Google Message Security for Google Apps Administration Guide - Manual (Page 410)

410 Message Security for Google Apps Administration Guide
X-pstn-nxpr and X-pstn-nxp Header Fields
When messages are delivered to Google Gmail, these header fields are added,
and display information similar to the following:
X-pstn-nxpr: disp=neutral, envrcpt=address
X-pstn-nxp: bodyHash=e7a578306639faf47072571274493f2ce89341bc
These header fields refer to only internal information.
Attachment Manager and Content Manager Header Fields
Attachment Manager and Content Manager add header fields when they
quarantine an email message.
Note that if you set Attachment Manager or Content Manager to block or
blackhole messages, these fields are not added.
Attachment Manager Header Fields
If Attachment Manager quarantines a message, the message does not have
normal spam header fields. Instead, there is only one header field:
X-pstn-disposition: quarantine
If the sender appears on the organization-based Approved Senders list, the
message containing the attachment is passed on to the recipient inbox. The
header field looks like this:
X-pstn-attach-addresses: from sender@address.com (approved)
Attachment Manager does not evaluate the user's Approved Senders list.
X-CM Header
If a Content Manager filter is triggered, the following line appears in the header:
X-CM: (name of triggered Content Manager filter)
For example:
X-CM: ConfidentialBilling
You create filter names when you create or edit filters in Content Manager.
Analyzing Header Fields
Following are the header fields in an example message: