Zip Attachments

A Zip Attachments rule puts a message's attachments into one password-protected ZIP file and sends the password in a separate email. Use it when your policy or your recipients require encrypted attachments but don't use links to cloud storage. This page covers each option in the Zip Attachments wizard and what senders and recipients receive.

The general wizard layout is in Create a Rule.

What it does

For each matching message, mxHERO:

1. Puts the attachments that pass the filters into a file named attachments.zip, protected with a generated password.
2. Replaces those attachments with attachments.zip. Optionally, it stores the ZIP file in mxHERO Shares and sends a link to it instead (see Step 3).
3. Sends the password in a separate email to the recipients, the sender, or both.
4. Delivers the message. The body is not changed.

The ZIP file uses standard ZIP password encryption, which Windows and macOS open without extra software. It is not as strong as AES encryption. For the most sensitive mail, consider Secure Emails.

Typical uses:

• Meet a partner's or regulator's requirement that attachments be encrypted, for example for mail to a particular domain.
• Protect attachments for recipients who can't open cloud storage links.

Supported targets

See Rule Targets.

Before you begin

• You need an Owner or Administrator role in the Admin Dashboard.
• Route mail through mxHERO and test it. See Testing Mail Flow.
• Optionally set how passwords are built in Settings › Integrations › Storage settings › Storage Link Password Settings (Numbers, Special characters, Lower case letters, Upper case letters). The same settings apply to all generated link passwords.
• To send links instead of the ZIP attachment, set up mxHERO Shares first. See Shares Settings.

Step 1: Action

1. Open Rules › Create a Rule, select Zip Attachments, and click Start Rule Creation.

2. Under Select what to save:, only Attachments can be selected. Email and Email's Body in PDF are unavailable for this action.

   

3. Open Advanced Options and choose who receives the password:

   Option	Default	What it does
   Select where to add the attachment links:	Both	Email's body, “attachments.pdf“ file or Both. Applies when the ZIP is stored in mxHERO Shares and sent as a link.
   Send passphrase to recipient(s)	On	"Recipients of the secure link will receive the passphrase"
   Send passphrase to sender	Off	"You, the sender, will also receive the passphrase"
   Send a notification to the sender	Off	Tells the sender that the message was sent as a ZIP file. When on, edit the title (default "Email processed with ZIP encryption") and body (default "Your email was processed to secure its attachments using password-protected ZIP format. The recipients have received a secure version.").
   Customize password notifications	Off	Changes the password emails for this rule: the message to recipients, the messages to the sender, and the Subject prefix (default [Password Notification]).

   At least one of Send passphrase to recipient(s) and Send passphrase to sender must be on. If you send the password only to the sender, the sender must pass it to the recipients another way, for example by phone.

4. Click Confirm.

Action filters (optional)

Click Add Filters under the Action step to choose which attachments go into the ZIP file, for example only Office documents and PDFs. The options are the same as for Protect Attachments, except Only process protected ZIP files. See Filters and Exclusions.

A message with no attachment that passes the filters is delivered unchanged.

Step 2: Target

Rule Scope: shows only Email Flow.

1. Choose how passwords are created for messages with several recipients:
   • Send a single Zip file to all recipients, protected with a shared password (default): one ZIP file and one password for the whole message.
   • Send a separate Zip file to each recipient, each protected with a unique password: each recipient gets their own ZIP file and password.
2. Set Target all emails sent:. The direction is fixed to From. Choose a Sender and a Recipient (defaults Organization and Anyone). For example, From Organization to a partner's domain. See Senders and Recipients.
3. Optionally open Advanced Options: Include From, To and CC when evaluating which emails will be processed. or Include From header when evaluating which emails will be processed.
4. Click Confirm.

Target Filters for Zip Attachments are Use filter policy and Sender/Recipient (From/To) Exclusions. There are no short-code options in the wizard. See Filters and Exclusions.

Step 3 (optional): Add Storage Settings

By default, the ZIP file is attached to the message. To store it in mxHERO Shares and send a link instead, click Add Storage Settings after confirming the Target. This adds 3. Cloud Storage and 4. Storage Filepath. The button is available only if mxHERO Shares is enabled for your organization. To go back to an attached ZIP, click Remove Storage Settings.

3. Cloud Storage

1. Cloud Storage Account: is fixed to mxHERO Shares.
2. Choose Select a security option:. The default is Preset: 7 days expiration public access links. You can also choose Preset: Public access links, Preset: Organization access links, or an mxHERO Shares security policy or definition. The ZIP password protects the file in every case.
3. Click Confirm.

4. Storage Filepath

1. Edit the Subfolder path. The default is:

   Zip Attachments/{Sender}/{Subject Normalized}/{Sent Date / yyyyMMdd_hhmm}

2. Or turn on Use a copy policy instead.

3. Optionally open Advanced Options: Attachment Name Formatting (default {Attachment Name}) and Use a subfolder to save attachments.

4. Click Confirm.

How long files stay in mxHERO Shares depends on your Shares retention setting. See mxHERO Shares Overview.

More actions (optional)

Add Action is available only when storage settings are added. It offers:

Then name and save the rule. See Create a Rule.

What recipients and senders see

Recipients get:

• The original message with the body unchanged, and attachments.zip in place of the protected attachments. With storage settings, a link to the ZIP file in mxHERO Shares instead.
• A separate password email (when Send passphrase to recipient(s) is on), with the subject [Password Notification] <original subject> and the text "Use the passphrase below to access the secure links recently sent to you."

To open the file, recipients save attachments.zip and enter the password when their computer asks. See Password-Protected Emails. Share that page with your recipients if they are new to it.

Senders see their original message in Sent Items. They also get:

• The password, if Send passphrase to sender is on. The text names the recipients ("…recently sent to" the recipients, or "…to all intended recipients").
• A notice that the message was sent as a ZIP file, if Send a notification to the sender is on.

Notifications this action sends

The password email comes from the original sender's address when the sender's domain is managed by mxHERO, and from noreply@mxhero.com otherwise. See Notification Templates.

Limits

• Email Flow only. The direction is always From.
• Storage, when used, is always mxHERO Shares.
• The custom title is limited to 115 characters and the body to 1,500 characters. Password message lines are limited to 500 characters and the subject prefix to 100.
• Messages in winmail.dat (TNEF) format are not processed and are delivered as they are. See Preventing TNEF Encapsulation.
• Zip Attachments runs after Copy Emails and before Secure Emails and Protect Attachments. With storage settings, later Secure Emails and Protect Attachments rules are skipped for the message. Without storage settings, they can still run on the same message. Avoid rules that overlap. See How Rules Work.
• Some mail systems and security gateways block or quarantine encrypted ZIP files because they can't scan them. Test with your main recipients first.

If something fails

mxHERO fails open: if it can't create the ZIP file, the recipient gets the original attachments. If unencrypted attachments must never be sent, use storage settings with Bounce email to sender, or a Block Attachments rule.

Verify

1. Send a test message with an attachment from a managed account to an outside address you control.
2. Check that the recipient got attachments.zip (or a link) and a separate password email.
3. Open the ZIP file with the password.
4. If Send passphrase to sender or Send a notification to the sender is on, check the sender's inbox.
5. In Reports › Email Flow Logs, check the rule's executed event. See Email Flow Logs.

Troubleshooting

Related pages

• Secure Emails
• Protect Attachments
• Create a Rule
• Senders and Recipients
• Filters and Exclusions
• Storage File Paths
• mxHERO Shares Overview
• Notification Templates
• Password-Protected Emails