When a mail is received, the system first consults the virtual aliases file (found in /etc/hato,mail/virtual), followed by the /etc/aliases file. If no expansion is not found (or the expansion results in the same local user) then we fall back on the Hato system-wide filter, a Scheme script in /etc/hato/filter. This uses the same semantics as the user filters in the next section, except that any result indicating a non-email address string is taken to be a local user rather than a mailbox name.