Opting Out with #nomxhero – mxHero Help Center

You can let your users send a single message without attachment protection by adding #nomxhero to the subject line. This is useful when a recipient needs real attachments, for example a billing system that reads invoices from email, or a partner who can't open cloud links. This page explains how to allow it, what it skips, and what it doesn't.

What #nomxhero does

When a sender puts #nomxhero in the subject of a message:

Protect Attachments, Secure Emails and Zip Attachments rules that allow the opt-out don't run for that message. The recipient gets the original attachments.
Once one of these rules is skipped, all later Protect Attachments, Secure Emails and Zip Attachments rules are skipped for that message too.
mxHERO removes #nomxhero from the subject before delivery, so recipients don't see it.

#nofusion works the same way, for compatibility with older setups.

The built-in hashtag is fixed: #nomxhero (or #nofusion). You can't change it or add a translated version. To use your own keyword in any language, see "Use your own keyword" below.

It does not affect:

Rule	Effect of #nomxhero
Copy Emails	Still runs. The message is still copied to storage.
Block Attachments	Still runs. The message is still blocked.
Temporary Hold, Request Approval	Still run. The message is still held.
S/MIME Emails	Still runs.
User Mailboxes rules	Not affected. The opt-out applies only to Email Flow.

Before you begin

The sender must be a managed account, an account of your organization in Settings › Accounts and Groups. A hashtag from anyone else is ignored. See Accounts and Directory.
Decide which rules may be skipped. Allow the opt-out only where sending real attachments is acceptable.

Allow the opt-out in a rule

The opt-out is off until you turn it on, rule by rule.

Open Rules › Rules List and click Edit on a Protect Attachments or Secure Emails rule, or create a new rule.
Click Add Filters under the Target step. The Target Filters panel opens.
Turn on Cancel on short code. Its description reads "Do not execute this rule when a short code #NOMXHERO is used in the subject. Only managed accounts can use this option."
Click Save Rule.

The change applies within about 1 to 2 minutes.

Cancel on short code can't be combined with Trigger on short code in the same rule: a rule that runs only when users add a hashtag doesn't need an opt-out. See Filters and Exclusions.

How senders use it

Write the message as usual and attach the files.
Add #nomxhero anywhere in the subject, separated from other words by spaces. For example: Invoice 1043 #nomxhero.
Send.

Upper or lower case doesn't matter: #NOMXHERO and #nomxhero both work. The hashtag must stand alone: Invoice#nomxhero doesn't work.

Tell users when they may use it and when they must not. See Planning End User Communications.

Warning: With the opt-out allowed, any managed sender can send original attachments to any recipient by adding the hashtag. Don't allow it on rules that enforce a compliance or data-loss policy. For recipients that always need real attachments, use an exclusion in the rule instead. That way, the decision stays with the administrator.

Use your own keyword

If you want users to opt out with a word of your choice, for example in another language, use a filter policy instead of the hashtag:

In Auto Filling › Variables, create a variable that checks whether the Subject contains your word. See Custom Variables.
In Auto Filling › Filter Policies, create a policy with that variable set to No match. See Filter Policies.
In the rule, turn on Use filter policy under Target Filters and choose the policy.

The rule then doesn't run when the subject contains your word. Unlike #nomxhero, mxHERO doesn't remove your keyword from the subject, and any sender can use it, not only managed accounts. Test it with one message before you rely on it.

Alternatives

Need	Better option
A specific recipient or system always needs real attachments	Add the recipient to Sender/Recipient (From/To) Exclusions in the rule
Protect attachments only when the sender asks for it	Turn on Trigger on short code instead (`#mxhero` for Protect Attachments, `#secure` for Secure Emails)
Skip the rule for certain kinds of messages	Use a filter policy in Target Filters

See Filters and Exclusions.

Verify

From a managed account, send a test message with an attachment and #nomxhero in the subject to a recipient the rule covers.
Check that the recipient got the original attachment and that the subject no longer contains #nomxhero.
In Reports › Email Flow Logs, open the message. The rule shows as not applied with the reason rule_shortcode_avoid_processing. See Email Flow Logs.

Troubleshooting

Symptom	Cause	Fix
Attachments are still replaced with links	Cancel on short code is off in that rule	Turn it on in each rule that may be skipped.
Hashtag is ignored, reason `rule_shortcode_sender_not_managed_by_rule`	The sender isn't a managed account	Import the sender into Settings › Accounts and Groups.
Hashtag is ignored with no reason shown	The hashtag isn't separated by spaces, or the message was handled by a rule type that ignores it, such as Copy Emails or Block Attachments	Put spaces around the hashtag. Check which rule handled the message in Email Flow Logs.
Message was still copied to storage	Copy Emails rules ignore #nomxhero	Expected. Use an exclusion in the Copy Emails rule if needed.
Recipient sees `#nomxhero` in the subject	The message didn't pass through mxHERO, for example it wasn't routed	Check routing. See Testing Mail Flow.