VerifySeal ManagerLive verification platform
← All installation guides High Security Email Integrations

Set up High Security email on Microsoft 365 and Graph

Use a trusted Graph or SMTP application that submits the completed MIME message; Outlook signatures and mail-flow disclaimers are Low Security only.

M365
Recommended methodServer-side per-message API
Trusted-server integration

Create, bind and deliver each message code safely

  1. 1

    Choose a trusted sending application

    Use a protected server application with Microsoft Graph or an approved SMTP/gateway integration. Do not put the API key in Outlook, Office add-in browser code, a signature or an Exchange disclaimer.

  2. 2

    Create the Message-ID before sending

    Build the MIME message and assign its final Message-ID using the verified sender domain before requesting a VEM code. Persist the value for queue retries.

  3. 3

    Insert the VEM data

    Add message_code.header to the MIME headers and append the returned HTML and text footers before serialization. Keep the public verification URL unchanged.

  4. 4

    Submit completed MIME through Graph

    Use the MIME form of user sendMail, or a trusted gateway that accepts the finished message. The platform must not regenerate the Message-ID or remove the custom header.

  5. 5

    Verify provider preservation

    Inspect the message received outside Microsoft 365 and compare its internet Message-ID with the value sent to VerifySeal. Microsoft 365 configuration and security services can alter messages.

  6. 6

    Check DKIM and DMARC

    Confirm the received message contains the VEM footer/header and has aligned DKIM and DMARC passes. If the Message-ID changes, use a mail route that preserves it.

Open Microsoft Graph sendMail documentation ↗
High Security still requires domain authentication

A VEM code does not replace SPF, DKIM or DMARC

The sender domain must continue to publish a valid SPF record, the selected DKIM key and a DMARC policy. VerifySeal automatically rechecks these records according to the administrator schedule. For High Security messages, DKIM must cover the final Message-ID, VEM header and completed body.

  • SPF authorizes sending services
  • DKIM verifies the signed message domain
  • DMARC publishes the domain policy
Testing checklist

Confirm the installation is working

01

Message-ID

The exact final Message-ID is created before the API request and matches the sent email.

02

VEM code

The returned header and footer are present and the public verification link opens.

03

DKIM last

The receiving service reports an aligned DKIM and DMARC pass after all content was inserted.

04

Revocation

Revoking the test code immediately changes its public status.

Platform notes
  • Outlook signatures and Exchange mail-flow disclaimers can display the Low Security seal but cannot implement the High Security code workflow on their own.
  • Microsoft Graph supports sending MIME content; production compatibility still depends on the final service preserving the submitted Message-ID and custom header.
All seal types

View every available VerifySeal design

Domain OwnershipEmail Sender VerificationHigh Security Email VerificationVerified BusinessVerified OrganizationVerified ResellerTrusted WebsiteCertified MemberAustralian Builder LicenceAustralian Financial Services LicenceWebsite PCI DSS ComplianceDocument IntegrityVerified Issuer DocumentHigh Security Document Authentication