Standardizing Webhook Delivery Identity to MailVeri 2.0

Effective immediately today, September 22, 2026, MailVeri is standardizing its outgoing webhook delivery identity across our entire delivery network. All HTTP webhook requests dispatched to user endpoints will now carry the official User-Agent header: MailVeri 2.0.

Why We Are Standardizing

As MailVeri continues to scale its asynchronous batch verification infrastructure, observability, traceability, and security predictability are top priorities for engineering teams integrating our API.

To enhance security posture, streamline log analytics, and prevent false-positive blocks by Web Application Firewalls (WAF) or anti-bot layers, all outbound webhook deliveries now identify as MailVeri 2.0.

• Simplified WAF & Firewall Filtering: Seamlessly allow-list MailVeri traffic in Cloudflare, AWS WAF, Fastly, or Nginx.
• Clear Observability & Log Analytics: Instantly filter and audit webhook dispatches across Datadog, Grafana, ELK, or CloudWatch.
• Consistent Platform Identity: Standardized parity across our edge delivery workers, background batch engines, and developer tooling.

Standardized Webhook Request Format

All webhook POST requests delivered to your configured HTTPS webhook URL include:

POST /your-webhook-endpoint HTTP/1.1
Host: api.yourcompany.com
Content-Type: application/json;charset=UTF-8
User-Agent: MailVeri 2.0
X-Webhook-Signature: t=1758500000,v1=9b0f4a8b7c3d2e1f...

Note: Your payload structure (id, status, download_link) and cryptographic HMAC signature verification (X-Webhook-Signature) remain completely unchanged and backwards-compatible.

Action Required: How to Adapt Your Code & Infrastructure

If your webhook receiver performs strict User-Agent validation, or if your ingress gateway (Cloudflare WAF, AWS WAF, Nginx reverse proxy) filters inbound requests, please verify the following steps:

1. Update WAF & Ingress Allow-Lists

If you inspect or filter incoming traffic by User-Agent at the gateway level:

• Add MailVeri 2.0 (or a case-insensitive prefix match MailVeri*) to your trusted allow-list.
• Verify that automated bot challenge rules or rate-limiting thresholds do not intercept this identifier.

# Allow MailVeri Webhooks through protected endpoints
if ($http_user_agent ~* "^MailVeri") {
    set $bypass_bot_challenge 1;
}

2. Receiver Code Adaptation Examples

Python (FastAPI / Starlette)

from fastapi import FastAPI, Header, HTTPException, Request
 
app = FastAPI()
 
@app.post("/webhooks/mailveri")
async def handle_mailveri_webhook(
    request: Request,
    user_agent: str = Header(None)
):
    # Verify User-Agent header
    if not user_agent or not user_agent.startswith("MailVeri"):
        raise HTTPException(status_code=400, detail="Invalid User-Agent")
 
    payload = await request.json()
    batch_id = payload.get("id")
    status = payload.get("status")
 
    # Process verified batch completion...
    return {"received": True}

Node.js / TypeScript (Express)

import express, { Request, Response } from 'express';
 
const app = express();
app.use(express.json());
 
app.post('/webhooks/mailveri', (req: Request, res: Response) => {
  const userAgent = req.get('User-Agent') || '';
 
  // Case-insensitive verification
  if (!userAgent.toLowerCase().includes('mailveri')) {
    return res.status(400).json({ error: 'Unrecognized User-Agent' });
  }
 
  const { id, status, download_link } = req.body;
  // Handle verified batch...
 
  res.status(200).json({ success: true });
});

Go (net/http)

package main
 
import (
	"encoding/json"
	"net/http"
	"strings"
)
 
func webhookHandler(w http.ResponseWriter, r *http.Request) {
	ua := r.Header.Get("User-Agent")
	if !strings.HasPrefix(ua, "MailVeri") {
		http.Error(w, "Invalid User-Agent", http.StatusBadRequest)
		return
	}
 
	var payload struct {
		ID           string `json:"id"`
		Status       string `json:"status"`
		DownloadLink string `json:"download_link"`
	}
 
	if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}
 
	w.WriteHeader(http.StatusOK)
}

3. Best Practice: Always Verify Cryptographic Signatures

While checking the User-Agent header helps with request routing and early firewall filtering, cryptographic payload integrity must always rely on HMAC signatures.

MailVeri sends an X-Webhook-Signature header with timestamp and HMAC-SHA256 signature (t=<timestamp>,v1=<signature>). If you haven’t enabled Webhook Signing yet, you can toggle it on anytime in your Dashboard → Webhooks.

Testing Your Webhook Delivery

You can test and verify your endpoint with the MailVeri 2.0 User-Agent immediately:

1. Navigate to Dashboard → Webhooks.
2. Scroll to the Recent Deliveries log table.
3. Click the Retry button on any past batch delivery.
4. Inspect your server logs to confirm receipt of the User-Agent: MailVeri 2.0 header.

If you have questions or need assistance adjusting firewall rules, our engineering team is available via your dashboard support channel.