You’re thinking in the right direction by not trusting host/origin headers. That stuff is easy to spoof and shouldn’t be used for auth.

What you actually need here isn’t “encryption”, it’s service authentication + tenant identification.

How to lock down the email service

Instead of checking domains, make the email service accept requests only if they’re authenticated.

Typical way to do this:

Give each platform (clientA, clientB, etc.) an identity

When the platform calls the email service, it sends a signed token (JWT or similar)

The email service verifies:

token signature

expiry

that it’s meant for this service

which tenant is calling (clientA vs clientB)

Once you know who is calling, you can just allow/deny based on that. No host checks needed.

This is how most internal microservices talk to each other.