Information to Gather – mxHero Help Center

Collect the decisions and details on this page before you start setting up mxHERO. Having them ready avoids changing routing or rules after users are already affected. Use it as a worksheet with your email and storage administrators.

People and access

You need	Why	Notes
Email administrator	Changes mail routing, connectors and DNS	Global or Exchange administrator in Microsoft 365, or super administrator in Google Workspace
Cloud storage administrator	Authorizes mxHERO for the whole organization	Box admin, Microsoft 365 Global Administrator (for OneDrive or SharePoint admin consent), Google Workspace super administrator, or Dropbox team admin
DNS access	Domain verification, SPF and DKIM records	For every domain you will use
Admin Dashboard users	Who will manage rules and settings	Decide who gets the Owner role and who gets Administrator

Mail platform and routing

Mail platform. Microsoft 365 (Exchange Online), Google Workspace, or another system that can route mail through an SMTP gateway.
What you need to process.
- Email in transit (gateway routing) for actions such as Protect Attachments, Temporary Hold and Request Approval.
- Email at rest (mailbox access) for copying, moving or thinning existing mail.
- Both.
See How mxHERO processes email.
Directions. Inbound (external senders to your users), outbound (your users to external recipients), internal (between your users), or a combination.
Routing design. For each direction, choose:
- Loopback: your tenant routes mail to mxHERO with a routing rule, and mxHERO returns it. Most Microsoft 365 and Google Workspace customers use this.
- Border: your MX record or border gateway (for example Proofpoint or Barracuda) sends inbound mail to mxHERO first.
- Outbound standard or loopback: mxHERO delivers outbound mail directly, or relays it back through your tenant or another gateway.
See Routing architectures.
Existing gateways and relays. List any security gateway, archive or relay already in your mail path. They affect the Relay Server setting and where mxHERO fits in the chain.
Scope. All users, or a pilot group first. Microsoft 365 and Google Workspace can route a single group through mxHERO. See Selective routing.

Domains

For each email domain:

Item	Example	Where it's used
Domain name	`example.com`	Verified with a DNS TXT record
Aliases (other domains that should be treated the same)	`example.net`	Connected as an alias of the main domain
Server: the host that receives mail for this domain after mxHERO	Microsoft 365: your tenant's MX host, such as `example-com.mail.protection.outlook.com`. Google Workspace: `smtp.google.com`. Other: your mail server's hostname	Required for every domain
Relay Server: where mxHERO sends outbound mail, if not straight to the recipient	Google Workspace outbound loopback: `smtp-relay.gmail.com`. Microsoft 365 outbound loopback: your tenant's MX host. Or your border gateway's hostname	Optional
Current SPF record	`v=spf1 include:spf.protection.outlook.com ~all`	You will add mxHERO to it
DMARC policy	`p=quarantine`	Affects how carefully you set up SPF, DKIM and ARC

See Domain Server and Relay settings.

Users, groups and directory

Directory source. Microsoft 365, Google Workspace or LDAP, or accounts added by hand or by CSV file.
Groups to use in rules. For example, a pilot group, a legal team, or everyone who sends invoices.
Accounts to leave out. Service accounts, shared mailboxes or executives, if they should be excluded.
Approvers. For Request Approval rules, the supervisors or approval groups for each team.

See Accounts and directory overview.

Cloud storage

Decision	Options	Notes
Storage provider	Box, OneDrive and SharePoint, Google Drive, Egnyte, Egnyte Gov, Dropbox (Teams), mxHERO Shares	You can use more than one.
Connection type	Organization-wide (synced), or individual accounts	Organization-wide is recommended where available. Egnyte connects through individual accounts only. See Storage overview.
Where files go	Each user's own storage, one shared account, a SharePoint site or shared drive, or a pool of accounts	A pool spreads uploads across accounts to avoid provider rate limits. See Storage load balancing.
Link security	Public, expiring, password-protected, organization-only, or recipient-only links	Depends on the provider. See Link security options by provider.
mxHERO Shares subdomain and region	For example `acme`, region US or Japan	Both are fixed once set up. Choose carefully. See mxHERO Shares overview.

Folder structure and naming

Sketch the folders you want before you build rules. A common pattern is a top folder per purpose, then one folder per correspondent, then one per subject:

Emails/
  client@example.org/
    2026-10 Contract renewal/
      20261019_0930-Contract renewal.pdf
      Contract.docx

Decide:

What to save: the full message (EML or MSG), a PDF of the body, attachments, or a combination.
Which details to use in folder and file names: sender, recipient, date, subject, or values looked up from a client list.
Whether you need lookup tables, for example client codes mapped to client names. Prepare them as CSV files for Datasets.

See Storage file paths and File and folder naming rules.

Rules to start with

For each rule you plan, write down:

The action, for example Protect Attachments.
Who it applies to (sender and recipient).
Exceptions, such as recipients who must receive real attachments (billing systems, some partners).
Whether users may skip it for a single message with #nomxhero.

See How rules work and Opting out with #nomxhero.

Notifications and support contacts

Alert recipients. Addresses that receive mxHERO alerts (storage errors, failed rules, directory sync problems). A shared IT mailbox works well.
Alert frequency. Hourly, daily or weekly digests.
Monthly usage report. Who should receive it, if anyone.
Status page subscribers. Who should get service updates from https://status.mxhero.com.

See Notification settings.