Cloudmark Server Edition communicates with the Microsoft Exchange Server through Microsoft's standard Messaging Application Programming Interface (MAPI). It receives notifications when messages arrive, then checks the messages and performs preconfigured actions on messages that are spam, phishing, or viruses.
CSE computes a set of unique "fingerprints" for each message that arrives, then sends the fingerprints to the Cloudmark Service for evaluation. Meanwhile, Exchange continues routing messages, so the regularly flow of delivery is not impeded.
The Cloudmark Service compares the fingerprints of the new message with those of messages already known to be spam or phishing. If a match is found, the new message is considered spam or phishing; otherwise, it is legitimate. Cloudmark notifies CSE of the result.
Depending on how you have configured CSE, it can tag spam messages in the recipients's mailbox or move them to a spam folder.
Users can contest the status of a message by moving it into or out of the spam folder. CSE reports this feedback to the Cloudmark Service, where it is used to re-evaluate how messages with similar fingerprints are filtered. You can re-scan mailboxes manually or on a schedule in order to apply the results of the latest feedback.