Filters and Exclusions – mxHero Help Center

Filters narrow down which messages and attachments a rule acts on, beyond its senders and recipients. This page covers the two filter panels in the rule wizard (Action Filters and Target Filters), filter policies, exclusions, and the order in which mxHERO checks them.

Before you begin

To use a filter policy, create it first in Auto Filling › Filter Policies. See Filter Policies.
Know which senders, recipients and folders the rule must skip.

The two filter panels

Panel	Added with	Decides	Title in the wizard
Action filters	Add Filters under the Action step	Which attachments the action handles	Action Filters, or Attachments Filter for Copy Emails on non-Email Flow targets, Move Emails, Drag and Drop, Temporary Hold and Request Approval
Target filters	Add Filters under the Target step	Whether the rule runs for a message at all	Target Filters

For Temporary Hold and Request Approval, the attachments panel is added with Add attachment filter, below the last step. Block Attachments and S/MIME Emails have no storage steps. S/MIME Emails has no action filters.

Order of evaluation

For Email Flow rules, mxHERO checks a rule's conditions in this order, for each recipient copy. The first check that fails skips the rule for that recipient:

Target filter policy (Use filter policy in Target Filters).
Short codes in the subject (Trigger on short code, Cancel on short code).
Senders and recipients, including Process only managed accounts.
Action filters: attachment size, extension, name and type, and the action filter policy.
Exclusions (Sender/Recipient (From/To) Exclusions).
The action runs.

When a rule is skipped, Reports › Email Flow Logs shows the reason, for example trigger_policy_no_match or flow_filter_from_to. See Mail Not Processed.

Action filters (attachments)

Action Filters panel with attachment size, extension, name and type options

Toggle	What it does
Include attachments by size (minimum)	Only attachments above a size, in Bytes, Kilobytes or Megabytes
Include attachments by extension / Exclude attachments by extension	Only, or never, attachments with these extensions, for example `pdf`, `docx`. Not case-sensitive.
Include attachments by name matching / Exclude attachments by name matching	Only, or never, attachments whose name matches
Include attachments by type / Exclude attachments by type	Only, or never, attachments of a type: Image, Audio, Text, Video, Application
Exclude inline images	Images embedded in the message body, such as signature logos, are not treated as attachments
Only process protected ZIP files	Only password-protected `.zip` attachments. Turns off the other attachment filters.
Include RFC822 Emails	Emails attached to the message count as attachments
Exclude mail system administrative messages	Delivery reports and other `multipart/report` messages are skipped
Use filter policy	Only attachments that meet a filter policy's conditions. The policy is checked for each attachment.
Include TNEF messages	Block Attachments, Temporary Hold and Request Approval only. A `winmail.dat` message is matched as a whole; the attachments inside it aren't inspected.

In chip fields, type a value and press Enter to add it. Values that aren't formatted correctly aren't added.

Important: When the panel opens, the toggles look off, but some protections apply even without them. If a Protect Attachments, Secure Emails, Zip Attachments or Block Attachments rule has no action filter at all, mxHERO excludes inline images and includes attached emails. A message with no qualifying attachment doesn't trigger the rule (reason mail_content_without_attachments).

For Temporary Hold and Request Approval, the attachments filter decides whether the whole message is held: the rule runs only if at least one attachment matches.

Attachments Filter for Temporary Hold with its info box

Target filters for Email Flow

Target Filters panel with filter policy, short code, managed accounts and exclusion options

Toggle	What it does	Actions
Use filter policy	The rule runs only when the filter policy matches the message	All
Trigger on short code	The rule runs only when the sender puts a hashtag in the subject: `#mxhero` or `#fusion` for Protect Attachments; `#secure`, `#ferpa`, `#hipaa`, `#compliant` or `#sec` for Secure Emails. Only managed senders can use it.	Protect Attachments, Secure Emails
Cancel on short code	The sender can skip the rule by putting `#nomxhero` in the subject. Only managed senders can use it. Not available while Trigger on short code is on. See Opting Out with #nomxhero.	Protect Attachments, Secure Emails
Process only managed accounts	The rule runs only when the sender or the recipient is an account in Settings › Accounts and Groups	Copy Emails, Secure Emails, Protect Attachments, Block Attachments, Temporary Hold
Sender/Recipient (From/To) Exclusions	Skip messages between specific senders and recipients	All

mxHERO removes hashtags from the subject before delivery. Hashtags are not case-sensitive and must be separated from other words by spaces.

Exclusions

Turn on Sender/Recipient (From/To) Exclusions.
In Exclude emails from [From] to [To], enter a sender, a recipient, or both. Leave a side empty to mean anyone.
Click Add another exclusion for more pairs.

The rule is skipped for a recipient copy if any exclusion pair matches it.

Examples:

Goal	From	To
Real attachments for a billing system		`invoices@vendor.example`
Never process mail from the CEO	`ceo@acme.example`
Skip internal mail between two departments	`legal@acme.example`	`hr@acme.example`

If Include From, To and CC when evaluating which emails will be processed. is on in the Target step, exclusions are checked against the header addresses too. For Temporary Hold and Request Approval you can also set Exclusion matching: Skip the rule if any recipient matches the exclusion list (default) or Skip the rule only if all recipients match the exclusion list.

Target filters for User Mailboxes

Include and Exclude by folder path rows for a User Mailboxes rule

Toggle	What it does
Use filter policy	Only messages that meet a filter policy's conditions
Sender/Recipient (From/To) Inclusions	Only messages from or to these addresses or domains. Click Add another filter for more.
Sender/Recipient (From/To) Exclusions	Never messages from or to these addresses or domains
Include by folder path	Only these folders. For each, choose Folder and subfolders, Only this folder or Subfolders only. Create folder creates the folder in every mailbox if it doesn't exist (only when you create the rule).
Exclude by folder path	Never these folders, with the same three options

Rules for mailbox filters:

Inclusions and exclusions accept email addresses and domains only, not groups, tags, Organization or Anyone else. Leave a side empty to mean anyone.
A message is processed if it matches any inclusion and no exclusion. Exclusions always win.
With no folder inclusions, all folders are processed. Drafts, junk/spam, trash and deleted items are always skipped.
You can't change mailbox target filters after the rule is saved.

Note: "Create folder" is a simple way to give users a drop folder. For example, include the folder File to Box with Create folder on: every user gets the folder, and only mail they move into it is filed.

Target filters for Forwarding Address

Use filter policy: only messages that meet a filter policy's conditions.
Organization Only: only accept mail from senders in your organization. Messages from other senders are not saved.

Filter policies

A filter policy is a reusable set of conditions built from variables, for example "subject contains an invoice number" or "attachment is a Microsoft sensitivity label Confidential". Its conditions are combined with OR: the policy matches when any one condition is met.

Where you use it	What it decides
Target Filters › Use filter policy	Whether the rule runs for the message
Action Filters › Use filter policy	Which attachments are processed, checked one attachment at a time. For Block Attachments, Temporary Hold and Request Approval, whether the rule runs.

A filter policy can also use an AI Question variable. See AI Question Conditions and Filter Policies.

Verify

Send one message that should be processed and one that should be skipped by each filter.
In Reports › Email Flow Logs, open the skipped message. The rule shows as not applied with the reason, for example flow_filter_from_to for an exclusion or mail_content_failed_to_check_filter for an attachment filter.
For mailbox rules, check the rule's account details on the Rules List.

Troubleshooting

Symptom	Cause	Fix
Signature logos are saved as attachments	Inline images aren't excluded	Turn on Exclude inline images.
Rule never runs on messages without attachments	Storage actions need a qualifying attachment unless you save the email itself	Expected. To save every message, use Copy Emails with Email selected.
Rule skips everything after adding a filter policy	The policy's conditions never match	Test the policy's variables with a sample email in Auto Filling › Variables › Test variable.
Cancel on short code is greyed out	Trigger on short code is on	Turn off Trigger on short code.
An exclusion doesn't work for BCC or list recipients	Exclusions are checked against the envelope, or against headers when the header option is on	Check the envelope recipient in Email Flow Logs and adjust the exclusion.
`winmail.dat` messages aren't blocked	TNEF messages are skipped by default	Turn on Include TNEF messages, or prevent TNEF. See Preventing TNEF Encapsulation.