Google Apps Directory Sync for Postini Services Administration Guide - Manual (Page 10)

Introduction 11
Architecture
Google Apps Directory Sync runs on your server and updates the message
security service to match your LDAP server. The directory sync utility never
updates or changes your LDAP server.
The following steps describe how the data flow of directory sync works.
1. The directory sync utility connects to your LDAP server (via port 389 or
another port you specify) and generates a list of users on your directory. You
can set up rules to specify how this user list is generated.
2. The directory sync utility connects to the message security service (via port
8080 if you are using a proxy server, or otherwise port 443) and generates a
list of registered users in the message security service. You can set up rules
to specify how this user list is generated.