Selective Routing

Selective routing sends only some users' mail through mxHERO, for example a pilot group or one department. You limit the routing rule in your mail system to a group; everyone else's mail bypasses mxHERO. Use it for a pilot before you route the whole organization, or when only some users need mxHERO.

Selective routing works with Inbound Loopback, Outbound Standard and Outbound Loopback, where a rule in your mail system decides what goes to mxHERO. With Inbound Border every inbound message reaches mxHERO, so limit processing with the rule targets in mxHERO instead.

Before you begin

• Set up routing for your platform first, with the routing rules turned off: Office 365 Configuration Service, Office 365 manual configuration or Google Workspace configuration.
• Decide who is in the group. You can use one group for both directions, or separate inbound and outbound groups.

Note: The group in your mail system decides which mail reaches mxHERO. Your mxHERO rules then decide what happens to it. A user outside the group is not processed even if an mxHERO rule names them. A user inside the group is processed only if an mxHERO rule matches.

Microsoft 365

Create the group

1. In the Microsoft 365 admin center, go to Teams & groups › Active teams & groups.
2. Add a group, for example a mail-enabled security group or distribution list named mxHERO users.
3. Add the users to route through mxHERO.

Limit the mail flow rules to the group

The rules mxHERO - Route Inbound and mxHERO - Route Outbound route the whole tenant by default. Add a group condition to each.

Admin center:

1. Exchange admin center › Mail flow › Rules › open mxHERO - Route Inbound › Edit rule conditions.
2. Replace the condition The recipient is located Inside the organization with The recipient › is a member of this group › mxHERO users.
3. Save.
4. Open mxHERO - Route Outbound. Replace The sender is located Inside the organization with The sender › is a member of this group › mxHERO users.
5. Save.

Keep the actions and the X-mxHero-Server exception unchanged.

PowerShell:

$group = "mxhero-users@example.com"
Set-TransportRule -Identity "mxHERO - Route Inbound"  -SentToScope $null -SentToMemberOf $group
Set-TransportRule -Identity "mxHERO - Route Outbound" -FromScope   $null -FromMemberOf   $group

Then turn the rules on. See Office 365 Configuration Service (section "Turn on the mail flow rules").

Important: Running Configure again in the Office 365 Configuration Service does not overwrite your edited rules, because it skips objects that already exist.

Google Workspace

Create the group

1. In the Admin console, go to Directory › Groups and click Create group.
2. Group name: mxHERO users. Group email: mxhero@example.com.
3. Set the access settings for your organization (for example Team), and click Create group.
4. Open the group and add the users to route through mxHERO.

Limit the content compliance rules to the group

1. Go to Apps › Google Workspace › Gmail › Compliance › Content compliance.
2. Edit mxHERO inbound routing. Click Show options. Under Envelope filter, select Only affect specific envelope recipients, choose Group membership (only received mail), and select mxHERO users. Click Save.
3. Edit mxHERO outbound routing. Under Envelope filter, select Only affect specific envelope senders, choose Group membership (only sent mail), and select mxHERO users. Click Save.

Important: The Gmail Outbound gateway setting cannot be limited to a group. Use the outbound content compliance rule.

Verify

1. Send a message from an outside account to a user in the group. Its headers contain X-mxHero-Server and it appears in Reports › Email Flow Logs.
2. Send a message to a user not in the group. It has no X-mxHero-Server header and does not appear in Email Flow Logs.
3. Repeat in the outbound direction.

Expand to everyone

When the pilot is finished, remove the group condition:

• Microsoft 365: restore the scope conditions:

  Set-TransportRule -Identity "mxHERO - Route Inbound"  -SentToMemberOf $null -SentToScope InOrganization
  Set-TransportRule -Identity "mxHERO - Route Outbound" -FromMemberOf   $null -FromScope   InOrganization

• Google Workspace: clear the envelope filter in both content compliance rules.

Or keep the group and add users to it.

Troubleshooting

Related pages

• Routing architectures
• Testing mail flow
• Senders and recipients
• Groups