Add KamoMail domain validator to block cross-tenant email addresses

Shipped

April 20, 2026 at 3:21 AM UTC

Author

Kamo

Commit

25340fc

Introduces KamoMailDomainValidator component that checks, at service layer, whether the submitted email domain matches the org's verified default domain when KamoMail is the active provider. Injected into MailboxProvisioningService, AliasService, and SharedMailboxService — called before any provisioning occurs. Returns 403 FORBIDDEN if the domain does not match.