The Mail Transfer Agent, which is integrated with the Symantec Message Filter Client, receives inbound email. The Client sends the message to the Server for evaluation and scanning. The Symantec Message Filter Server filters messages for classification with a variety of scanning technologies.
The Server scans the message to determine the following conditions:
Symantec Message Filter Conduit connects to Symantec Brightmail Logistics and Operations Center (BLOC) to determine whether updated antispam filters are available. If the filters are available, the Conduit retrieves the updated antispam filters through a secure HTTP file transfer. LiveUpdate connects to Symantec LiveUpdate server to determine whether updated antivirus definitions are available. If the definitions are available, the LiveUpdate retrieves the updated antivirus definitions through a secure HTTP file transfer. After the Conduit and LiveUpdate authenticate the antispam filters and antivirus definitions, they distribute the updated filters and definitions to your servers and notify your servers to begin using the updated filters and definitions.
Figure: How Symantec Message Filter works shows how Symantec Message Filter integrates with your system.