When creating a content filtering policy condition on the "Content Filtering Policy Condition" configuration page on a Symantec Messaging Gateway appliance that has "Text in this specific part of the message" with "Body" as the message part and "matches exactly" as the condition with some specific text or a regular expression, it is important to note that this policy will try to match the entire message body against the provided text or regular expression. This policy will trigger only when the entire message body matches the text or regular expression exactly. If the message body differs even slightly, this compliance policy will not trigger.
This configuration page is available here: Content->Policies->Email, click on a policy name to edit that policy, under the "Conditions" section, select an existing condition and click "Edit". Or, if no existing conditions are available (if this is a new condition for a new policy, for example), then click on "Add". The configuration section is called "Text in this specific part of the message" on the "Content Filtering Policy Condition" page. The condition has "matches exactly" on its drop-down list.
This behavior is by design. Here is the explanation from the on-line Help or the "Administration Guide" document for a Symantec Messaging Gateway appliance. The important parts of this explanation are highlighted in bold below:
"...The policy condition applies one of the following rules to the specified message part and uses it to match the word, expression, or pattern that you specify:
Regular expressions are designed to match on a line-by-line basis when configured to match against a message header. But they only match against the entire body text when configured to match against the message body or attachments."