What you describe is a e-mail content filter and not DLP. DLP is much wider approach, extremely expensive and because of that currently the first class buzzword of security salesmen. In contrast to that content filtering can be configured on various MTAs and you get it for free in most cases. Here is an example for Postfix.
E-mail content filtering does not depend on your network encryption, because it is done on the MTA. It works with IPsec encrypted internal networks and with L2TP encrypted external networks. But it requires that the mails are not encrypted.
If your user sends encrypted messages you have in general no chance to intercept the communication. This is one reason why some companies permit sending encrypted mails or encrypted attachments like encrypted ZIP files. Another reason is that it is not possible to perform virus checks on encrypted mails.
But there are solutions available to solve this problem. The first solution works with a master key, which gives the MTA a way to decrypt the encrypted e-mails. And the second is an encryption gateway, which does the encryption for the user, which means that the user does not need to encrypt and therefor is not allowed to encrypt.