Trend Micro Email Security provides inbound message protection by evaluating email messages in the following order:

1. Connection Filtering - Provides the recipient filter, sender filter, Transport Layer Security (TLS) check, and IP Reputation settings.
2. Domain-based authentication - Provides authentication methods such as Sender IP Match, Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting & Conformance (DMARC) to protect against email spoofing.
3. Virus Scan - Allows you to configure virus policies and scan exceptions.
4. Spam Filtering - Allows you to configure spam policies, high profile users for BEC policies and Time-of-Click Protection settings.
5. Content Filtering - Allows you to configure content filtering policies to take actions on messages based on the conditions matched.
6. Data Loss Prevention - Allows you to create Data Loss Prevention (DLP) policies to manage your incoming email messages containing sensitive data.

In the Trend Micro Email Security web console, the Inbound Message Protection flow is arranged in the same order as above:

For more information, you may refer to Inbound Message Flow.