Receiver requirements
Compute the signature from the exact raw request body. Compare signatures in constant time.
Signed webhooks
Signed webhooks
Delivery, bounce, and complaint events signed with HMAC-SHA256.
Outbound controls
Endpoint creation requires HTTPS. Private, loopback, link-local, metadata, credential-bearing, and internal targets are blocked and resolved again at dial time. Redirects are not followed. Delivery uses bounded timeouts and retry attempts.
Implemented controls
TLS for supported external HTTP and SMTP submission paths Hashed, scoped, expiring API keys with optional IP allowlists
Encryption boundary
TLS is transport encryption, not end-to-end email encryption. Recipient providers can process delivered content. Customers needing message-level confidentiality must add an appropriate scheme such as S/MIME, PGP, or application-layer encryption.
signed = timestamp + "\0" + event_id + "\0" + raw_body
expected = HMAC-SHA256(webhook_secret, signed)
constant_time_compare(expected, Postline-Signature)