Routing Rules

Routing rules are configurations that determine how email messages are directed within or beyond an organization's email infrastructure. These rules can be set up to manage incoming, outgoing, or both incoming AND outgoing messages based on specific conditions. Think of Routing Rules as "Content Filters for the Spool" -- they act similarly to domain or user content filters, but where those content filters only act on messages for a specific user or domain, Routing Rules work on anything moving into, or out of, the spool as a whole -- before a domain or user's own Content Filters ever get a chance to see the message.

Routing rules can be used for a number of different scenarios. For example, administrators can configure rules to route bounced messages to a specific mailbox. Or, messages that have a specific attachment, such as "company_secrets.pdf", can have attachments stripped prior to the message actually being sent. The key is that routing rules are extremely flexible and can be used for a number of different scenarios.

Important Notes

• Routing Rules are extremely powerful, and they need to be used with care to avoid potential drawbacks such as missing emails, etc.
• Normally, every enabled routing rule that matches a message is processed, from top to bottom, unlike Content Filters, which stop evaluating further filters once one fires. However, four specific Actions -- Delete Message, Quarantine Message, Bounce Message, and Stop Processing Rules -- halt this entirely: once one of them runs, no further Actions and no additional Routing Rules further down the list are evaluated for that message. See the note under Actions, below, for details.
• Routing rules are processed on messages in the spool -- incoming, outgoing, or both, depending on how the rule is set up. However, if archiving is enabled, messages WILL BE archived prior to any routing rules being processed.
• If a routing rule is saved with no Conditions added at all, that empty condition set is automatically treated as "True" when the rule's Match Type is set to All (so the rule matches every message it's allowed to scan), but as "False" when the Match Type is set to Any (so the rule never matches anything). This is different from leaving an individual Condition's search value blank -- doing that just causes that one Condition to fail to match, which, in an All-type rule, prevents the whole rule from firing (see the note under Conditions, below).
• For extension matching, SmarterMail uses an exact, though case-insensitive, match. Therefore, "doc" and "docx" are treated as two completely separate extensions (though "PDF" and "pdf" are treated the same).
• Some Actions will stop any additional Actions and any additional Routing Rules from being evaluated for the message. These are Delete Message, Quarantine Message, Bounce Message, and Stop Processing Rules (each marked with an asterisk in the Actions list, below). SmarterMail automatically runs these four Actions last within whatever rule they're added to, regardless of the order they were added on the Actions tab, so any other Actions configured in that same rule still get a chance to run first.

Create / Edit Routing Rules

Initially, the Routing Rules area will be empty. However, if an existing rule is displayed, it can be clicked on and edited as needed. To create a new Routing Rule, click the New button. You'll see three (3) tabs displayed: Options, Conditions, and Actions. The Options tab will be highlighted.

The Options tab is where you set up some initial information about the Routing Rule. The Conditions tab is where you set up the conditions that will determine if the Routing Rule should be applied. The Actions tab is where you set up the actions that will be taken if the Conditions are met.

Options

The Options tab holds the Options card. Here you will set the following:

• Name - The friendly name of the rule. Ideally, this will be something specific to the rule being created as this information is logged by SmarterMail when it fires. Using a generic, or non-descriptive name can make it difficult to know, when reviewing logs, what the rule is for and what it does.
• Match Type - This is where you set how the rule applies the Conditions that are set: whether Any one Condition being met is enough to fire the rule (a logical OR across all Conditions), or whether All Conditions must be met (a logical AND). See the worked example under Conditions, below, for how this plays out with multiple Conditions.
• Messages to Scan - This is where you set whether the rule evaluates inbound messages, outbound messages, or both.
• Enabled - Whether the specific rule is enabled or disabled.
• Enable wildcards in search strings ( * and ? ) - The * and ? wildcards are used in search strings to represent unknown characters or sequences. Asterisks (*) are used for zero or more characters. For example, when used with "bird*", "bird", "birds", "birding", etc. would be returned. Question marks (?) are used for single, unknown characters. For example, "te?t" would return "text" and "test". Generally, neither should be used as the first character in order to prevent performance issues. For example, "*ing" could infer an extremely large dataset as anything followed by "ing" would be found/used/indexed.
• Include System Messages and Mailing Lists when evaluating conditions - By default, Routing Rules only evaluate "Normal" messages -- that is, ordinary mail composed by a user or submitted by an application. System-generated mail such as autoresponder replies, bounce/non-delivery notices, System Events notification emails, mailing list traffic, and delivery status notifications is skipped by default. Enable this setting if you need a rule's Conditions (such as a Message Type condition looking for Bounce or AutoResponse messages) to actually be evaluated against those system-generated message types as well.

Once the Options are set, the routing rule can be saved and Conditions and Actions added to the rule.

Conditions

When going to the Conditions tab, click on New to specify the criteria that triggers the rule's action(s). For each condition selected, you will be able to add specifications and enter any necessary details, as required. For example, if you choose to filter on 'From Address', you can enter one or multiple email addresses. If you choose to filter on 'Contains specific words or phrases', you can enter the specific text and choose to look for that text in an email's subject, message body, header, etc.

Conditions are arranged in "Condition Types." These are, essentially, the primary categories of conditions, with each Condition Type having a subset of Fields that are used for the condition. Some Condition Fields also have their own Comparison setting, and what that Comparison actually means depends on the kind of Field it's attached to:

• For simple yes/no Fields (like Has Any Attachment, Sender Authenticated, or Is Whitelisted), the Comparison is really just a True / False toggle -- False inverts the Condition, so the rule matches when that thing is not the case.
• For text-search Fields (From Address, To Domain, Subject, Email Header, and the other "contains specific words" Fields), the Comparison is Contains or Does Not Contain, checking whether your search text shows up anywhere in the relevant value. Wrapping a search term in double quotes (e.g. "test") requires it to match as a whole word bounded by spaces, rather than as a substring that could appear inside a longer word.
• For dropdown-style Fields (Message Type, Spam Level), the Comparison is Equals or Does Not Equal.
• For the one numeric threshold Field that offers a Comparison (Spam Score), it's Greater Than or Equal or Less Than.

As a worked example combining several Conditions: a rule with Match Type set to All that combines a To Domain Condition of "example.com", a Has Any Attachment Condition of "True", and a Specific Extension Condition of "exe" will only fire for messages addressed to someone at example.com that also carry an attachment with an .exe extension -- every one of those three Conditions has to be true at once. Changing the Match Type to Any on that same rule would instead fire if just one of those three things were true, which is rarely what you want for a rule like this.

Condition Types, and their respective Fields, are listed below. (This list is subject to change and modification.)

From Address

• From Address - Matches against the sender's address as parsed out of the message's From header (e.g., ceo@example.com from "Jane Doe <ceo@example.com>"). You can enter one or more addresses, one per line. Because the Comparison for this Field is a text "contains" check, entering the full address (e.g., "ceo@example.com") matches only that address, while entering something shorter like "example.com" would still match, since it's a substring search of the parsed address -- for domain-only matching, use the From Domain Field instead.
• From Domain - Matches against just the domain portion of the sender's address (everything after the @). Example: entering "example.com" matches messages from any address at that domain, such as billing@example.com or ceo@example.com, without having to list every individual sender.

To Address

• To Address - Matches against the recipient address(es) on the message's To line. Because a message can have multiple recipients, SmarterMail checks every address in the To header and matches if any one of them contains your search text. Example: entering "helpdesk@example.com" fires the rule whenever that address appears anywhere in the list of To recipients, even if other people are also addressed on the same message.
• To Domain - Matches against the domain portion of each recipient address on the To line. Example: entering "example.com" catches any message addressed to a user at example.com, regardless of which specific mailbox.

Contains Specific Words or Phrases

• Subject - Searches the text of the message's Subject line for the word(s) or phrase(s) entered. Example: entering "invoice" matches any message whose subject contains that word anywhere, such as "Your March Invoice is Ready."
• Body - Searches the message body content (not headers) for the specified word(s) or phrase(s).
• Subject or Body - A convenience Field that runs the same search against both the Subject line and the message body, matching if the text is found in either location.
• From Address - Unlike the From Address Field under the "From Address" Condition Type above, which searches the parsed sender email address, this Field performs a raw text search of the entire From header line, including any display name. Example: searching for "Accounting Dept" would match a From header like "Accounting Dept <ap@example.com>" even though that phrase isn't part of the email address itself.
• To Address - The same kind of raw text search, but performed against the message's entire To header line, including any display names present.
• Email Header - Searches the raw text of every header field on the message -- Received, Message-ID, X-Mailer, any custom X- header, etc. -- not just one named header. There's no separate field to restrict the search to a single, specific header name; SmarterMail checks all of them and matches if your search text turns up in any one of them.
• Anywhere In Message - The broadest of these Fields: searches every header field plus the entire message body for the specified text, matching if it's found anywhere at all in the message.

Message Properties

• Message Over Size - Matches messages whose total size, entered in KB, is greater than the value you specify. Example: entering "10000" (roughly 10 MB) matches any message larger than 10,000 KB.
• Message Under Size - Matches messages whose total size is less than the value you specify. Note the unit is different from Message Over Size: this Field's threshold is entered directly in bytes, not KB.
• Message Priority - Matches against the priority/importance flag a sending mail client attached to the message, read from the Importance header first, then the X-Priority header, then the X-MSMail-Priority header (whichever is present). Choose Low, Normal, or High from the dropdown; if none of those headers exist on the incoming message, it's treated as Normal. Example: a rule matching Message Priority = High could be paired with a Send Copy to Recipients action to automatically alert a supervisor whenever an urgent-flagged email comes through.
• Is Signed or Encrypted - A true/false check for whether the message carries cryptographic signing or encryption, covering both S/MIME (multipart/signed or application/pkcs7-mime parts) and PGP (multipart/encrypted parts, detached .pgp attachments, or inline ASCII-armored PGP blocks in the body). This condition doesn't distinguish between S/MIME and PGP, or between merely signed and fully encrypted -- it simply detects that some form of message-level cryptographic protection is present.

Delivery

• Sender Authenticated - A true/false check for whether the sender authenticated (logged in via SMTP AUTH) before submitting the message -- in other words, legitimate mail submitted by one of your own users through their mail client, as opposed to mail relayed in anonymously from elsewhere on the internet.
• Is Being Forwarded - Matches messages that are being forwarded rather than delivered straight to their original recipient. SmarterMail considers a message to be "being forwarded" if it's the product of a mailbox-level auto-forward, or if its headers contain forwarding indicators such as Resent-From, Resent-To, Resent-Date, X-Forwarded-To, or X-Forwarded-For.
• Spam Score - Matches against the raw numeric spam weight SmarterMail's antispam engine calculated for the message, compared against a threshold number you enter using Greater Than or Equal or Less Than. Example: "Spam Score Greater Than or Equal 8" fires for any message whose calculated weight reaches 8 or higher, regardless of which Spam Level tier that score happens to fall into.
• Spam Level - Rather than comparing the raw numeric score, this Field compares the message against the None, Low, Medium, or High tiers defined by your system's spam-score thresholds (set on the antispam Options page), using Equals or Does Not Equal. Example: "Spam Level Equals High" only matches once the calculated score has crossed into whatever range you've configured as "High."
• Message Type - Matches against the internal category SmarterMail assigned to the spool message, letting a rule target specific kinds of generated mail rather than ordinary user messages. The types currently available are Normal (ordinary composed mail), AutoResponse (autoresponder replies), Bounce (non-delivery notices), EventEmail (System Events notification email), MailingList (mail flowing through a mailing list), SizeLimitExceeded, and Dsn (delivery status notifications). Remember that Routing Rules only evaluate Normal messages by default -- for a Message Type condition targeting anything else (like Bounce) to ever actually fire, you must also enable "Include System Messages and Mailing Lists when evaluating conditions" on the Options tab.
• Is Whitelisted - A true/false check for whether the sender is considered whitelisted by the antispam engine -- the same whitelist consulted during normal spam scoring, configurable from the system's Blacklist/Whitelist settings -- letting you build rules that treat known-good senders differently.
• Time of Day - Matches based on the current time on the server, compared as Between or Outside two times you specify. Example: "Between 22:00 and 06:00" could route messages arriving overnight to a gateway with lighter processing, or flag them for review the next morning.
• Day of Week - Matches based on the current day of the week on the server, using Equals, Does Not Equal, or Between two days. Example: "Between Saturday and Sunday" could be combined with an action to hold weekend mail for review before delivery.
• External Sender - A true/false check for whether the message's sender is external to your server. SmarterMail treats an authenticated sender as automatically internal; otherwise, it compares the sender's domain (and Return-Path domain) against every recipient's hosted domain, that domain's aliases, and the External Senders whitelist -- if the sender's domain doesn't match any of those for any recipient, the sender is considered external. This is the same "external" concept used elsewhere in SmarterMail to flag messages that only appear to come from an internal address.

Attachments

• Has Any Attachment - A simple true/false check for whether the message contains at least one attachment, regardless of its type or name.
• Specific Extension - Matches attachments by file extension, entered one per line (the leading dot is optional). As noted above, SmarterMail uses an exact, case-insensitive match on the extension: "pdf" matches "Report.PDF", but "doc" will not match a file named "resume.docx", since extensions are compared as complete strings, not substrings. Example: a Specific Extension value of "exe" would catch an attachment named "setup.exe" but not one named "setup.exe.zip" (whose actual extension is .zip).
• Specific File Name - Matches the exact attachment file name (case-insensitive), rather than just its extension. This is the Field you'd use for the "company_secrets.pdf" example mentioned earlier -- entering that full file name matches only an attachment with that precise name, not other PDFs.
• Over Specified Size - Matches when at least one individual attachment -- not the message as a whole -- exceeds the specified size, entered in KB. Example: setting this to 5000 KB (about 5 MB) catches messages carrying a single large attachment, even if a Message Over Size condition wouldn't otherwise trigger because the total message size is still under that separate, larger threshold.

Actions

Once Conditions are set, it's possible to add actions. (This is possible before any Conditions are set as well.) When going to the Actions tab, click on New to specify what happens when one or more Conditions are met. As with Conditions, several Actions can run based on the criteria selected for the specific Condition(s) added. It's also worth remembering, as mentioned above, that some Actions (noted, below, with an asterisk) will stop any additional Actions -- and any additional Routing Rules -- from being processed. In these cases, that is noted on the Actions modal. In addition, Actions can contain variables for things like notifications, sending emails, etc. All available Actions are listed below. (This list is subject to change and modification.)

• Delete Message* - Silently deletes the message from the spool. No bounce or non-delivery notice is sent to the sender; the message is simply discarded and cannot be recovered afterward. Because there's no way to undo this or notify anyone it happened, test the rule's Conditions thoroughly before relying on this action in production.
• Send to Gateway - Overrides normal outbound routing and forces the message out through a specific Outbound Gateway you select, rather than whatever gateway (or round-robin rotation) the sending domain would otherwise use. At least one gateway must already be configured on the Gateways tab before you can select one here; the round-robin gateway pool, if one exists, is also selectable as a target. Example: forcing all outbound mail from a flagged sender through a dedicated, more heavily monitored gateway.
• Quarantine Message* - Pulls the message out of normal delivery entirely and places it into the system's spam quarantine (it's tagged the same way outbound spam-quarantined messages are), where a system administrator can review, release, or permanently delete it from the Spam Quarantine area rather than it being delivered or bounced.
• Add Header - Inserts a custom header (in "Name: Value" format) into the message before it's delivered. Example: adding "X-Routed-By: RoutingRule-Marketing" to tag messages that passed through a particular rule, which can then be searched for in logs or used as a condition in a later rule or a user's own content filter.
• Subject Prefix - Prepends text to the beginning of the message's Subject line (SmarterMail checks first and skips re-adding the prefix if the subject already starts with it). Example: prefixing "[EXTERNAL]" to any message where an External Sender condition is true, to visually warn recipients before they open it.
• Bounce Message* - Generates and sends a real non-delivery report (NDR/bounce) back to the sender, then stops the message from being delivered -- functioning like a rejection after the fact. Use this instead of Delete Message when you want the sender to know their message didn't go through.
• Strip Attachments - Removes attachments from the message before delivery. By default, it strips only attachments that are neither inline (such as a signature image referenced inline in an HTML email) nor an image type, leaving those two categories untouched; enabling the action's "strip all attachments" checkbox removes every attachment regardless of type. Note that Strip Attachments always operates on whatever attachments meet its own inline/image criteria (or all attachments, if that checkbox is set) -- it does not selectively strip only an attachment named in the rule's Conditions. So tying back to the "company_secrets.pdf" example in the overview, above, a rule combining a Specific File Name condition of "company_secrets.pdf" with a Strip Attachments action will fire the action whenever that file is present, but the action itself removes attachments based on its own inline/image (or strip-all) setting, not specifically because the condition named that one file.
• Stop Processing Rules* - Halts all further Routing Rule processing for this message: no remaining Actions in the current rule (there normally aren't any, since halting Actions are automatically executed last within their own rule) and no subsequent Routing Rules further down the list are evaluated at all. Its only job is to serve as an explicit "stop here" marker, typically placed as the last Action in a rule so that once this rule has fired, nothing further down the list also acts on the same message.
• Add Recipient to Message - Silently adds one or more additional recipients (comma- or line-separated) to the message's existing recipient list, similar to a BCC. The message is reprocessed so the newly added recipients actually receive delivery of the same original message. Example: adding compliance@example.com as an extra recipient on any outbound message matching a sensitive-content rule, so compliance automatically receives the message itself.
• Send Copy to Recipients - Unlike Add Recipient to Message, which modifies the original message's own recipient list, this creates an entirely separate, cloned copy of the message -- with a new Message-ID and its DKIM/authentication-related headers stripped -- and delivers that copy to the address(es) you specify, leaving the original message and its original recipients untouched. Example: sending a silent copy of specific outbound mail to an archive mailbox without altering who the original message was actually addressed to.
• Show a Notification - Creates a SmarterMail system notification -- the same kind of alert visible to system administrators within the SmarterMail interface -- containing the subject and body you configure. It does not email anyone; it only raises an internal, admin-facing alert. Example: flagging system administrators whenever an unusually large volume of mail matches a rule's Conditions, without generating any additional email traffic.
• Send Email - Sends a brand-new, separate alert email (distinct from the message that triggered the rule) to whatever From/To addresses and Subject/Body content you configure in the action itself. Example: emailing helpdesk@example.com any time a message trips a rule watching for a specific malicious attachment type, so IT is alerted immediately.
• Send Webhook - Sends an HTTP request (method configurable as POST, GET, PUT, or DELETE) to an administrator-supplied URL, with optional custom headers and a JSON payload. If you don't provide a custom payload, SmarterMail sends a default JSON body containing the message's spool ID, sender, recipient list, and a timestamp, making it possible to feed routing rule events into external monitoring, ticketing, or SIEM systems. Example: posting to an internal Slack or Teams incoming-webhook URL whenever a rule matching a specific spam pattern fires.

Action Variables

All Actions that have the ability to use variables have the same variables available to them. These are:

• Day of Week - #dayofweek#
• Time of Day - #timeofday#
• Date - #date#
• Spool ID - #spoolid#
• Message File Path - #messagefilepath#
• Return Path - #returnpath#
• Originating IP Address - #fromipaddress#
• Recipients - #recipients#
• Subject - #subject#
• From Address - #fromaddress#

These variables can be combined freely within a single Action. For example, an Add Header action could use a value like "X-Rule-Info: Message from #fromaddress# received #dayofweek# at #timeofday# (spool ID #spoolid#)" to embed several pieces of context about the message directly into a custom header for later troubleshooting.