VerifySeal ManagerLive verification platform
← All installation guides High Security Email Integrations

Set up High Security email on PHP and PHPMailer

Set the final PHPMailer MessageID, request a VEM code, add its header and footer, then let the configured mail transport apply DKIM.

PHP
Recommended methodServer-side per-message API
Trusted-server integration

Create, bind and deliver each message code safely

  1. 1

    Keep the key outside public files

    Store the VerifySeal API key in a server environment variable such as VERIFYSEAL_EMAIL_API_KEY. Never commit it to a repository or place it in public_html, JavaScript or a template.

  2. 2

    Create the Message-ID yourself

    Before PHPMailer prepares the message, create a globally unique value such as <random@example.com> and assign that exact value to the PHPMailer MessageID property. Use a domain controlled by the sender.

  3. 3

    Request the VEM code

    Call the VerifySeal endpoint from PHP with the same Message-ID and a stable application send ID. Require a successful JSON response before allowing a High Security message to continue.

  4. 4

    Add both message formats

    Add message_code.header as a custom header. Append html_footer to Body and text_footer to AltBody so both MIME alternatives identify the same code.

  5. 5

    Send through the final signer

    Call send only after the content is complete. If PHPMailer signs DKIM locally, configure signing on that same instance. If an SMTP provider signs downstream, confirm it preserves Message-ID and the footer.

  6. 6

    Test the received source

    Inspect a message received outside your network. Confirm the final Message-ID exactly matches the one submitted, X-VerifySeal-Code is present, the verification link opens, and DKIM/DMARC pass.

Open PHPMailer MessageID source documentation ↗
High Security still requires domain authentication

A VEM code does not replace SPF, DKIM or DMARC

The sender domain must continue to publish a valid SPF record, the selected DKIM key and a DMARC policy. VerifySeal automatically rechecks these records according to the administrator schedule. For High Security messages, DKIM must cover the final Message-ID, VEM header and completed body.

  • SPF authorizes sending services
  • DKIM verifies the signed message domain
  • DMARC publishes the domain policy
Testing checklist

Confirm the installation is working

01

Message-ID

The exact final Message-ID is created before the API request and matches the sent email.

02

VEM code

The returned header and footer are present and the public verification link opens.

03

DKIM last

The receiving service reports an aligned DKIM and DMARC pass after all content was inserted.

04

Revocation

Revoking the test code immediately changes its public status.

Platform notes
  • PHPMailer exposes a MessageID property for a custom RFC Message-ID. A delivery provider can still replace it, so the received source must be tested.
  • Treat an API failure as a failed High Security send. Queuing an unmarked message would reduce it to an ordinary email.
All seal types

View every available VerifySeal design

Domain OwnershipEmail Sender VerificationHigh Security Email VerificationVerified BusinessVerified OrganizationVerified ResellerTrusted WebsiteCertified MemberAustralian Builder LicenceAustralian Financial Services LicenceWebsite PCI DSS ComplianceDocument IntegrityVerified Issuer DocumentHigh Security Document Authentication