Customer PlaybooksSignature Stamping — Customer Playbook

Signature Stamping — Customer Playbook

For AdtoSign Customers | How to set up, configure, and manage the signature gateway (Signature Stamping)

For AdtoSign Customers | How to set up, configure, and manage the signature gateway (Signature Stamping)

What Signature Stamping Does

The signature gateway (Signature Stamping) is AdtoSign's server-side signature deployment method. Instead of relying on the Outlook add-in, Signature Stamping intercepts emails through your email platform's transport rules and injects signatures at the gateway — ensuring every email gets a signature regardless of device or client.

Key Capabilities

  • Universal coverage: Works on mobile, desktop, web, and any email client
  • No add-in required: Signatures applied server-side via signature gateway
  • Image embedding: All images converted to inline CID attachments (no "download images" prompt)
  • Banner injection: Campaign banners applied at the gateway
  • DKIM/DMARC preservation: Gateway re-signs with DKIM to maintain email authentication
  • Multi-platform support: Microsoft 365, Google Workspace, Zoho, Zimbra
  • Dedicated or shared gateway: Plan-dependent — shared pool or dedicated egress IP

Getting Started

Step 1: Check Plan Eligibility

Signature Stamping is a plan-gated feature. Check with your AdtoSign admin or the Deployment page to see if your plan includes Signature Stamping.

Plan types:

  • None: Signature Stamping not available — use Outlook add-in instead
  • Shared: Use the shared regional gateway (common pool)
  • Dedicated: Your own dedicated gateway with dedicated egress IP (premium plans)

Step 2: Navigate to Deployment

  1. Go to Deployment in the AdtoSign sidebar
  2. Click Signature Stamping
  3. The setup wizard will guide you through platform-specific steps

Step 3: Select Your Platform

Choose your email platform:

  • Microsoft 365: Automated connector + transport rule setup via Azure Function
  • Google Workspace: Manual smart-host configuration in Google Admin Console
  • Zoho: Manual smart-host configuration in Zoho Mail admin
  • Zimbra: Manual smart-host + tenant IP allowlist (self-hosted, egress IPs not in shared ranges)

Step 4: Configure DNS Records

The wizard will show you the DNS records needed:

  • MX record: Points your mail routing to the AdtoSign gateway
  • SPF record: Includes the gateway's sending IP
  • DKIM record: Allows the gateway to sign outgoing email

Step 5: Set Up Transport Rule / Smart Host

For Microsoft 365:

  • AdtoSign creates an Exchange connector and transport rule automatically
  • Requires Azure AD app with Exchange.ManageAsApp permission
  • The transport rule routes emails from AdtoSign-enabled users through the gateway

For Google Workspace:

  • Configure smart host in Google Admin Console
  • Set the gateway host address provided by the wizard
  • Add SPF/DKIM records to your DNS

For Zoho:

  • Configure smart host in Zoho Mail admin settings
  • Add the gateway host address
  • Configure SPF/DKIM records

For Zimbra:

  • Set gateway host: zmprov ms <host> zimbraMtaRelayHost <relayHost>:587
  • Add Zimbra server's PUBLIC sending IPs to tenant IP allowlist
  • Configure SPF/DKIM records

Step 6: Verify Setup

  1. Send a test email from an enabled user
  2. Check the received email for:
    • Signature appears correctly
    • Images are inline (no "download images" prompt)
    • X-AdtoSign-Processed header is present
  3. Check the Deployment page for status

Managing Signature Stamping

Distribution Group Management

Signature Stamping processes emails only from users in the AdtoSign-enabled distribution group:

  1. Go to Deployment > Distribution Group
  2. The wizard generates a PowerShell script to create the group
  3. Run the script in Exchange Online PowerShell
  4. Add/remove users from the group as needed

Tenant IP Allowlist

For self-hosted platforms (Zimbra) or custom setups:

  1. Go to Deployment > Tenant IPs
  2. Add your server's public sending IP addresses
  3. The gateway will only accept connections from allowlisted IPs

Gateway Type Management (Root Admins Only)

If you're the root organization admin:

  1. Go to Deployment > Signature Stamping
  2. View the Family Usage panel
  3. For each workspace, select gateway type:
    • Off: No Signature Stamping for this workspace
    • Shared: Use the shared gateway pool
    • Dedicated: Use a dedicated gateway (if plan allows)
  4. Changes may require confirmation for destructive actions (dedicated to shared/off)

Troubleshooting

Signatures Not Appearing

  1. Check if Signature Stamping is enabled: Deployment > Signature Stamping > Status
  2. Check user is in distribution group: The AdtoSign-enabled-users group
  3. Check transport rule: For Microsoft 365, verify the rule is active
  4. Check gateway logs: Ask your AdtoSign admin to check gateway processing
  5. Check X-AdtoSign-Processed header: If missing, email bypassed the gateway

"Download Images" Prompt Still Appearing

This means Signature Stamping is not processing the email:

  1. Verify Signature Stamping is enabled and active
  2. Verify the user is in the distribution group
  3. Verify the transport rule/smart host is routing through the gateway
  4. Check if the email was sent from a platform that bypasses the gateway

DKIM/DMARC Failures

  1. Verify DKIM DNS records are correctly published
  2. Verify SPF includes the gateway's sending IP
  3. Check if the gateway is re-signing with DKIM (check gateway logs)
  4. For dedicated gateway, verify the dedicated egress IP is in SPF

Mobile Signatures Still Showing Old Signature

Signature Stamping should strip and replace mobile signatures:

  1. Check if the email has X-AdtoSign-Processed header
  2. If yes, the gateway processed it but may not have stripped the old signature (bug)
  3. If no, the email bypassed the gateway — check routing

Zimbra-Specific Issues

  1. Connection refused: Verify Zimbra egress IPs are in tenant IP allowlist
  2. Gateway Host not set: Run zmprov ms <host> zimbraMtaRelayHost <relayHost>:587
  3. Emails not routing: Verify Zimbra MTA configuration
  4. SPF failures: Zimbra self-hosted IPs are NOT in shared provider ranges — must be in SPF

Best Practices

  1. Use distribution groups: Only enable users who need Signature Stamping — don't enable all users
  2. Test with a small group first: Verify before mass deployment
  3. Monitor gateway status: Check the Deployment page regularly
  4. Keep DNS records current: DKIM/SPF changes can break email delivery
  5. For Zimbra: Always add egress IPs to the tenant IP allowlist
  6. For Microsoft 365: Keep the Azure AD app certificate current (rotation handled by AdtoSign)
  7. Dedicated vs Shared: Use dedicated for high-volume senders or compliance requirements

References

Was this page helpful?