Message sender email addresses and domains go through approved sender and blocked sender list filtering. Sender email addresses are evaluated until the first match is found.
Messages from allowed sender addresses bypass IP reputation-based filtering at the MTA connection level and content-based filtering at the message level for spam detection, and proceed directly to malware detection. Messages from blocked email addresses are blocked.
Evaluation is done in the following order:
End User Quarantine console blocked sender list
Administrator console blocked sender list
End User Quarantine console approved sender list
Administrator console approved sender list
Approved senders added to the End User Quarantine console will not override blocked senders for the same email address or domain in the administrator console. For example, assume that *@example.com is in the blocked sender list of the administrator console, and email@example.com is in the approved sender list in the End User Quarantine console for an end user. Messages from firstname.lastname@example.org will still be blocked.