A method for applying policies to an email message, the method being carried out by an inbound policy module in a protected network and comprising: receiving message metadata of an email message intended to a recipient associated with the protected network without receiving the email message determining, based on the message metadata, whether receiving the email message in the protected network is prohibited by at least one metadata policy of one or more metadata policies; sending a response to block the email message from being forwarded to the protected network if receiving the email message in the protected network is determined to be prohibited by the at least one metadata policy; sending a request for the protected network for scan results data for the email message if receiving the email message in the protected network is determined not to be prohibited by the one or more metadata policies; receiving the scan results data; determining, based on the scan results data, whether receiving the email message in the protected network is prohibited by at least one scan policy of one or more scan policies; sending a particular response to block the email message from being forwarded to the protected network if receiving the email message in the protected network is prohibited by the at least one scan policy; sending a request for the email message if receiving the email message in the protected network is not prohibited by the one or more scan policies; receiving the email message when the email message is requested; and forwarding the email message to a mail server in the protected network, wherein the mail server delivers the email message to an intended recipient of the email message. receiving message metadata of an email message intended to a recipient associated with the protected network without receiving the email message determining, based on the message metadata, whether receiving the email message in the protected network is prohibited by at least one metadata policy of one or more metadata policies; sending a response to block the email message from being forwarded to the protected network if receiving the email message in the protected network is determined to be prohibited by the at least one metadata policy; sending a request for the protected network for scan results data for the email message if receiving the email message in the protected network is determined not to be prohibited by the one or more metadata policies; receiving the scan results data; determining, based on the scan results data, whether receiving the email message in the protected network is prohibited by at least one scan policy of one or more scan policies; sending a particular response to block the email message from being forwarded to the protected network if receiving the email message in the protected network is prohibited by the at least one scan policy; sending a request for the email message if receiving the email message in the protected network is not prohibited by the one or more scan policies; receiving the email message when the email message is requested; and forwarding the email message to a mail server in the protected network, wherein the mail server delivers the email message to an intended recipient of the email message.