Rules with the Email Flow target run only on mail that passes through mxHERO. This page explains the four ways to route mail through mxHERO, what each one needs, and how to choose. Read it before you change any mail flow settings.
Note: Rules with the User Mailboxes target work on mail that is already in mailboxes, through the Microsoft 365, Google or IMAP APIs. They need no routing changes. See Rule targets.
Key terms
| Term | What it is |
|---|---|
smtp-in.mxhero.com |
Where mail enters mxHERO for inbound processing. Use it for inbound routes, inbound connectors and MX records. Ports 25 and 587. |
smtp-relay.mxhero.com |
Where mail enters mxHERO for outbound processing. Use it for outbound routes and outbound connectors. Ports 25 and 587. |
| Server | A per-domain setting in Settings › Organization and domains. Where mxHERO delivers inbound mail for the domain after processing, usually your Microsoft 365 or Google mail system. Required. |
| Relay Server | An optional per-domain setting. Where mxHERO sends outbound mail from the domain after processing. If it is empty, mxHERO delivers directly to the recipient's mail server. |
| Transport Agent | A random value per mxHERO organization (32 lowercase hexadecimal characters), shown in Settings › Gateway. Your routing rule adds it in the X-mxHero-Transport-Agent header so mxHERO knows which organization the message belongs to. |
X-mxHero-Server |
A header mxHERO adds to each message it returns, with the same Transport Agent value. Your routing rule skips messages that carry it. This prevents loops. |
Note: Older guides call the Transport Agent value the "domain hash". It is not calculated from your domain name. It is one random value per mxHERO organization, and you copy it from Settings › Gateway.
Warning: Older guides also use
smtp.mxhero.com. Do not usesmtp.mxhero.comin new configurations, and never use it as an MX record or inbound host. Usesmtp-in.mxhero.comfor inbound andsmtp-relay.mxhero.comfor outbound.
The four architectures
Inbound Loopback
Your mail system receives the message from the internet as usual (your MX record does not change). A routing rule sends the message to mxHERO. mxHERO processes it and returns it to your mail system, which delivers it to the mailbox.
Inbound Loopback: on the second pass the routing rule sees X-mxHero-Server and does not send the message to mxHERO again.
You configure:
- In your mail system: a route to
smtp-in.mxhero.com, a rule that adds the Transport Agent header, skips messages withX-mxHero-Serverand uses that route, and trust for mail from the mxHERO IP addresses. - In mxHERO: the domain Server = your mail system's inbound host.
Inbound Border
The message reaches mxHERO before your mail system. Either your MX record points to smtp-in.mxhero.com, or a border gateway in front of your mail system (for example Proofpoint or Barracuda) relays mail to smtp-in.mxhero.com. mxHERO processes the message and delivers it to the Server.
Inbound Border: mail does not return to mxHERO after delivery, so no loop exception is needed.
You configure:
- The MX record or the border gateway route to
smtp-in.mxhero.com. - In your mail system: trust for mail from the mxHERO IP addresses. No routing rule.
- In mxHERO: the domain Server.
- On a border gateway: a header
X-mxHero-Transport-Agentwith your Transport Agent value. See Border gateways.
Important: With a direct MX record, nothing adds the Transport Agent header. If Only process email rules with transport agent header (Strict Mode) is on in Settings › Gateway, mxHERO does not run your rules on that mail and does not show it in Email Flow Logs. Turn Strict Mode off for direct-MX routing, or route through a border gateway that adds the header. Strict Mode is on by default for organizations registered since April 21, 2025.
Outbound Standard
Your mail system sends outgoing mail to mxHERO with a routing rule. mxHERO processes it and delivers it directly to the recipient's mail server.
Outbound Standard: mxHERO is the last hop, so receivers check mxHERO's IP addresses against your SPF record.
You configure:
- In your mail system: a route to
smtp-relay.mxhero.comand a rule that adds the Transport Agent header and skips messages withX-mxHero-Server. - In mxHERO: the domain Server, and an empty Relay Server.
- In DNS:
include:_spf.mxhero.comin your SPF record, and DKIM signing for mxHERO. See SPF, DKIM and DMARC.
Outbound Loopback
Your mail system sends outgoing mail to mxHERO. mxHERO processes it and sends it back to your mail system's relay, which delivers it to the recipient.
Outbound Loopback: your mail system stays the last hop; its routing rule skips the returned message because it carries X-mxHero-Server.
You configure:
- In your mail system: the same route and rule as Outbound Standard, plus permission for the mxHERO IP addresses to relay mail.
- In mxHERO: the domain Server, and the Relay Server = your mail system's relay host (
smtp-relay.gmail.comfor Google Workspace; your tenant's<tenant>.mail.protection.outlook.comfor Microsoft 365).
You can also set the Relay Server to your own border gateway, so processed outbound mail leaves through it. See Border gateways.
Which one should I use?
| If you… | Use | Why |
|---|---|---|
| Use Microsoft 365 or Google Workspace and want inbound processing without DNS changes | Inbound Loopback | Your MX record stays. You can limit the rule to a group, and turn it off by disabling one rule. |
| Already have a border gateway in front of your mail system | Inbound Border, with the gateway relaying to smtp-in.mxhero.com
|
The gateway keeps filtering first. No loop exception is needed. |
| Want mxHERO to receive all inbound mail first and have no border gateway | Inbound Border, with MX to smtp-in.mxhero.com
|
No rules in your mail system. Every inbound message passes through mxHERO. Strict Mode must be off. |
| Want processed outbound mail to leave from mxHERO | Outbound Standard | Fewest hops. Needs the mxHERO SPF include and DKIM. |
| Want processed outbound mail to leave from your own mail system | Outbound Loopback | Your mail system stays the last hop. Needs a Relay Server and relay permission for mxHERO. |
| Must send outbound mail through a border gateway | Outbound, with Relay Server = your gateway | The gateway stays the last hop. |
| Only need to file or protect mail that is already in mailboxes | No routing | Use rules with the User Mailboxes target. |
You can combine one inbound and one outbound architecture. Start with a pilot group before you route everyone: see Selective routing.
What each architecture needs
| Requirement | Inbound Loopback | Inbound Border | Outbound Standard | Outbound Loopback |
|---|---|---|---|---|
| Domain Server in mxHERO | Yes | Yes | Yes | Yes |
| Mail system accepts and trusts mxHERO IP addresses | Yes | Yes | – | Yes |
Route to smtp-in.mxhero.com
|
Yes | MX or gateway | – | – |
Route to smtp-relay.mxhero.com
|
– | – | Yes | Yes |
Rule adds X-mxHero-Transport-Agent
|
Yes | Gateway: recommended | Yes | Yes |
Rule skips messages with X-mxHero-Server
|
Yes | – | Yes | Yes |
| Relay Server | – | – | Empty | Your relay host |
SPF include:_spf.mxhero.com
|
Recommended | Recommended | Required | Recommended |
For exact settings, see Office 365 Configuration Service, Office 365 manual configuration and Google Workspace configuration. The mxHERO IP addresses are listed in Network endpoints and IP addresses.
How loop prevention works
- Your routing rule adds
X-mxHero-Transport-Agent: <Transport Agent value>and sends the message to mxHERO. - mxHERO matches the value to your organization, removes the header and runs your rules.
- mxHERO adds
X-mxHero-Server: <Transport Agent value>and returns the message. - Your routing rule sees
X-mxHero-Serverwith your value and does not send the message to mxHERO again.
mxHERO also adds X-mxHero-Server to the notifications, copies and bounces it sends for your organization, so your rules skip those too.
Warning: The exception must test
X-mxHero-Server, notX-mxHero-Transport-Agent. mxHERO removesX-mxHero-Transport-Agent, so an exception on it never matches and mail loops.
Warning: If the value in your rule does not match Settings › Gateway, mxHERO does not recognize the message and does not add
X-mxHero-Server. In a loopback setup the message then loops until mxHERO rejects it with554 Message exceeded 50 hops, this may indicate an email loop.Copy the value with the Copy button; don't retype it.
Important: When you generate a new Transport Agent value, mxHERO accepts both the new and the previous value until you remove the previous one. Update every routing rule (the header action and the exception) to the new value, test, and only then remove the previous value.
Why the Server field matters
The Server tells mxHERO where to deliver inbound mail for your domain. It is required in the dashboard, even if you route only outbound mail. If it is missing or wrong, mxHERO falls back to your domain's public MX record. If that MX points to mxHERO, the message loops until the 50-hop limit and bounces. Set the Server before you route any mail. See Domain Server and Relay settings.
What happens if processing fails
mxHERO fails open. If a rule action fails, mxHERO delivers the original message unchanged and logs an error. The exceptions are rules set to bounce the message on a storage error, and Block Attachments rules, which always drop matching mail. See How mxHERO processes email.
Comments
0 comments
Please sign in to leave a comment.