ECDSA P-256 signed identity headers that let any recipient programmatically verify an email was AI-generated, who operated the agent, and what oversight was in place.
Regulators worldwide are mandating AI disclosure in communications, but there is no standard way to make that disclosure machine-readable. A footer saying "This email was sent by AI" is easy for humans to read but impossible for downstream systems to parse reliably. Email providers, compliance tools, and receiving agents need a structured, cryptographically verifiable signal — not a line of prose buried in the body. Without a machine-readable header, organizations cannot build automated AI-email filtering, cannot prove disclosure compliance to auditors, and cannot verify that a disclosure claim is authentic rather than spoofed.
MultiMail attaches two headers to every AI-sent email. X-AI-Generated: true is an unsigned convenience header for simple filtering. X-MultiMail-Identity is the real payload: an ECDSA P-256 signed, base64url-encoded JSON claim containing ai_generated, operator, oversight mode, capabilities, reputation hash, and timestamps. Anyone can verify the signature against the public key published at /.well-known/multimail-signing-key. Unlike DKIM — which cannot sign custom headers via Postmark and breaks on forwarding — the MultiMail identity claim is independently verifiable, carries richer metadata, and survives DKIM breakage. The ai_disclosure mailbox setting defaults to true and can be disabled for human-operated mailboxes.
Your AI agent calls the /v1/send endpoint. MultiMail checks the mailbox's ai_disclosure setting (default: true). If enabled, the system prepares the identity claim.
MultiMail builds a JSON payload with ai_generated, operator, oversight mode, capabilities, verified_operator status, service identifier, creation timestamp (iat), and a reputation_hash. Keys are sorted for canonical JSON serialization to ensure deterministic signing.
The canonical JSON is signed with MultiMail's ECDSA P-256 private key. The signature and payload are base64url-encoded and attached as the X-MultiMail-Identity header. A plain X-AI-Generated: true header is also added.
A human-readable sig block — including 'This email was sent by an AI agent.' — is appended to the email body, satisfying text-based disclosure requirements alongside the machine-readable header.
Any recipient or intermediate system fetches the public key from multimail.dev/.well-known/multimail-signing-key, decodes the base64url header, and verifies the ECDSA signature. The verification page at multimail.dev/verify provides a browser-based tool for manual checks.
import requests
import json
import base64
API = "https://api.multimail.dev/v1"
HEADERS = {"Authorization": "Bearer mm_live_xxx"}
"cm"># Send — disclosure headers are added automatically
resp = requests.post(
f"{API}/send",
headers=HEADERS,
json={
"from": "[email protected]",
"to": "[email protected]",
"subject": "Q1 Report Summary",
"text_body": "Here is your Q1 report summary..."
}
)
message_id = resp.json()["message_id"]
print(f"Sent with AI disclosure: {message_id}")
"cm"># Later: read received email and decode the identity header
resp = requests.get(
f"{API}/inbox",
headers=HEADERS,
params={"mailbox": "[email protected]", "limit": 1}
)
email = resp.json()["emails"][0]
identity_header = email["headers"].get("X-MultiMail-Identity", "")
if identity_header:
"cm"># Decode the base64url payload (before signature verification)
parts = identity_header.split(".")
payload_bytes = base64.urlsafe_b64decode(parts[0] + "==")
claim = json.loads(payload_bytes)
print(f"AI generated: {claim[&"cm">#039;ai_generated']}")
print(f"Operator: {claim[&"cm">#039;operator']}")
print(f"Oversight: {claim[&"cm">#039;oversight']}")Send an email via the MultiMail API. AI disclosure headers are attached automatically when ai_disclosure is enabled on the mailbox.
async function verifyIdentityHeader(
header: string
): Promise<{ valid: boolean; claim: Record<string, unknown> | null }> {
"cm">// Header format: base64url(payload).base64url(signature)
const [payloadB64, signatureB64] = header.split(".");
if (!payloadB64 || !signatureB64) {
return { valid: false, claim: null };
}
"cm">// Fetch the public key
const keyResp = await fetch(
"https://multimail.dev/.well-known/multimail-signing-key"
);
const jwk = await keyResp.json();
const publicKey = await crypto.subtle.importKey(
"jwk",
jwk,
{ name: "ECDSA", namedCurve: "P-256" },
false,
["verify"]
);
"cm">// Decode base64url
const payloadBytes = Uint8Array.from(
atob(payloadB64.replace(/-/g, "+").replace(/_/g, "/")),
(c) => c.charCodeAt(0)
);
const signatureBytes = Uint8Array.from(
atob(signatureB64.replace(/-/g, "+").replace(/_/g, "/")),
(c) => c.charCodeAt(0)
);
"cm">// Verify ECDSA P-256 signature
const valid = await crypto.subtle.verify(
{ name: "ECDSA", hash: "SHA-256" },
publicKey,
signatureBytes,
payloadBytes
);
const claim = valid
? JSON.parse(new TextDecoder().decode(payloadBytes))
: null;
return { valid, claim };
}Fetch the public key and cryptographically verify the X-MultiMail-Identity header using Web Crypto API.
"cm"># Fetch the public signing key
curl -s https://multimail.dev/.well-known/multimail-signing-key | jq .
"cm"># Decode an X-MultiMail-Identity header payload
"cm"># (replace HEADER_VALUE with the actual base64url string before the dot)
HEADER="eyJhaV9nZW5lcmF0ZWQiOnRydWUsIm9wZXJhdG9yIjoiYWNtZS1jb3JwIn0"
echo "$HEADER" | tr &"cm">#039;_-' '/+' | base64 -d | jq .
"cm"># Full pipeline: fetch an email and extract the identity claim
curl -s -H "Authorization: Bearer mm_live_xxx" \
"https://api.multimail.dev/v1/[email protected]&limit=1" \
| jq -r &"cm">#039;.emails[0].headers["X-MultiMail-Identity"]' \
| cut -d. -f1 \
| tr &"cm">#039;_-' '/+' \
| base64 -d \
| jq .Use curl and base64 to fetch the signing key and inspect a disclosure header from the command line.
{
"ai_generated": true,
"capabilities": ["send", "reply", "read"],
"created": "2026-03-15T09:30:00Z",
"iat": 1773750600,
"operator": "acme-corp",
"oversight": "gated_send",
"reputation_hash": "sha256:a1b2c3d4e5f6...truncated",
"service": "multimail",
"verified_operator": true
}The full JSON payload contained in an X-MultiMail-Identity header after base64url decoding.
ECDSA P-256 signatures let any recipient prove an email was AI-generated without trusting the sender. The public key at /.well-known/multimail-signing-key makes verification independent of MultiMail's API.
DKIM via Postmark only signs From, Date, Subject, MIME-Version, Content-Type, Content-Transfer-Encoding, To, and Message-ID — it cannot sign custom headers. The MultiMail identity claim is self-contained and verifiable even when DKIM breaks on forwarding.
Beyond a boolean ai_generated flag, the signed claim includes the operator identity, oversight mode, agent capabilities, reputation hash, and timestamps — everything a receiving system needs for policy decisions.
MultiMail's Lean 4 formal proofs include the tamper_evident_ai_generated theorem, which proves that modifying the ai_generated field invalidates the signature. This is not just tested — it is mathematically proven.
The ai_disclosure mailbox setting defaults to true. Mailboxes operated by humans can disable it, ensuring headers are only attached when the email is genuinely AI-generated.
Email infrastructure built for AI agents. Verifiable identity, graduated oversight, and a 38-tool MCP server. Formally verified in Lean 4.