doorstep. Skip this and messages are stamped and then turned away, and they show as delivery problems on Mail.

Live status

The Live status card says Ready when mail from your registered ranges is accepted and stamped, or Not ready with the reason, and when a message from your organisation last reached the relay. Messages your platform refused on the way back are listed on Mail, as Retrying or Given up; given up means the message was not delivered.

Working with the other channels

  • Mail the Outlook add-in already signed is marked, and the relay passes it through instead of adding a second signature.
  • A signature someone pasted from their signature page is recognised and replaced, so it is not doubled.
  • Mail from a person with Signatures off passes through without a signature.
  • The relay knows who each message is going to, so recipient rules apply.
  • Everyone whose mail the relay stamped in the last 30 days shows as Server-side on People, which counts as signing.

What the relay keeps, and for how long, is on How mail is handled.

Rotating

  • Rotate the header secret issues a new value and stops the old one at once: update your routing rule straight away, or the relay turns your mail away.
  • Re-issue relay credentials creates a new relay password (shown once) and a new DKIM selector. Your relay hostname, registered IP ranges and header secret stay the same, so routing keeps working.