The order for email filtering is as follows:
Email is found –
- Is it in one of the sources you picked in the email tab?
- Is it in one of the folders allowed by the email folder filters?
- Does the recipient list contain any of the domains/names you included in the email tab (if applicable)?
- Does it meet the date range criteria from the email tab (if applicable)?
- Does it have nonsearchable attachments (if applicable)?
- Does it have encrypted attachments (if applicable)?
- Does it contain any of the keywords you specified (if you specified any for emails)?
- Is it to be excluded because of dedupe or hash list filtering?