Before any content rules are applied, the message content goes through a normalization process - mostly this just involves decoding any encoded content,
but it also involves compressing all consecutive white-space characters to a single space character - this is why it's impossible to filter on embedded newlines,
or tabs, in a message - these are normalized into a normal space character (ascii 0x20).
This normalization happens on both the message body and the message headers.
It also applies to attachment content, for those attachments that contain extractable text.
Symantec Messaging Gateway (SMG) 10.7.4
Enhancement request has been taken by the product engineering team.
Initial tentative target is SMG 10.7.6.
Proposed Draft Enhancement: Update the policy engine to enable a new search element "raw header" or "raw content".