How emails are scanned

MSME scans an email differently based-on whether it is an inbound, outbound, or internal email.

Each time an email message is sent to or received from a source, MSME scans it comparing it with a list of known viruses and suspected virus-like behavior. MSME can also scan for content within the email message using rules and policies defined within the software.

When MSME receives an email, it scans in this order:

  1. IP address, spam or phish
  2. Corrupt or encrypted content
  3. File filter
  4. Content scanning (DLP and Compliance)
  5. Anti-virus
  6. Mail URL reputation

Even though emails are scanned in this order, if an item is detected first by the file filtering scanner, it will still be scanned for anti-virus before being quarantined.

Note: Detecting an email based on the source IP address is possible when you enable the IP reputation feature in MSME. This feature is available when you install the McAfee Anti-Spam component.