Google Message Security for Google Apps Administration Guide - Manual (Page 203)

Content Manager 203
When Content Filters Apply
The message security service applies Inbound Content Manager filters after
Connection Manager (attack blocking), but before Sender Lists, Junk Filters, Virus
Blocking, and Attachment Manager. As a result:
• Messages with approved content are not filtered as spam.
If a message is captured by a content filter or compliance policy with a
disposition of Approve, it bypasses the Junk Filters, even if it contains spam-
like content.
• Approved senders can optionally bypass content filters.
If you configure Inbound Content Manager to allow all email from
organization-level approved senders, your message security service delivers
any messages from these senders, even if their messages contain content
that a content filter would otherwise bounce or quarantine. Messages from
senders that are on only an individual user’s approved senders list cannot
bypass content filters.
• Content Manager approved or quarantined messages are scanned for
viruses.
A message infected with a virus, or that contains an attachment prohibited by
an attachment filter, isn’t delivered to users, even if it contains approved
content.
How Content Manager Scans Email Messages
Message Components Scanned
When your create a custom content filter, you can choose to scan specific parts of
an email message, including the headers, subject line, sender, recipient, or body.
You can also choose to scan all parts of a message—that is, the entire
message—including any unencrypted attachments. If you set up a compliance
policy, Content Manager always scans all parts of a message, including any
unencrypted binary attachments.