Deployment Checklist – mxHero Help Center

This checklist takes you from registration to your first working rule, in the order that avoids rework. Each step links to the page with the details. Most deployments of standard use cases take a few hours of hands-on work, spread over the time it takes to get the right people and approvals.

Before you begin

Read How mxHERO processes email so you know whether you need gateway routing, mailbox access, or both.
Have your email administrator and your cloud storage administrator available. Some steps need administrator rights in Microsoft 365 or Google Workspace, in your DNS, and in your storage service.

1. Plan

Gather the decisions and details listed in Information to gather: mail platform, routing design, domains, pilot users, storage provider, folder structure and alert recipients.
Ask your network or security team to allow mxHERO's addresses and hostnames. See Network endpoints and IP addresses.
Draft the message to your users. See Planning end user communications.
Review Security and data handling with your security or compliance team, if they need to approve the service.

2. Set up your organization

Register your organization and sign in to the Admin Dashboard. See Registering and signing in.
Add and verify each email domain with a DNS TXT record, then connect it. See Organization and domains.
Set each domain's Server, and its Relay Server if you use one. See Domain Server and Relay settings.
Copy your Transport Agent value and review Only process email rules with transport agent header (Strict Mode) in Settings › Gateway. See Gateway settings.
Add the other dashboard users and set their roles. See Users and roles.
Choose how dashboard users sign in, and turn on two-factor authentication if required. See Security settings and Single sign-on with SAML.
Set who receives alert emails in Settings › Notifications. See Notification settings.

3. Prepare DNS and your mail platform

Add mxHERO to your SPF record. See SPF, DKIM and DMARC.
Set up DKIM signing in the dashboard, if mxHERO will deliver outbound mail directly. See SPF, DKIM and DMARC.
Microsoft 365 or Exchange: turn off TNEF (rich text) for remote domains. See Preventing TNEF encapsulation.

4. Connect your directory and mailboxes

Synchronize accounts and groups from Microsoft 365, Google Workspace or LDAP, or add accounts by hand. See Accounts and directory overview.
Microsoft 365: grant directory and mailbox access. See Office 365 directory and mailbox access.
Google Workspace: grant domain-wide delegation. See Google Workspace directory and mailbox access.
Other mail systems: add IMAP or individual mailbox accounts, if you need mailbox rules. See IMAP and individual mailboxes.

5. Connect cloud storage

Authorize mxHERO in your storage service for the whole organization. See Storage overview, then the page for your provider:
If you will use mxHERO Shares, set it up and choose its region. See Shares settings.

6. Build and test with a pilot group

Create your first rule, scoped to a test account or pilot group. See Create a rule and Senders and recipients.
Set the folder structure for saved files. See Storage file paths.
Route the pilot group's mail through mxHERO. Use the selective (group-based) routing option. See Selective routing and the guide for your platform:
- Office 365 Configuration Service (automated) or Office 365 manual configuration
- Google Workspace configuration
- Border gateways such as Proofpoint or Barracuda
Send test messages in each direction you route, and confirm the results. See Testing mail flow.
Check processing in Email Flow Logs.

7. Roll out

Send your announcement to users. See Planning end user communications.
Widen the routing scope and the rule targets to the full set of users.
If users will handle held or approval messages, or manage shared files, point them to The End User App.
Subscribe your administrators to service updates at https://status.mxhero.com.

Verify

Your deployment is working when:

Test messages in each routed direction appear in Reports › Email Flow Logs with your rule listed under the message's actions and a delivered status.
Files appear in the expected storage folders, with the expected names.
Recipients can open the links and passwords they receive.
No messages arrive twice, and nothing lands in spam because of the routing change.

Troubleshooting

Symptom	Cause	Fix
Test messages are delivered but don't appear in Email Flow Logs	Mail is not reaching mxHERO, or Strict Mode is on and the message lacks your Transport Agent header	Check your routing rule and its header value. See Mail not processed.
Messages loop or bounce with "too many hops"	The routing rule doesn't skip messages that carry `X-mxHero-Server`, or a domain's Server is missing or wrong	See Mail loops and bounces.
Messages land in spam or fail authentication	SPF not updated, mxHERO IPs not allowed, or ARC not trusted	See Spam and authentication issues.
Original attachments are delivered instead of links	The storage upload failed, so mxHERO delivered the original	Check Reports › Notifications and Storage upload failures.