Protect Attachments

A Protect Attachments rule moves attachments out of email and into cloud storage, and puts secure links in their place. Use it to keep files out of mailboxes, control who can open them, set links to expire, and file every attachment automatically. This page covers each option in the Protect Attachments wizard and what senders and recipients see.

Formerly called Fusion. The general wizard layout is in Create a Rule; this page covers what is specific to Protect Attachments.

What it does

• On Email Flow (mail in transit): mxHERO uploads the matching attachments to storage, removes them from the message, adds links, and delivers the message. The message body is kept.
• On User Mailboxes (mail already stored): mxHERO saves the attachments, creates a new copy of each message with links instead of attachments, and then removes the original message. See "Protect attachments in mailboxes" below.

Typical uses:

• Send large files without hitting mailbox or gateway size limits.
• Make links to outside recipients expire, require a password, or open only for people in your organization.
• Reduce mailbox storage by replacing attachments in existing mail with links.
• File every attachment in a consistent folder structure, for example by client and date.

Supported targets

See Rule Targets for how each target works.

Before you begin

• You need an Owner or Administrator role in the Admin Dashboard.
• Connect the storage you want to use in Settings › Integrations. An organization-level account is best. See Storage Overview.
• Email Flow: route mail through mxHERO and test it first. See Testing Mail Flow.
• User Mailboxes on Microsoft 365: mxHERO needs the Microsoft Graph permissions MailboxFolder.Read.All, MailboxItem.Read.All and MailboxItem.ImportExport.All (organization access), or MailboxFolder.Read, MailboxItem.Read and MailboxItem.ImportExport (an individual mailbox account). If they are missing, the dashboard asks you to grant consent again or re-authenticate when you save the rule. See Office 365 Directory and Mailbox Access.
• Decide who should be able to open the links. This decides the security option in step 3. See Link Security Options by Provider.

Step 1: Action

1. Open Rules › Create a Rule, select Protect Attachments, and click Start Rule Creation.

2. Under Select what to save:, keep Attachments selected. It is required. Optionally also select:

   • Email: also save a copy of the whole message. Choose .EML (default, opens in most mail programs) or .MSG (Outlook format) under File type for saved email:.
   • Email's Body in PDF: also save the message body as a PDF.

   

3. Optionally open Advanced Options (see the next section).

4. Click Confirm.

Advanced Options

The password email is sent only when the links are password protected. See "Notifications this action sends" below.

Action filters (optional)

Click Add Filters under the Action step to choose which attachments are protected, for example only files above 5 MB, or no images. The Action Filters panel is described in Filters and Exclusions.

Two points matter most for Protect Attachments:

• A message with no attachment that passes the filters is delivered unchanged, and the rule doesn't run for it.
• Images embedded in the body, such as signature logos, are not protected unless you change Exclude inline images.

Step 2: Target

Under Rule Scope:, choose Email Flow or User Mailboxes. You can't change the scope after the rule is saved.

Email Flow

1. Choose how links are created for messages with several recipients:
   • Send an individual copy of the content and attachment links to each recipient (default): each recipient gets their own upload and links. Use this for recipient-only links and per-recipient folders.
   • Send the same copy of the content and attachment links to all recipients: one upload and one set of links for everyone. With this option, Between is not available, and recipient-only security options are hidden.
2. Set Target all emails sent: with Between or From, a Sender and a Recipient. The defaults are Organization and Anyone. To protect only mail exchanged with outside parties, use Between Organization and Anyone else. See Senders and Recipients.
3. Optionally open Advanced Options to also match the From, To and CC headers, or only the From header. See Rule Targets.
4. Click Confirm.

Target Filters for Email Flow (click Add Filters under the Target step):

mxHERO removes the short code from the subject before delivery. See Filters and Exclusions and Opting Out with #nomxhero.

User Mailboxes

1. In Target all emails from this provider:, choose Office 365™ for organizations, Google™ Apps, or an individual mailbox account. IMAP is not supported for this action.
2. Choose the accounts and a Select Time Range: option. See Rule Targets.
3. Open Advanced Options and set the options described in "Protect attachments in mailboxes" below.
4. Click Confirm.

Step 3: Cloud Storage

1. In Cloud Storage Account:, choose the storage. Organization accounts, such as Box for Organizations, are listed first. mxHERO Shares is also offered if your organization has set it up. See mxHERO Shares Overview.

2. For an organization account, choose Select which storage accounts are used: (automatic per user, a specific account, or a balanced list). See Create a Rule.

3. Choose Select a security option:. This is the most important choice in the rule:

   

   Option	Use it when
   Preset: Public access links	Anyone with the link may open the files
   Preset: 7 days expiration public access links	Same, but links stop working after 7 days
   Preset: Recipients access links / Preset: 7 days expiration recipients access links	Only the email's recipients may open the files, after signing in to the storage provider
   Preset: Organization access links	Only people in your organization may open the files (internal mail)
   Preset: Password protected access links	Anyone with the link and the password, which mxHERO sends in a separate email (Box, Dropbox and mxHERO Shares)
   Accessible to the folder collaborators (no shared link)	No link is created. Only people who already collaborate on the folder can open the files. Not suitable for outside recipients.
   A Security policy or Security definition	Your own settings, or settings chosen by conditions. See Security Definitions and Policies.

   The list shows only options the selected provider supports. For User Mailboxes, only Accessible to the folder collaborators (no shared link), Preset: Public access links, Preset: Organization access links and security definitions can be used; security policies can't.

   Important: Check the selected security option before you confirm. Don't rely on the preselected value.

4. Optionally open Advanced Options:

   • Select a template option: apply a Box or Egnyte metadata template. See Template Definitions and Policies.
   • Tracking option: Do not track emails (default), Track email opens, Track only attachment access, or Track email opens and attachment access. The sender is emailed when a tracked event happens. See Link Tracking.
   • Link to folder: Never (default), Always, or From a certain number of attachments. When it applies, the email has one link to the folder instead of one link per file. Email Flow only.

   

5. Click Confirm.

Step 4: Storage Filepath

1. Keep Root or choose Pick from storage under Filepath where to copy your files:.

2. Edit the Subfolder path. Type { to insert variables. The default depends on the target:

   Target	Default subfolder
   Email Flow, individual copy	Protect Attachments/{Email Address}/{Peer Address}/{Subject Normalized}/{Sent or Receive Date / yyyyMMdd}
   Email Flow, same copy for all recipients	Protect Attachments/{Sender}/{Subject Normalized}/{Sent or Receive Date / yyyyMMdd}
   User Mailboxes	Protect Attachments/{Folder Name}/{From Address}/{Subject Normalized}/{Sent or Receive Date / yyyyMMdd}

3. Or turn on Use a copy policy instead to choose the folder by conditions. See Copy Policies.

4. Optionally open Advanced Options:

   • Attachment Name Formatting (default {Attachment Name}), plus a name format for each other content type you save.
   • Use a subfolder to save attachments (and the matching option for emails or PDFs).
   • Do not overwrite existing files: keep an existing file with the same name and save the new one with a version suffix.

5. Click Confirm.

Path syntax and examples are in Storage File Paths.

More actions (optional)

Click Add Action to open More actions....

Then name and save the rule. See Create a Rule.

Protect attachments in mailboxes

When the target is User Mailboxes, the rule changes the messages in the mailbox. For each message with qualifying attachments, mxHERO:

1. Saves the selected content to storage.
2. Creates a new copy of the message with links instead of the attachments. Follow-up flags and categories are kept.
3. Removes the original message.

Warning: By default the original message is permanently deleted, not moved to the trash. To keep the originals in the Trash or Deleted Items folder, choose Move original email to Trash folder in the Action step's Advanced Options before you save. You can't change this choice after the rule is saved. Test the rule on one mailbox first.

Mailbox options:

Mailbox behavior to know:

• Microsoft 365: the original is moved to Deleted Items and then deleted from there. If the second step fails, the original stays in Deleted Items.
• Calendar invitations and sharing invitations are saved but never replaced, so they keep their attachments.
• Drafts, junk/spam and trash folders are always skipped.
• By default, mail is processed in batches of 25 messages per mailbox, and up to 6 mailboxes at a time per rule.
• After saving, you can't change the provider, accounts, time range, target filters or the trash/delete choice. Copy the rule to make changes. See Rules List.

What recipients and senders see

Recipients get the message without the protected attachments, and:

• Links at the top of the message, an attachments.pdf file with the links, or both. Each link opens the file in the browser or on the storage provider's site. With Link to folder, one link opens a folder with all the files.
• A separate password email, if the links are password protected.
• The expiration date and access notes in the link text, for example that only the recipient can open the link.

What recipients do is described in Opening Protected Attachments and Password-Protected Emails. Share those pages with your users.

Senders usually see nothing different: the copy in their Sent Items is saved by their mail system before mxHERO processes the message, so it keeps the attachments (unless a User Mailboxes rule later processes it). They may receive tracking notifications (if tracking is on) and a [BOUNCED] notice (if storage fails and the rule bounces).

Note: If a recipient receives a file named unverified-attachments.pdf, someone sent a file named attachments.pdf that mxHERO didn't create. mxHERO renames it so it can't be mistaken for a real link list.

Notifications this action sends

The password email comes from the original sender's address when the sender's domain is managed by mxHERO, and from noreply@mxhero.com otherwise. Passwords are generated using the rules in Settings › Integrations › Storage settings › Storage Link Password Settings.

Rule errors also appear in Reports › Notifications. See Notification Error Codes.

Limits

• Messages in winmail.dat (TNEF) format are not processed and are delivered as they are. See Preventing TNEF Encapsulation.
• Protect Attachments runs after the other Email Flow actions. If a Secure Emails rule, or a Zip Attachments rule that uses storage, already processed the message, Protect Attachments rules are skipped for it. See How Rules Work.
• Rule changes reach mail in transit within about 1 to 2 minutes.
• Each message is uploaded with a time budget of 45 minutes, including retries.
• Box, Dropbox and Egnyte upload each file in a single request, so the provider's single-upload size limit applies.
• File and folder names are cleaned and shortened to 200 characters. See File and Folder Naming Rules.

If something fails

mxHERO fails open: if the attachments can't be stored, the recipient gets the original message.

Warning: Use Bounce email to sender only if your policy requires that unprotected attachments never leave. It stops mail when storage is unavailable.

Verify

1. Send a test message with an attachment that matches the rule.
2. Check that the recipient got links (or attachments.pdf) instead of the attachment, and that the link opens as expected for an outside user.
3. Check the file in the storage folder.
4. In Reports › Email Flow Logs, open the message and look for the rule's executed event and a storage event. See Email Flow Logs.
5. For User Mailboxes, expand the rule on the Rules List and open the account details to see processed and protected counts.

Troubleshooting

More storage errors are in Storage Upload Failures.

Related pages

• Create a Rule
• Rule Targets
• Senders and Recipients
• Filters and Exclusions
• Storage File Paths
• Link Security Options by Provider
• Secure Emails
• Zip Attachments
• Notification Templates