Secure Emails

A Secure Emails rule protects the whole message, not only its attachments. mxHERO moves the message body (as a PDF) and the attachments to cloud storage, and the recipient gets a notice with a secure link instead of the content. Use it for sensitive mail such as health, financial or student records. This page covers each option in the Secure Emails wizard, including password delivery.

In the dashboard the action is called Secure Emails. Older documents call it Secure Email. The general wizard layout is in Create a Rule.

What it does

For each matching message, mxHERO:

1. Saves a PDF of the message body and the attachments to storage, with the link security you choose.
2. Replaces the message body with a short notice and a link to the protected content ("Email content has been protected. To see email content click here."). The attachments are removed and replaced with links.
3. If the links are password protected, sends the password to the recipient in a separate email.
4. Delivers the notice.

The subject, sender and recipients stay visible. Only the body and the attachments are protected.

Typical uses:

• Protect mail that contains regulated data, for example to meet HIPAA or FERPA policies.
• Let senders choose when to protect a message by adding #secure to the subject.
• Protect mail automatically when its content matches a pattern, using a filter policy or security policy. See Filter Policies.

Compare with Protect Attachments, which keeps the message body readable and protects only the attachments, and Zip Attachments, which uses a password-protected ZIP file.

Supported targets

See Rule Targets.

Before you begin

• You need an Owner or Administrator role in the Admin Dashboard.
• Route mail through mxHERO and test it. See Testing Mail Flow.
• Connect the storage in Settings › Integrations. For password-protected links without a storage-provider account on the recipient's side, use Box, Dropbox or mxHERO Shares. See Link Security Options by Provider.
• Optionally set how passwords are generated in Settings › Integrations › Storage settings › Storage Link Password Settings (number of digits, special characters, lowercase and uppercase letters).
• Optionally create a storage notification template to change the notice text. See Notification Templates.

Step 1: Action

1. Open Rules › Create a Rule, select Secure Emails, and click Start Rule Creation.

2. Under Select what to save:, Attachments and Email's Body in PDF are selected. Email's Body in PDF is required: if you clear it, the message "Email's Body in PDF option must be selected" appears and you can't confirm. Optionally also select Email to save the full message as .EML (default) or .MSG.

   

3. Optionally open Advanced Options:

   Option	Values	Default	What it does
   Select where to add the attachment links:	Email's body, “attachments.pdf“ file, Both	Both	Where the links to the attachments appear in the notice
   Customize password notifications	On or off	Off	Changes the password email for this rule: Message to recipient (default "Use the passphrase below to access the secure links recently sent to you.") and Subject prefix (default [Password Notification])

   Secure Emails has no template selector in the rule.

4. Click Confirm.

Action filters (optional)

Click Add Filters under the Action step for the Action Filters panel: attachment size, extension, name and type, and a filter policy. See Filters and Exclusions.

Important: A message must have at least one attachment that passes the action filters, or the rule doesn't run and the message is delivered unprotected (reason mail_content_without_attachments).

Step 2: Target

Rule Scope: shows only Email Flow.

1. Choose Send an individual copy of the content and attachment links to each recipient (default) or Send the same copy of the content and attachment links to all recipients. Use an individual copy if each recipient needs their own links or password.
2. Set Target all emails sent: with Between or From, a Sender and a Recipient. To protect mail to outside recipients only, use From Organization to Anyone else. See Senders and Recipients.
3. Optionally open Advanced Options: Include From, To and CC when evaluating which emails will be processed. or Include From header when evaluating which emails will be processed.
4. Click Confirm.

Target Filters (click Add Filters under the Target step):

Short codes are not case-sensitive, must be separated from other words by spaces, and are removed from the subject before delivery. A common setup is Trigger on short code so that users decide which messages to secure. See Opting Out with #nomxhero.

Step 3: Cloud Storage

1. In Cloud Storage Account:, choose the storage, for example Box for Organizations or mxHERO Shares.

2. For an organization account, choose Select which storage accounts are used:. See Create a Rule.

3. Choose Select a security option:. For Secure Emails this decides how the recipient opens the message:

   Option	Recipient experience
   Preset: Password protected access links	Opens the link and enters the password from a separate email. No storage account needed. Box, Dropbox and mxHERO Shares.
   Preset: Recipients access links / Preset: 7 days expiration recipients access links	Signs in to the storage provider with the address the email was sent to. Not with Send the same copy of the content and attachment links to all recipients.
   Authenticated access links (mxHERO Shares)	Signs in on the mxHERO Shares page with an emailed code, Google or Microsoft. Not with Send the same copy of the content and attachment links to all recipients.
   Preset: Organization access links	Only people in your organization can open it. Use for internal mail.
   Preset: Public access links / Preset: 7 days expiration public access links	Anyone with the link. This offers little protection for Secure Emails.
   A Security definition or Security policy	Your own settings, for example 3-day links with a password. See Security Definitions and Policies.

   Important: Check the selected security option before you confirm. Don't rely on the preselected value, and don't use Accessible to the folder collaborators (no shared link) for outside recipients: they would get a link they can't open.

4. Optionally open Advanced Options:

   • Select a template option: Box or Egnyte metadata template.
   • Tracking option: Do not track emails (default), Track email opens, Track only attachment access, or Track email opens and attachment access. See Link Tracking.

5. Click Confirm.

How the password is delivered

When the security option uses a password:

• mxHERO generates a new password for each message, following Storage Link Password Settings. With Send an individual copy of the content and attachment links to each recipient, each recipient gets their own password.
• The recipient gets a second email with the subject [Password Notification] <original subject> (or your Subject prefix) and the text "Use the passphrase below to access the secure links recently sent to you." (or your Message to recipient).
• The password email comes from the original sender's address when the sender's domain is managed by mxHERO, and from noreply@mxhero.com otherwise.
• A sender can also ask for a password on one message by adding #pass or #password to the subject, even when the rule's security option has no password. This works when the sender is managed by the rule.

Step 4: Storage Filepath

1. Keep Root or choose Pick from storage under Filepath where to copy your files:.

2. Edit the Subfolder path. The default is:

   Secure Emails/{Email Address}/{Peer Address}/{Subject Normalized}/{Sent or Receive Date / yyyyMMdd}

   With same copy for all recipients, the default starts Secure Emails/{Sender}/ instead.

3. Or turn on Use a copy policy instead. See Copy Policies.

4. Optionally open Advanced Options:

   • Attachment Name Formatting (default {Attachment Name})
   • Email's Body in PDF Name Formatting (default {Sent or Receive Date / yyyyMMdd_hhmm}-{Subject Normalized})
   • Use a subfolder to save attachments and Use a subfolder to save the email’s body as a PDF
   • Collaborate Subfolder: share a folder level with the managed sender or recipient. Not available with recipient-access links or same copy for all recipients.
   • Do not overwrite existing files

   

5. Click Confirm.

See Storage File Paths.

More actions (optional)

Click Add Action to open More actions...:

Warning: With Deliver anyway, a message whose content can't be stored is delivered unprotected. For mail that must never be sent in the clear, choose Bounce email to sender. See "If something fails" below.

Then name and save the rule. See Create a Rule.

What recipients and senders see

Recipients get a message with the original subject and sender, and:

• A notice instead of the body, with a link (default text "Email content has been protected. To see email content click here." and the link text "Open").
• Links to the attachments in the notice, in an attachments.pdf file, or both.
• A separate password email, if the links are password protected.

The link opens a PDF of the original message; the attachments open from their own links. What recipients do is described in Password-Protected Emails and Opening Protected Attachments.

To change the notice text, use the Secure email tab of a storage notification template. See Notification Templates.

Senders see their message as they wrote it in Sent Items. They may get tracking notifications and, with Bounce email to sender, a [BOUNCED] notice.

Notifications this action sends

Limits

• Email Flow only.
• Messages in winmail.dat (TNEF) format are not processed and are delivered as they are. Prevent TNEF in your mail system. See Preventing TNEF Encapsulation.
• If the body has no HTML part, the body PDF may not be created (event no_html_in_body).
• Secure Emails runs after Copy Emails and Zip Attachments, and before Protect Attachments. Once a Secure Emails rule processes a message, Protect Attachments rules are skipped for it. See How Rules Work.
• Cancel on short code (#nomxhero) on one rule also cancels the later Secure Emails, Zip Attachments and Protect Attachments rules for that message.
• Each message is uploaded with a time budget of 45 minutes, including retries.

If something fails

Verify

1. From a managed account, send a test message with an attachment to an outside address you control. If the rule uses Trigger on short code, add #secure to the subject.
2. Check that the recipient got the notice instead of the body, and the password email if expected.
3. Open the link as the recipient. Check that the body PDF and the attachments open with the expected sign-in or password.
4. In Reports › Email Flow Logs, open the message and check the rule's executed event and the storage event. See Email Flow Logs.

Troubleshooting

Related pages

• Protect Attachments
• Zip Attachments
• Create a Rule
• Senders and Recipients
• Filters and Exclusions
• Link Security Options by Provider
• Storage File Paths
• Notification Templates
• Password-Protected Emails