Variables are placeholders in braces, such as {Subject Normalized}, that mxHERO fills from each email. You use them in storage file paths, file names, custom variables and policies. This page lists every built-in variable by group, with what it returns and an example.
How to read this page
-
Names are exactly as the dashboard shows them. Type
{in a path or name field to pick a variable from the list instead of typing it. The list groups entries as Default variable, User variable and Platform variable. - Not every variable is offered in every rule. The list shows only the variables that apply to the rule's action and target. For example, mailbox variables appear only for User Mailboxes rules.
- Some variables hold several values, such as all To recipients. In a path, each value can produce its own folder. In a condition, each value is tested separately.
-
Examples use this email unless noted: from
Mary Smith <mary@example.com>tobob@partner.exampleandcarol@partner.example, Ccdan@example.com, subjectFwd: Q4 budget 🔥, sent October 19, 2026 at 14:30:05, processed for the managed accountmary@example.com. The organization ownsexample.com.
Default variables
Nine ready-made variables provided by mxHERO. They appear in Auto Filling › Variables › Default Variables, where you can Show or Copy them but not edit them. Each returns the matching value only when an attachment matches, so they are most useful in Filter Policies and Security Policies.
| Display name | What it returns | Example |
|---|---|---|
| Common Office Attachment Extension | The extension of an attachment of a common office type (txt, pdf, epub, odt, rtf, doc, docx, xls, xlsx, ods, csv, tsv, ppt, pptx, pps, odp and similar) | docx |
| Common Compression Attachment Extension | The extension of a compressed-file attachment (zip, 7z, rar, gz, tar, iso, dmg and about 70 others) | zip |
| Common Image Attachment Extension | The extension of an image attachment (jpg, jpeg, png, gif, bmp, tiff, webp, psd and others) | png |
| Common Video Attachment Extension | The extension of a video attachment (mp4, mov, avi, mkv, wmv, webm and others) | mp4 |
| Common Audio Attachment Extension | The extension of an audio attachment (mp3, wav, m4a, aac, flac, ogg and others) | mp3 |
| Common threat vector Extension | The extension of an attachment type often used to spread malware (exe, bat, cmd, js, vbs, ps1, msi, lnk, scr, xlsm and others) | exe |
| Microsoft General Sensitivity Label | The Microsoft Purview sensitivity label of an attachment, when it contains General
|
General |
| Microsoft Personal or Public Sensitivity Label | The sensitivity label, when it contains Personal or Public
|
Public |
| Microsoft Confidential Sensitivity Label | The sensitivity label, when it contains Confidential
|
Confidential |
To see a default variable's exact pattern, click Show. To change it, click Copy and edit the copy. See Custom Variables.
User variables
Variables your organization creates in Auto Filling › Variables. They are listed under User variable with the name you gave them. See Custom Variables.
Platform variables
Managed account and peer
Offered for Email Flow and Forwarding Address rules (Protect Attachments, Secure Emails, Zip Attachments, Copy Emails, Temporary Hold, Request Approval). The managed account is the account in your organization that the rule is processing for. With an individual copy per recipient, the rule runs once for each managed party.
| Display name | What it returns | Example |
|---|---|---|
| Email Address | The managed account's address | mary@example.com |
| Email, local part | The part before @
|
mary |
| Email, domain part | The part after @
|
example.com |
| Peer Address | The other party: the recipient when the managed account sent the email, the sender when it received it | bob@partner.example |
| Peer Address, local part | The part before @
|
bob |
| Peer Address, domain part | The part after @
|
partner.example |
Envelope sender and recipient
Same availability as above. The envelope is the address used for delivery, which can differ from the From and To headers.
| Display name | What it returns | Example |
|---|---|---|
| Sender | The envelope sender | mary@example.com |
| Sender, local part / Sender, domain part | Part of the envelope sender |
mary / example.com
|
| Sender, internal | Whether the sender belongs to your organization | true |
| Recipient | The envelope recipient being processed | bob@partner.example |
| Recipient, local part / Recipient, domain part | Part of the envelope recipient |
bob / partner.example
|
| Recipient, internal | Whether the recipient belongs to your organization | false |
| Email Flow | The direction: inbound, outbound or intra-bound (both parties internal) |
outbound |
Forwarding address
Offered for Copy Emails rules with a Forwarding Address target.
| Display name | What it returns | Example |
|---|---|---|
| Archiving Address | The forwarding address that received the email, without any + suffix |
team_archive@go.mail2cloud.io |
| Original Archiving Address | The forwarding address as it was written, including the part after +
|
team_archive+acme@go.mail2cloud.io |
You can add +<text> to a forwarding address to pass extra information, for example a client code. The rule still runs, and Original Archiving Address lets you use the text in a path through a custom variable.
Mailbox
Offered for User Mailboxes rules (Copy Emails, Move Emails, Protect Attachments on mailboxes).
| Display name | What it returns | Example |
|---|---|---|
| Inbox Address | The mailbox being processed | mary@example.com |
| Inbox, local part / Inbox, domain part | Part of the mailbox address |
mary / example.com
|
| Folder Name | The mailbox folder the email was found in | Projects |
Rule settings
Offered for all actions. These are shown in the list without braces and without a description.
| Display name | What it returns | Example |
|---|---|---|
rule_locale |
The rule's Locale, as a language tag | en-US |
rule_timezone |
The rule's TimeZone, as an IANA time zone name | Europe/Paris |
Storage
Offered for actions that save files (Protect Attachments, Secure Emails, Zip Attachments, Copy Emails, Move Emails, Drag and Drop).
| Display name | What it returns | Example |
|---|---|---|
| Storage User Id | The storage provider's ID of the user the files are saved for | — |
| Storage, as user id | The storage user mxHERO acts as when saving | — |
| Attachment Index | The position of the attachment being saved, starting at 1 | 2 |
| File Type | The type of file being saved | — |
| Egnyte User name | The Egnyte username of the user, as used in Egnyte private folders | msmith |
| Source folder | The ID of the storage folder the email was dropped into (Drag and Drop only) | 123456789 |
Dates
Three date bases, each in nine formats. Sent or Receive Date uses the sent date and falls back to the received date when the email has none. Dates are written in the rule's time zone (Locale & Time zone › TimeZone), or the organization's time zone if the rule has none. Hours are 00–23.
| Format | Received Date | Sent Date | Sent or Receive Date | Example |
|---|---|---|---|---|
| Date and time to seconds | Received Date / yyyyMMdd_hhmmss | Sent Date / yyyyMMdd_hhmmss | Sent or Receive Date / yyyyMMdd_hhmmss | 20261019_143005 |
| Date and time to minutes | Received Date / yyyyMMdd_hhmm | Sent Date / yyyyMMdd_hhmm | Sent or Receive Date / yyyyMMdd_hhmm | 20261019_1430 |
| Date | Received Date / yyyyMMdd | Sent Date / yyyyMMdd | Sent or Receive Date / yyyyMMdd | 20261019 |
| Year | Received Date / yyyy | Sent Date / yyyy | — | 2026 |
| Month | Received Date / Month (MM) | Sent Date / month (MM) | — | 10 |
| Day | Received Date / Day (dd) | Sent Date / Day (dd) | — | 19 |
| Hours | Received Date / Hours (HH) | Sent Date / Hours (HH) | Sent or Receive Date / Hours (HH) | 14 |
| Minutes | Received Date / Minutes (mm) | Sent Date / Minutes (mm) | Sent or Receive Date / Minutes (mm) | 30 |
| Seconds | Received Date / Seconds (ss) | Sent Date / Seconds (ss) | Sent or Receive Date / Seconds (ss) | 05 |
For year, month or day folders, use the Received Date or Sent Date variants.
In conditions, the three full-date formats can be compared as dates, and year, month, day, hours, minutes and seconds as numbers.
Address fields
Each address header has the same set of variables. Use the row for what you need and the column for the header. Recipients covers To, Cc and Bcc together.
| Returns | From | Reply-To | To | Cc | All recipients |
|---|---|---|---|---|---|
| Address | From Address | Reply-To address | To Recipients | Cc Recipients address | Recipients address |
| Display name | From Name | Reply-To name | To Recipients Name | Cc Recipients name | All Recipients name |
| Domain part | From Address, domain part | Reply-To Address, domain part | To Recipients, domain part | Cc Recipients, domain part | Recipients, domain part |
| Local part | From Address, local part | Reply-To Address, local part | To Recipients, local part | Cc Recipients, local part | Recipients, local part |
| Name and address | From Name and Address | Reply To Name and Address | To Recipients Name and Address | Cc Recipients name and address | Recipients name and address |
| Unique addresses | From Unique Address | Reply-To Unique Address | To Recipients Unique Address | Cc Recipients Unique Address | Recipients Unique Address |
| Unique domains | From Unique Domain | Reply-To Unique Domain | To Recipients Unique Domain | Cc Recipients Unique Domain | Recipients Unique Domain |
| Number of addresses | From Address Count | Reply-To Address Count | To Recipients Address Count | Cc Recipients Address Count | Recipients Address Count |
| Number of domains | From Domain Count | Reply-To Domain Count | To Recipients Domain Count | Cc Recipients Domain Count | Recipients Domain Count |
| Number of unique addresses | From Unique Address Count | Reply-To Unique Address Count | To Recipients Unique Address Count | Cc Recipients Unique Address Count | Recipients Unique Address Count |
| Number of unique domains | From Unique Domain Count | Reply-To Unique Domain Count | To Recipients Unique Domain Count | Cc Recipients Unique Domain Count | Recipients Unique Domain Count |
The Reply-To variables use the Reply-To header, or the From address when the email has no Reply-To.
Examples with the sample email:
| Variable | Result |
|---|---|
| To Recipients |
bob@partner.example, carol@partner.example (two values) |
| To Recipients, domain part | partner.example |
| To Recipients Unique Domain Count | 1 |
| Recipients Address Count | 3 |
| From Name and Address | Mary Smith <mary@example.com> |
Internal and external addresses
Each address group above also exists in an Internal and an External version. Internal values are addresses in your organization's domains; external values are all others. The name pattern is {<Internal|External> <group>, <what>}:
- Groups: From, Reply-To, To Recipients, Cc Recipients, Recipients
- What: address, name, domain part, local part, name and address, unique address, unique domain, address count, domain count, unique address count, unique domain count
| Variable | Result with the sample email |
|---|---|
| {Internal Recipients, address} | dan@example.com |
| {External Recipients, address} |
bob@partner.example, carol@partner.example
|
| {External Recipients, unique domain count} | 1 |
| {External From, address} | (empty: the sender is internal) |
Use the count variables in conditions, for example "more than 10 external recipients".
Subject, body and headers
| Display name | What it returns | Example |
|---|---|---|
| Subject | The subject with reply and forward prefixes (such as Re: and Fwd:, in many languages) removed, / replaced by a space, and spaces trimmed |
Q4 budget 🔥 |
| Subject Normalized | Like Subject, also normalized to standard Unicode forms (NFKC), with emoji and similar characters replaced by _. Best choice for folder and file names. |
Q4 budget _ |
| Subject (raw) | The subject exactly as received | Fwd: Q4 budget 🔥 |
| Message Body | The text of the email body | — |
| Headers Line | The email's header lines, for matching with a condition | — |
Attachments
| Display name | What it returns | Example |
|---|---|---|
| Attachment Name | The name of the attachment being processed, with extension | Budget Q4.xlsx |
| Attachment Normalized Name | The attachment name with characters that storage providers reject replaced. Best choice for file names. | Budget Q4.xlsx |
| Attachment Extension | The extension of the attachment | xlsx |
| Attachments File Name | All attachment names; in a condition, resolves to the first name that matches |
Budget Q4.xlsx, notes.pdf
|
| Attachments Content Type | The attachment's content (MIME) type | application/pdf |
| Attachments Count | Number of attachments in the email | 2 |
| Zip Attachments with password Count | Number of password-protected ZIP attachments | 0 |
| Attachments Text | Text read from attachments: text, HTML, RTF, Word, Excel, PowerPoint, PDF with a text layer, and AutoCAD .dwg
|
— |
| Attachments Header and Footer Text | Header and footer text of Word, Excel and PowerPoint attachments | CONFIDENTIAL |
| Microsoft Sensitivity Label | The Microsoft Purview sensitivity label of the attachment | Confidential |
is_tnef |
Whether the email is a TNEF (winmail.dat) message. Shown without braces. |
false |
Text from scanned images and image-only PDFs needs OCR, which adds four more variables when mxHERO enables it. See OCR Text Extraction.
Tips
- For folder and file names, prefer Subject Normalized and Attachment Normalized Name. They avoid characters that providers remove. See File and Folder Naming Rules.
- Email Address and Peer Address change with the direction of the email. Use From Address, Sender or Recipient when you need a fixed role.
- Count, date and true/false variables are most useful in conditions. Address and subject variables are most useful in paths.
Comments
0 comments
Please sign in to leave a comment.