Transport rules

A transport rule is a standing instruction about mail passing through your organization: when a message looks like this, do that.

It is how you add a legal disclaimer to everything going out, tag messages from a particular sender, or quarantine anything mentioning a word you would rather nobody emailed.

Read the enforcement note below before you rely on one. Rules are always saved and ordered; whether they act on live mail depends on your deployment.

Each rule has three parts.

Direction — whether it applies to mail coming in, going out, or both.

Conditions — what makes a message match. You can test the sender, the recipient, the subject, a header, the message size, or whether it has an attachment. Each condition uses one of: equals, contains, starts with, ends with, a regular expression, greater than, or less than. Where a rule has several conditions, you choose whether all must match or any will do.

Actions — what happens to a matching message. Adding a header, changing the subject, adding a disclaimer, rejecting and quarantining are carried out where enforcement is on. Redirect and blind-copy are not: they change where a message is delivered, and the component that applies these rules can inspect and mark mail but cannot reroute it. A rule using those actions is evaluated and then skipped rather than quietly appearing to work.

Rules run in priority order, top to bottom, and each can be switched off without being deleted.

Enforcement is off by default and turned on per deployment. That is deliberate: switching it on changes what happens to live mail, so it is an operator's decision made knowingly rather than a surprise on a deploy. If you need your rules to act and are not sure whether they do, ask through a support ticket rather than assuming — and test as in step seven below.

The hit count column does not currently increase when a rule matches. Do not read a zero there as proof a rule never fired; test with a real message instead.

1. Go to Transport Rules and add a rule.
2. Name it for what it does — Add legal disclaimer to outbound beats Rule 3 when somebody reads this list next year.
3. Choose the direction. Outbound covers mail your organization sends; inbound covers mail arriving.
4. Add your conditions and choose whether all or any must match. Start narrower than you think you need — a rule matching more mail than expected is the usual way this goes wrong.
5. Choose the action. If you need redirect or blind-copy, raise a ticket instead: those are not applied today.
6. Save, then drag it into the right position relative to your other rules.
7. Test it with a real message. Send one that should match and check the outcome on the message itself — a subject change or an added disclaimer is visible; a header is visible in the message source. This is the only reliable confirmation, because the hit counter does not move.
8. If nothing happens, ask whether enforcement is on for your deployment before rewriting the rule.

The rule does nothing at all. First ask whether enforcement is switched on for your deployment. A perfectly correct rule on a deployment with enforcement off changes nothing.

A redirect or blind-copy rule does nothing. Expected. Those actions are skipped. Raise a ticket describing what you need to happen to the mail.

The hit count says zero. It does not increment. Judge by the mail itself.

The rule matches too much. A contains on a short word catches more than you expect. Tighten the value, or add a second condition and set the logic to all.

Two rules fight. They run in order. Move the more specific rule above the general one.

Mail is disappearing. Look for a rule with a reject or quarantine action and switch it off — the switch keeps the rule so you can fix it rather than rebuild it. Then confirm against Email logs.

• Shared mailboxes — addresses a team works from
• Email logs — what actually happened to a message
• Go to Transport Rules