Senders and Recipients – mxHero Help Center

Every Email Flow rule says whose mail it applies to with a sender, a recipient and a direction. This page explains the values you can use, what Anyone, Anyone else and Organization mean, which combinations are valid, and how messages with several recipients are matched.

Before you begin

Import your users, groups and tags into Settings › Accounts and Groups. Organization, group and tag values match only accounts that exist there. See Accounts and Directory.

Where you set them

In the rule wizard's Target step, choose Email Flow, then fill in Target all emails sent:

Email Flow target: Between or From, then the Sender and Recipient fields

Choose the direction:
- Between: matches mail in both directions, from the sender to the recipient and from the recipient to the sender.
- From: matches mail only from the sender to the recipient.
In Sender, type to search, or pick a keyword.
In Recipient, type to search, or pick a keyword.

The defaults are Organization and Anyone.

Temporary Hold, Request Approval and Zip Attachments rules always use From. Between isn't available when you choose Send the same copy of the content and attachment links to all recipients.

Values you can use

Sender search showing tag, Organization, Anyone and Anyone else options

Value	Matches
Email (an address)	That address, including any of the account's aliases. Not case-sensitive.
Domain	Any address in the domain or its aliases. Works for external domains too, for example `bank.example`.
Group	Members of a group in Settings › Accounts and Groups.
Tag	Accounts that have the tag.
Organization	Any account of your organization.
Anyone else	Anyone who does not match the other side of the rule. See below.
Anyone	Any address.

What "Anyone else" means

Anyone else means "anyone who doesn't match the other field". It is relative to what you put on the other side:

Sender	Recipient	What Anyone else matches
Organization	Anyone else	Recipients outside your organization. This is the usual "external mail" rule.
`finance@example.com`	Anyone else	Everyone except `finance@example.com`, including your other employees
Group `Legal`	Anyone else	Everyone who isn't in the Legal group, including other employees

Important: Anyone else means "external" only when the other side is Organization. In the UI its subtext says "Outside your organization", but with any other value on the other side it also matches internal users. To target only external mail for one group, use the group as sender and Anyone as recipient, then add a target filter policy whose variable checks that {Recipient, internal} is equal to false. See Filters and Exclusions.

The managed-account rule

At least one side of the rule, the sender or the recipient, must be something your organization manages: Organization, one of your domains, groups or tags, or an account in Settings › Accounts and Groups. Anyone, Anyone else and external addresses or domains are not managed. The wizard won't confirm the Target step otherwise.

Examples for an organization with the domain acme.example:

Sender	Recipient	Valid?	Why
Organization	`bank.example`	Yes	The sender is managed
`john@other.example`	`bank.example`	No	Neither side is managed
`john@other.example`	`mary@acme.example`	Yes	The recipient is managed
`bob@other.example`	Anyone	No	Anyone isn't necessarily managed
Organization	Anyone else	Yes	The sender is managed
Anyone	Organization	Yes	The recipient is managed

For Temporary Hold and Request Approval, the sender must be managed, and it can't be Anyone or Anyone else. These rules run before the message is split per recipient, and only for mail your own users send.

Common setups

Goal	Direction	Sender	Recipient
All mail between your users and the outside world	Between	Organization	Anyone else
Only outbound mail to external recipients	From	Organization	Anyone else
Only inbound mail from outside	From	Anyone else	Organization
All mail of one department	Between	Group or tag	Anyone
Mail between your organization and one partner	Between	Organization	Partner's domain
Everything your users send or receive, internal included	Between	Organization	Anyone

How messages with several recipients are matched

mxHERO splits each message into one copy per recipient and checks the rule for each copy separately. Consider a message from mary@acme.example to tom@acme.example and client@partner.example, with a rule From Organization to Anyone else:

The copy to client@partner.example matches. The rule runs for that recipient.
The copy to tom@acme.example doesn't match. Tom gets the original message.

Temporary Hold and Request Approval are different: by default they hold the message for all recipients if at least one recipient matches.

If the recipient is also in another mxHERO organization, that organization's rules run on its copy after yours. See How Rules Work.

Envelope or headers

By default, rules match the envelope: the sender and recipient addresses that mail servers use to deliver a message. These are usually the same as the From and To you see in a mail client, but not always:

BCC recipients appear only in the envelope.
Mail to a distribution list may arrive with the list's address in To, and each member in the envelope.
Services that send on someone's behalf may use a different envelope sender than the From address.

Two options in the Target step's Advanced Options change this:

Option	Effect
Include From, To and CC when evaluating which emails will be processed.	Also matches the addresses in the From, To and CC headers. Exclusions are then checked against the headers too. On by default for Temporary Hold and Request Approval.
Include From header when evaluating which emails will be processed.	Also matches the From header address on the sender side.

You can turn on only one of the two. Use them when users expect the rule to follow what they see, for example to catch mail sent "on behalf of" a managed user. The From header can be forged, so don't rely on it alone for security decisions.

Verify

Send a test message for each direction your rule should cover, and one it should not.
Open Reports › Email Flow Logs and check each recipient. A matching recipient shows Rule Executed for your rule. A non-matching one shows no event for the rule. See Email Flow Logs.

Troubleshooting

Symptom	Cause	Fix
Target step won't confirm, with an error that the flow isn't managed	Neither side is managed by your organization	Put Organization, one of your domains, a group, a tag or an account on one side.
Target step won't confirm, with an error that the rule is in use	Another rule already uses the same flow in a way that conflicts	Adjust the senders and recipients, or edit the existing rule.
An "external" rule also runs on internal mail	Anyone else is paired with something other than Organization	Use Organization on the other side, or add exclusions.
A group or tag rule doesn't match a user	The user isn't in Settings › Accounts and Groups, or isn't in the group or tag	Check the account and run directory sync.
BCC recipients or list members aren't matched as expected	Envelope and header addresses differ	Check the envelope recipient in Email Flow Logs. Consider the header options.
Temporary Hold or Request Approval doesn't run on inbound mail	These rules run only for mail your own users send	Use a sender from your organization.