Ironport : difference between message filters and content filters

Message Filters and Content Filters use the same scripting language and regular-expression matching. Content Filters support a subset of the rules and actions used by Message Filters. Content Filters include all the rules and actions needed to identify and act upon the content of a message, and are very easy to configure in the GUI. Message Filters are more flexible, and give access to the meta-data of a message, such as the receiving listener, the sender IP, the SenderBase reputation score of the sender, the number of recipients in the message, the size of the message or attachments, etc.  (A subset of the meta-data is available in Content Filters as well.)

Message Filters are applied as the first Policy processing step in the IronPort email pipeline.  When a Message Filter is applied, its actions apply to all recipients of the message (i.e. if the action is Drop, then no recipient will receive the message, even if the rule which matched the message matched only one recipient.)

Content Filters are applied as the last Policy processing step in the email pipeline – after messages have been ‘splintered’ into separate copies depending on the Mail Policies (and therefore different recipient groups) defined in your configuration.  Because of this, Content Filters can be applied to a more finely-grained grouping of senders or recipients. If you are performing an action on all recipients, it is therefore more efficient to do so in a Message Filter before message splintering takes place. This is especially true in the case of content scanning (body-contains or attachment-contains rule), or if the action is to drop or bounce a message, which would then avoid anti-spam and anti-virus scanning on a message destined for non-delivery.