Klytic

Home›Guides›Email security

Email security · Use Klytic MTA

Reading and exporting a filter decision

Every Klytic MTA decision is explained: a score and a reason are added to the headers of the delivered message. The Essential plan provides this explanation; the Advanced plan adds CIS / NIST-compliant logs exportable to your SIEM, and a DMARC console. After a short period, the audit trail no longer contains the content of the mail, only its technical traces.

Updated October 20265 minHow-to Klytic MTA

What you get

ToolEssentialAdvanced
Score and reason for each decision in the message headersIncludedIncluded
Decision visible when releasing a quarantined messageIncludedIncluded
Newsletter and promotion category in a headerIncludedIncluded
CIS / NIST-compliant logs, exportable to a SIEMNoIncluded
DMARC console: reports, alerts and suggested fixesNoIncluded

This is done with Klytic MTA. It does not depend on Klytic Mail: it also works in front of Microsoft 365, Google Workspace, Exchange or any other server.

Who can do it

  • The Klytic MTA administrator reads the decisions, arranges the log export and monitors the DMARC console if the Advanced plan is subscribed.
  • The user can read the headers of their own messages and sees the decision when releasing a quarantined message.
  • Klytic connects the export to your SIEM with you and answers questions about a decision.

Reading the headers of a delivered message

Headers are the technical lines that accompany every message. Most email software can display them, under a name that varies: full headers, message source or original message. Klytic MTA adds its own lines, all starting with X-KlyticMTA.

HeaderWhat it indicates
X-KlyticMTA-StatusThe decision applied to the message.
X-KlyticMTA-ScoreThe score calculated by combining the analysis signals.
X-KlyticMTA-ReasonThe reason or reasons that weighed in the decision.
X-KlyticMTA-CategoryThe graymail category, newsletters or promotions, when it applies.

Read the reason as an explanation: it shows which family of checks weighed most, for example sender authentication, reputation, content, an attachment or impersonation. For messages with an ambiguous score, AI arbitration supplements the other signals, in both plans; if it does not respond, the filter still makes a decision. How it works is explained in AI in email filtering, and what leaves the company.

Your email service may add its own filtering headers. Only those starting with X-KlyticMTA come from Klytic MTA.

Example. An accountant is surprised that an invoice from a regular supplier arrived with a high score. The administrator displays the headers: the reason concerns authentication of the sender’s domain. The supplier changed its sending tool without updating its SPF record. The fix is on the supplier’s side. In the meantime, the administrator can set a sender rule for the domain, after confirming the change by phone with a known contact.

A quarantined or rejected message

A quarantined message is not yet in the mailbox. Its decision is visible at the time of release: the procedure is described in Quarantine, false positives and reporting.

A rejected message does not arrive. It therefore has no headers to read. Its technical trace remains in the gateway logs. With the Advanced plan, you will find it in the exported logs; otherwise, contact Klytic support with the approximate time and the sender’s domain.

Exporting logs to a SIEM

With the Advanced plan, Klytic MTA produces CIS / NIST-compliant logs, exportable to your SIEM, the tool that centralizes security events across your information system. You will find the gateway’s decisions there alongside the other events you monitor.

The connection is prepared with Klytic. Before discussing it, gather:

  • the export destination, that is, your SIEM’s collection point;
  • the formats and ingestion methods your SIEM accepts;
  • the retention period you want to apply on your side. It is a matter of your policy, not of the gateway: see Retaining and reviewing email security logs.

The DMARC console

The DMARC console is also part of the Advanced plan. It does not cover the mail you receive, but your own domains: it gathers DMARC reports, flags anomalies and suggests fixes to your SPF, DKIM and DMARC configuration. For what these mechanisms mean, see SPF, DKIM and DMARC: what they protect, and what they do not.

What the audit trail no longer contains

Klytic MTA does not keep a copy of your mail. After normal delivery, the personal analysis data is purged after a short period, 2 days by default:

  • deleted: the sender’s address, the recipients, the subject, the message body, the attachment names;
  • retained: the timestamp, the sender’s domain, the scores, the decision and the technical analysis data.

Two cases are exceptions, only for as long as necessary: a dangerous message in quarantine remains complete for the validity of its release link, 7 days; a message waiting because your server is not responding remains encrypted until it is delivered or the delay expires.

An audit that searches the gateway for the text of a message received a month ago will not find it. The message itself is in the recipient’s mailbox and, where applicable, in your email backup. The gateway keeps proof of the decision, not the mail.

The details of these periods, and how they differ from a legal retention period, are in Retaining and reviewing email security logs.

Frequently asked questions

Do I need the Advanced plan to understand a decision?

No. The score and reason are in the headers with Essential. Advanced adds log export and the DMARC console. See the Klytic MTA offer.

How do I correct a decision that keeps recurring?

With a sender rule for the domain. See Who sets the filter in Klytic MTA.

Can I find the subject of a message received last month?

Not in the gateway: it is purged after 2 days by default. See Retaining and reviewing email security logs.

What does DMARC check on my messages?

See SPF, DKIM and DMARC.

Connect Klytic MTA to your SIEM

Log export is part of the Advanced plan. Klytic prepares the connection with you.

Contact Klytic →

Compare Essential and Advanced

Further reading

Understand · Email securityRetaining and reviewing email security logsA filtering log says what was decided and why, not what the message said. What it contains, how long to keep it, and who reads it.6 min readRead →Understand · Email securitySPF, DKIM and DMARC: what they protect, and what they do notSPF, DKIM and DMARC prevent others from using your exact domain. They do not read the message: what they stop, what gets through, how to deploy them.6 min readRead →Use · Email securityQuarantine, false positives and reportingWhat happens to a message held by Klytic MTA, how to release it, correct a false positive and report a malicious message.6 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing