Zero trust for inbound email: where to start

Apply zero trust principles to email by verifying every sender, link, and attachment.

Verify identity each hop

Enforce SPF/DKIM alignment and mutual TLS where supported. Treat consumer mail differently from business partners.

• Use per-tenant policies for B2B partners.
• Quarantine unsigned messages claiming your brand.
• Score messages based on identity strength.

Inspect every element

Combine static analysis with behavior: link age, domain reputation, attachment type, and user history.

• Block macros and executable attachments by default.
• Detonate unfamiliar file types before delivery.
• Apply stricter rules to finance and HR groups.

Assume compromise

Monitor lateral movement and internal phish. Alert when OAuth tokens are granted to unknown apps or when forwarding rules change.

• Log and block auto-forwarding to personal mail.
• Require MFA and step-up verification for risky actions.
• Respond with automated rule clean-up on detection.