Block Attachments

A Block Attachments rule stops emails that carry attachments and tells the sender why. The recipient gets nothing. Use it to enforce a data policy, for example "no attachments to personal webmail domains" or "no executable files from outside". This page covers the rule wizard, the sender notice, filters, and what to check when a rule blocks too much or too little.

Warning: A blocked email is not delivered, not held and not stored anywhere by mxHERO. The sender must send it again. Test every Block Attachments rule with a pilot sender before you widen it.

Before you begin

• Your mail is routed through mxHERO for the direction you want to control. See Routing Architectures.
• The senders or recipients you want to target are managed accounts in Settings › Accounts and Groups (or covered by Organization). At least one side of the rule must be managed. See Senders and Recipients.
• Decide which attachments to block. Without filters, the rule blocks every email that has an attachment.
• Optional: a filter policy in Auto Filling › Filter Policies, for example one built on the default variable Common threat vector Extension. See Filter Policies.

How it works

1. A message matches the rule's senders and recipients.
2. mxHERO checks the message's attachments against the rule's Action Filters. If no attachment qualifies, the rule doesn't apply and the message continues.
3. If at least one attachment qualifies, mxHERO drops the whole message for that recipient. The other attachments and the body are not delivered either.
4. mxHERO sends the sender a notice from noreply@mxhero.com, as a reply to the original message.

Block Attachments checks each recipient separately. If an email goes to one internal and one external recipient and the rule targets Organization to Anyone else, only the external copy is blocked. The internal recipient still gets the email.

Block Attachments rules run before Temporary Hold, Request Approval, Copy Emails and the storage actions. Once a message is blocked for a recipient, no later rule runs on that copy. See How Rules Work.

There are no Cloud Storage or Storage Filepath steps and no More actions... panel.

Create a Block Attachments rule

Step 1: Action

1. Open Rules › Create a Rule.

2. Click Block Attachments, then Start Rule Creation.

   The Action step reads "All your attachments will be blocked". This text describes the action; the filters you add next decide which attachments count.

   

3. Optionally open Advanced Options and edit Block notification settings (see Sender notice).

4. Click Confirm.

Add Filters: choose which attachments block the email

1. Under the Action step, click Add Filters. The Action Filters panel opens.
2. Turn on the filters you need:

3. Check the state of every toggle before you continue.

If you don't add Action Filters, mxHERO uses built-in defaults: inline images don't count, attached emails do, and every other attachment blocks the message.

Important: TNEF messages from Outlook and Exchange (winmail.dat) are skipped unless Include TNEF messages is on. With it on, every TNEF message matches, whatever is inside it. Prefer turning TNEF off at the source. See Preventing TNEF Encapsulation.

For how filters, filter policies and exclusions combine, see Filters and Exclusions.

Step 2: Target

1. Under Rule Scope:, Email Flow is the only choice.

2. Under Target all emails sent:, choose Between (both directions) or From (one direction), then the Sender and Recipient. Defaults: Organization and Anyone.

   Typical choices:

   Goal	Sender	Recipient
   Stop attachments leaving the company	Organization	Anyone else
   Stop attachments to a specific domain	Organization	webmail.example
   Stop risky attachments arriving	Anyone else	Organization

3. Optionally open Advanced Options:

   • Include From, To and CC when evaluating which emails will be processed. Match header addresses as well as the envelope.
   • Include From header when evaluating which emails will be processed. Add the From header to the sender side.

   Both are off by default and can't be on together.

4. Click Confirm.

Add Filters: Target Filters (optional)

Click Add Filters under the Target step to add:

• Use filter policy: the rule runs only when the filter policy matches.
• Process only managed accounts: the sender or the recipient must be an account in Settings › Accounts and Groups.
• Sender/Recipient (From/To) Exclusions: pairs of addresses the rule skips, for example ceo@example.com to Anyone.

#nomxhero in the subject does not cancel a Block Attachments rule.

Name and save

1. In the right column, enter a Rule Name and, optionally, a Rule Description.
2. Optionally set Locale (the language of the default notice) and TimeZone.
3. Click Save Rule.

New rules are enabled when saved. Changes take one to two minutes to apply.

Sender notice

The sender gets one notice for the blocked recipient. Edit it in the Action step under Advanced Options › Block notification settings.

Variables in these fields use a $ and capitals, not braces:

Tell senders what to do next in the body, for example "Share the file through your company Box folder instead." For all other notification texts, see Notification Templates.

The message is dropped even if the notice can't be sent.

Verify

1. From a pilot sender, send an email with an attachment that should be blocked to a test recipient.
2. Check that the recipient gets nothing and the sender gets the notice.
3. Open Reports › Email Flow Logs and find the message. Its status is Dropped by rule action, and the event list shows your rule. See Email Flow Logs.
4. Send an email that should not be blocked (no attachment, or an allowed type) and check it's delivered.

Limits and failure behavior

• Email Flow target only. Block Attachments can't act on mail already in mailboxes.
• The whole message is blocked for the recipient, not only the matching attachment. To remove only some attachments and deliver the rest, use Protect Attachments instead.
• Unlike other actions, Block Attachments doesn't fail open: if the rule matches, the message is dropped even if sending the notice fails.
• If mxHERO can't load rules at all, mail is delivered without rules (including Block). See How Rules Work.
• Blocked messages can't be released or recovered from mxHERO.

Troubleshooting

Related pages

• Create a Rule
• Filters and Exclusions
• Senders and Recipients
• Filter Policies
• Preventing TNEF Encapsulation
• Notification Templates
• Email Flow Logs