Add Result Header to Email

The headers contain only the most important analysis results, not the full analysis output. To activate this:

In the Expert Editor, open shared/guarded_tenants.yml.
Find messageProcessing.pipelines.default, and add this line:

guarded_tenants.yml

tenants:
  - name: example
    messageProcessing:
      pipelines:
        emails:
          # Supported values: Enabled|EnabledInbound|Disabled
          analysisResultInMimeHeader: EnabledInbound

Click Publish. The new setting becomes active within about one minute. With this feature enabled, the header of an analyzed email will look like the one below:

x-xor-id: 111111111111-1111-1111-1111-111111111111
x-xor-decision: DELIVER
x-xor-verdict: spam
x-xor-verdict-confidence: high
x-xor-tags: #spam, #highrisk, #hsrisk, #domainonlyinbound, #mprisk, #noreputation, #rsdmediumscore, #senderonlyinbound, #tldnoreputation, #untrusted, #auth, #lowscore, #spfpass, #banner, #deliver, #dkimfromsigned, #eachlinkmfrom, #htmlmessage, #inc

The x-xor-verdict-confidence header is only included when the verdict is either Phishing, Spam, VIP Fraud, Impersonation, or Policy. The other verdicts do not have a confidence.