This article explains the order in which Symantec Email Security.cloud scans inbound email.

Email traffic entering the Symantec.cloud infrastructure is checked and scanned in the following order:

Note: The AntiSpam scanning order will be most effective when enabled according to the AntiSpam best practice settings. When not following best practices, weaker actions such as ''Log Only' will mean that any scanner further down the order will potentially be triggered and their action taken. This is to ensure your protection from harmful or malicious phishing emails.

Stronger actions chosen in the setting configuration for these services like block and delete, redirect, or quarantine will stop scans that are later in the scanning order from happening because the email has already been prevented from delivering to the original recipient. For example, an Anti-Malware conviction will either block or quarantine an email. So data protection scans which are later in the scanning order will not be applied to the anti-malware actioned email.

* requires ETDR (ETDR stands for Email Threat Detection and Response, previously known as ATP Advanced Threat Protection.)