How Rules Work

A rule tells mxHERO what to do with email: which messages to act on, what to do with them, and where to store the result. This page explains what a rule is made of, where rules run, how mxHERO decides whether a rule applies, and what happens when several rules match or when something fails. Read it before you build your first rule.

What a rule is made of

Every rule has one action and one target. Most rules also have conditions and a storage destination.

See Create a Rule for the wizard.

Actions and the targets they support

Each action works only with certain targets.

Each action has its own page in Rule Actions, for example Protect Attachments. Targets are described in Rule Targets.

Where rules run

• Email Flow rules run in the mxHERO gateway while a message is on its way, before it is delivered. Your mail system must route mail through mxHERO. See How mxHERO processes email.
• Forwarding Address rules run when a message arrives at the rule's @go.mail2cloud.io address. The message is saved and is not delivered anywhere.
• User Mailboxes rules connect to mailboxes and process mail that is already there, once or continuously. Mail routing does not need to change.
• Storage Webhook (Drag and Drop) rules run when an .eml or .msg file is added to a monitored Box folder.

The rest of this page is about Email Flow rules unless it says otherwise.

How mxHERO decides whether an Email Flow rule applies

mxHERO splits each message into one copy per recipient and evaluates rules for each copy. So one message to three people can be handled differently for each recipient. For example, a rule for external recipients protects the attachments for the outside recipient, while the internal recipient gets the original.

For each rule and each recipient copy, mxHERO checks the conditions in this order. If any check fails, the rule is skipped for that copy and the next rule is checked.

Each rule's conditions are checked in a fixed order; the first condition that fails stops the rule for that recipient.

Details of each check are in Senders and Recipients and Filters and Exclusions.

Whose rules run

• The sender's organization's rules run first.
• If the recipient belongs to a different mxHERO organization, that organization's rules run next. Mail between two of your own users is evaluated once, by your organization.
• If Only process email rules with transport agent header (sometimes called Strict Mode) is on in Settings › Gateway, your rules run only on messages that carry your organization's Transport Agent value. See Gateway Settings.

Rules that run before the message is split

Temporary Hold and Request Approval rules can hold a message for all of its recipients at once. These rules run once per message, before mxHERO splits it per recipient (sometimes called the preprocessing phase). They run only for mail sent by your organization's own users. See Temporary Hold and Request Approval.

When several rules match

You can't set a priority between rules. mxHERO runs matching rules in a fixed order of action types:

1. S/MIME Emails
2. Block Attachments
3. Temporary Hold
4. Request Approval
5. Copy Emails
6. Zip Attachments
7. Secure Emails
8. Protect Attachments

Within the same action type, the rule with the more specific sender and recipient runs first, in this order: email address, tag, group, domain, Organization, Anyone else, Anyone. The sender side counts slightly more than the recipient side.

Two more rules apply:

• A rule that takes the message stops the rest of that pass. When a rule blocks the message, holds it, sends it to storage to replace its content (Protect Attachments, Secure Emails, Zip Attachments with storage), or applies S/MIME, the remaining rules in that pass are skipped. Copy Emails rules do not take the message, so several Copy Emails rules can all run, and a Protect Attachments rule can still run after them.
• Each rule runs at most once per message.

Important: Because the order is fixed, two rules with overlapping senders and recipients can interact in ways you don't expect. For example, a Block Attachments rule always runs before a Protect Attachments rule for the same mail. Test overlapping rules with a pilot user and check Reports › Email Flow Logs.

Rule locale and time zone

Each rule can have its own Locale and TimeZone (in the wizard, under Locale & Time zone). If you leave them empty, the rule uses the organization's settings.

• The time zone is used for date variables in folder and file names, for example {Sent or Receive Date / yyyyMMdd}. A message sent at 23:30 UTC on the 1st is filed under the 2nd for a rule set to Asia/Tokyo.
• The locale sets the language of the notifications the rule sends (English, French or Japanese).

When changes take effect

• New and changed Email Flow rules apply within about 1 to 2 minutes.
• Only enabled rules run. Stopping a rule in the Rules List takes effect within the same 1 to 2 minutes.
• Up to 1,000 enabled Email Flow rules per organization are loaded.
• User Mailboxes rules start within a few minutes of saving. Continuous ones check for new mail about every 5 minutes.

What happens when something fails

mxHERO is designed to fail open: if a rule can't do its job, the original message is still delivered.

Messages in winmail.dat (TNEF) format are skipped by Protect Attachments, Secure Emails, Zip Attachments and S/MIME Emails. See Preventing TNEF Encapsulation.

Related pages

• Create a Rule
• Rule Targets
• Senders and Recipients
• Filters and Exclusions
• Rules List
• Email Flow Logs
• Mail Not Processed