Verdict email headers

This page includes:

Verdict headers

After Perception Point X‑Ray scans an email, various entries may be added to the email header to define the results of the scan.

Note:

  • The email headers that are described below are not added when a scan is performed using the Microsoft 365 API integration.

  • The email headers that are described below are not added to outgoing emails.

Header

Explanation

X-PERCEPTION-POINT-VERDICT

  • "MAL" – Malicious content was found in the email.

  • "CLN" – The email is clean. [It may be spam.]

X-PERCEPTION-POINT-SPAM

  • "FAIL" – The email was classified as "Spam".

  • "PASS" – The email is clean - it is not spam.

X-PERCEPTION-POINT-SUB-VERDICT

  • "MAL" – Malicious content was found in the email.

  • "SPAM" – The email is marked as "Spam".

  • "BLK" – The file/URL was blocked due to policy restrictions (for example, .exe files).

  • "CLN" – The email is clean.

    [Suspicious emails are also included in CLN]

X-PERCEPTION-POINT-SPF

  • "FAIL" – The email failed the SPF tests.

  • "PASS" – The email passed the SPF tests.

X-PERCEPTION-POINT-BEC-VERDICT

  • "FAIL" – The email failed the BEC tests.

  • "PASS" – The email passed the BEC tests.

X-PERCEPTION-POINT-DKIM

Not currently used

Sample additions to headers

  • For an email with a clean verdict

  • For an email with a spam verdict

See also: