Deploy Across 10,000+ Seats in 60 Minutes
Zero desktop agents. Zero MX disruption. Automate Microsoft 365 Exchange mailflow rules, centralized Outlook Add-in deployment, and directory identity sync.
Zero MX Disruption
No DNS MX record changes. Your primary mailflow continues to hit Microsoft 365 or Google Workspace directly.
Zero Desktop Agents
Employees install zero software. The Outlook Add-in deploys centrally via Microsoft 365 Admin Center with one click.
Automated PowerShell
Generate fully customized Exchange Online Transport Rules that quarantine AI impersonators and bypass spam for verified humans.
Entra ID & SCIM Sync
Automate employee attestation keys through standard SCIM 2.0. Instant offboarding via O(1) revocation bloom filters.
Interactive Enterprise Rollout Configurator
Customize your organization's deployment parameters to generate production-ready scripts and manifests.
# =================================================================
# HumanMail Automated Exchange Online Transport Deployer
# Generated for: contoso.com | Mode: Quarantine
# =================================================================
# 1. Connect to Microsoft 365 Tenant
if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force -AllowClobber
}
Connect-ExchangeOnline -ShowBanner:$false
# 2. Trusted SaaS Transactional Allowlist (Bypass non-human drops for business tools)
$SaaSAllowlist = @("docusign.net", "stripe.com", "github.com", "salesforce.com", "workday.com", "slack.com", "zoom.us", "okta.com")
# 3. Rule 1: Deliver Verified Humans Directly to Focused Inbox (SCL -1)
New-TransportRule -Name "HumanMail-01-DeliverVerifiedHuman" `
-HeaderMatchesMessageHeader "X-Human-Attestation" `
-HeaderMatchesPatterns "Pass" `
-SetSCL -1 `
-SetHeaderName "X-HumanMail-Route" `
-SetHeaderValue "Delivered-Verified-Human" `
-Priority 0 `
-Comments "Fast-tracks attested human senders directly to inbox."
# 4. Rule 2: Intercept AI Bot Impersonation & VIP Wire Fraud
New-TransportRule -Name "HumanMail-02-ProtectVIPImpersonation" `
-FromScope "NotInOrganization" `
-HeaderMatchesMessageHeader "X-Human-Attestation" `
-HeaderMatchesPatterns "Fail|Revoked|Expired|Missing" `
-RecipientAddressMatchesPatterns "ceo@contoso.com|cfo@contoso.com|treasury@contoso.com" `
-ExceptIfSenderDomainIs $SaaSAllowlist `
-Quarantine $true `
-Priority 1 `
-Comments "Protects company executives against AI bot swarms and unverified impersonation."
# 5. Rule 3: Diagnostic Stamp for Outlook Add-in
New-TransportRule -Name "HumanMail-03-TagClientInspection" `
-FromScope "NotInOrganization" `
-SetHeaderName "X-HumanMail-Inspected" `
-SetHeaderValue "M365-TransportRule-v1" `
-Priority 2
Write-Host "Success! HumanMail rules active in Exchange Online. Verify with: Get-TransportRule HumanMail*" -ForegroundColor GreenMicrosoft 365 Outlook Add-in (Centralized Deployment)
Compliant Office.js manifest.xml ready for zero-touch deployment across Desktop, Web, and Mobile.
manifest.xml.DNS Public Key Attestation Record
Publish this TXT record to enable recipient MTAs to verify your corporate authority statelessly.
Frequently Asked Architecture & Security Questions
Does HumanMail ever store our company's emails?
No. The HumanMail protocol is strictly zero-knowledge and stateless. Inbound emails flow directly to your Microsoft 365 or Google Workspace tenant. Transport rules verify the Ed25519 signature headers in <1ms without storing or caching message bodies.
How do we handle automated SaaS emails (DocuSign, Stripe, Salesforce)?
The generated PowerShell script incorporates a SaaS allowlist. Transactional and billing notifications bypass strict Proof-of-Personhood checks while user-facing personal emails require cryptographic human attestation to receive the verified badge.
How does Outbound Signing work without installing software on employee laptops?
We provide a turnkey Outbound Signing Partner Connector for Exchange Online. When employees send external emails, Exchange securely routes the message through an Outbound Milter (backed by Azure Key Vault or AWS KMS) which injects the cryptographic attestation header before delivering to the internet.
What happens if an employee leaves the company?
Via our SCIM 2.0 connector with Microsoft Entra ID (Azure AD), when an employee account is disabled, their cryptographic key is pushed to the global O(1) bloom filter revocation registry. Any further emails signed with that key fail verification instantly.
Ready to schedule an enterprise pilot?
Our team assists with Exchange Online staging and custom connector provisioning.