Cloud email message scanning with local policy application in a network environment

At least one machine readable storage medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

• receiving, in a protected network, message metadata of an email message en route to an intended recipient associated with the protected network, wherein the message metadata is to be received without receiving the email message;
• sending a request for scan results data of the email message based on determining that receiving the email message is not prohibited by one or more metadata policies;
• receiving the scan results data without receiving the email message;
• based, at least in part, on the scan results data, sending a response to cause the email message to be forwarded to the protected network;
• and
• receiving the email message in the protected network.

An apparatus in a protected network, comprising:

• at least one processor;
• and
• an inbound policy module including instructions that, when executed by the at least one processor, are to:
• receive, in the protected network, message metadata of an email message en route to an intended recipient associated with the protected network, wherein the message metadata is to be received without receiving the email message;
• send a request for scan results data of the email message based on determining that receiving the email message is not prohibited by one or more metadata policies;
• receive the scan results data without receiving the email message;
• based, at least in part, on the scan results data, send a response to cause the email message to be forwarded to the protected network;
• and
• receive the email message in the protected network.

A method, the method comprising:

• receiving, in a protected network, message metadata of an email message en route to an intended recipient associated with the protected network, wherein the message metadata is to be received without receiving the email message;
• sending a request for scan results data of the email message based on determining that receiving the email message is not prohibited by one or more metadata policies;
• receiving the scan results data without receiving the email message;
• based, at least in part, on the scan results data, sending a response to cause the email message to be forwarded to the protected network;
• and
• receiving the email message in the protected network.

A system, the system comprising:

• first logic, when executed by at least one processor of an email threat server in a cloud network is to:
• receive an email message en route to a protected network;
• send message metadata of the email message to the protected network without sending the email message;
• generate scan results data based on at least one scan of contents of the email message;
• and
• subsequent to receiving a request for the scan results data, send the scan results data to the protected network without sending the email message;
• and
• second logic, when executed by at least one processor in the protected network is to:
• send a response to the email threat server to block the email message from being forwarded to the protected network based on determining that receiving the email message in the protected network is prohibited by at least one of one or more scan policies applied to the scan results data.