Does Prevent make any modifications to the original email before passing the message back to the MTA?
Symantec Data Loss Prevention
If no violation is detected, the original message remains intact and is passed through to the MTA. However, if there is a violation, Symantec DLP creates a modified message stream and resends for modification or block rules where there is a redirect address in the response rule. Some customers may want a pass-thru header inserted to avoid double-detection in the case of a downstream monitor. In this instance, any email signatures will still pass along with the message.
NOTE: Prevent does not change the message, only the header and SMTP envelope.