RELEVANT VERSIONS: ALL
By default Symantec DLP enables detection on subject lines (or any other RFC2822 message headers). When the "Match On: Envelope" checkbox in the Conditions section of the Edit Rule page for keyword rules is unchecked, Symantec DLP ignores the header portion of each message.
See also:
KB 42551: What is the definition of an Envelope, Body or Attachment for each protocol?