Set up High Security email on High Security Email API overview

Trusted-server integration

Create, bind and deliver each message code safely

1
Complete the High Security seal first
Purchase and fulfil the separate High Security Email Verification Seal. Domain ownership, the exact sender address, SPF, DKIM and DMARC must be current. A Low Security Email Sender Seal cannot issue per-message VEM codes.
2
Open the API from the issued seal
Sign in to the customer portal, open My seals, select the issued High Security email seal and choose Manage High Security Email API. Create a separately named key for each production server, application or outbound gateway.
3
Install at the final mail-building point
Add the integration to the server-side application, queue worker, mail transport plug-in or outbound gateway that builds the complete message. It must be able to set Message-ID, add a custom header and update both HTML and plain-text bodies before DKIM signing.
4
Store the API key outside public content
Copy the key once into a protected environment variable, secret manager or server configuration outside the public web directory. Never place it in a website page, browser JavaScript, email template, signature editor, mobile device or source repository.
5
Create stable send identifiers
When the mail or queue job is created, generate its final RFC Message-ID and a stable idempotency key. Persist both with the job so a retry uses the same Message-ID, idempotency key and VEM code.
6
Request one code for that message
Before sending, POST the exact final message_id, including angle brackets, and the idempotency_key to the VerifySeal endpoint. Authenticate with the server API key in the Authorization Bearer header and require a successful response.
7
Place every returned value correctly
Add message_code.header to the message headers. Append message_code.html_footer to the HTML MIME part and message_code.text_footer to the plain-text MIME part. Do not paste one fixed VEM code into a reusable signature.
8
Apply DKIM signing and send last
After Message-ID, the X-VerifySeal-Code header and both message bodies are final, allow the local mailer or downstream provider to apply DKIM and send. Nothing may rewrite the Message-ID or remove the verification data afterward.
9
Test the delivered source
Send to an external mailbox, open the original message source and confirm the received Message-ID exactly matches the value submitted to VerifySeal. Check the VEM header and footer, open the public verification link, and confirm aligned DKIM and DMARC pass.
10
Monitor, retry and revoke safely
Treat an API failure as a failed or queued High Security send. Reuse the same idempotency key on retry. Revoke a VEM code for a cancelled or exposed message, and revoke and replace any server key that may have leaked.

Example seal code

Sign in and open an issued Email Sender Seal to receive installation links with your real code already filled in.

Message-code API endpoint

https://sitelock365.com/api/email/v1/codes.php

JSON request body

{
    "message_id": "<unique-id@example.com>",
    "idempotency_key": "your-stable-send-id"
}

Server-side cURL example

curl -X POST 'https://sitelock365.com/api/email/v1/codes.php' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"message_id":"<unique-id@example.com>","idempotency_key":"your-stable-send-id"}'

Response fields to insert

{
  "message_code": {
    "code": "VEM-...",
    "header": "X-VerifySeal-Code: VEM-...",
    "text_footer": "...",
    "html_footer": "...",
    "verify_url": "https://..."
  }
}

Sign in, open an issued High Security email seal and choose Manage High Security Email API to create a one-time API key and copy complete examples.

API keys are server secrets. Never place one in browser JavaScript, a public page, an email signature or an email.

Where to install it

Install the integration on the system that builds and sends the final email

The High Security seal is not one permanent image or code pasted into a website or signature. Your trusted sending system requests a new VEM code and inserts its verification data into every individual message before that message is DKIM-signed and delivered.

Location	What to configure there	Correct placement
Customer portal	Open My seals → High Security Email Verification Seal → Manage High Security Email API. Create and copy a named key for the sending system.	Account and key management only. The per-message integration does not run in the customer portal.
Hosting or application server	Store the API key in a protected environment variable, secret manager or non-public server configuration.	Outside `public_html` and outside templates, logs, repositories and browser-accessible configuration.
Mailer, queue worker or gateway	Create the final Message-ID, call the VerifySeal API, then add the returned header and both body footers.	Immediately before DKIM signing and the final SMTP, Gmail API or Microsoft Graph submission.
Email HTML body	Append `message_code.html_footer` after the message content and normal signature.	Inside the final HTML MIME part before signing. Keep the verification link unchanged.
Email plain-text body	Append `message_code.text_footer` after the text content and signature.	Inside the final text MIME part before signing so non-HTML recipients receive the same VEM code.
Email headers	Add the returned `X-VerifySeal-Code` header and preserve the exact submitted `Message-ID`.	In the final message headers before DKIM. The delivery provider must not replace either value.
DNS control panel	Maintain SPF, the selected DKIM record and DMARC for the verified sender domain.	DNS supports authentication, but the VEM API key and per-message code are never published in DNS.
Website or signature editor	A linked base seal image may be displayed separately, but it does not create High Security message verification.	Do not place the API key or a fixed VEM code here. Static signature installation is the Low Security method.

Choose the sending system

Open the detailed guide for the software that sends your email

Use the guide for the final mailer—not merely the website control panel. If a platform rewrites Message-ID or cannot add the custom header and both MIME footers, send High Security mail through a trusted gateway that preserves the completed message.

PHP

PHP and PHPMailer

Set the final PHPMailer MessageID, request a VEM code, add its header and footer, then let the configured mail transport apply DKIM.