Message headers reference
Obsidian adds these headers to delivered mail (when the policy's "Add X-Obsidian headers" is on). Mail platforms use them to route tagged mail to Junk; administrators use them to find a message in the trace.
| Header | Meaning |
|---|---|
| X-Obsidian-Verdict | Final verdict: clean, bulk, spam, phish, bec, virus, malware, blocked or policy. |
| X-Obsidian-Score | Total score with one decimal. |
| X-Obsidian-Spam | Yes when the message was delivered but judged spam / phishing / BEC (tagged). Use this in Junk rules. |
| X-Obsidian-Bulk | Yes for newsletters / marketing mail. |
| X-Obsidian-Rules | The strongest rules that fired, with their points. |
| X-Obsidian-ID | Message ID in Obsidian - paste it into Message trace search. |
| X-Obsidian-AI | The AI verdict and risk when the model reviewed the message. |
| X-Obsidian-AI-Review | 'released' on mail released automatically after an AI hold. |
| X-Obsidian-Released | Who released the message from quarantine and when. |
| X-Obsidian-Error | Present only when clamav.fail_action=accept delivered a message that could not be scanned. |
| X-Obsidian-Relay-Key | Secret stamped by the tenant's outbound rule; checked and removed by the gateway, never delivered. |
| Authentication-Results | SPF, DKIM, DMARC and ARC results as seen by the gateway. |
Example
X-Obsidian-Verdict: spam
X-Obsidian-Score: 6.4
X-Obsidian-Spam: Yes
X-Obsidian-Bulk: No
X-Obsidian-Rules: BODY_SCAM_LANGUAGE=2.4, SPF_SOFTFAIL=1, URL_SHORTENER=1, ...
X-Obsidian-ID: 5fdd5be358454c4a92c4732de73b588b
Authentication-Results: mx1.example.com; spf=softfail smtp.mailfrom=x@example.net; dkim=none; dmarc=none header.from=example.net; arc=noneRouting tagged mail to Junk
- Microsoft 365
- Exchange admin center › Mail flow › Rules › new rule: A message header matches
X-Obsidian-Spam=Yes→ Modify the message properties › set the spam confidence level (SCL) to 6. - Google Workspace
- Gmail › Spam, phishing and malware › Inbound gateway › Message is spam if the following header regexp matches:
X-Obsidian-Spam: Yes. - Exchange Server
- Transport rule: header
X-Obsidian-SpamincludesYes→ set SCL to 6.
Optionally treat X-Obsidian-Bulk: Yes the same way, or send it to a "Newsletters" folder with an inbox rule.