Email is becoming the universal interface for AI agents, but an ingested message contains un- trusted, malicious data the agent may execute as instructions. The indirect prompt-injection failure underlies real-world incidents such as EchoLeak (M365 Copilot, CVE-2025-32711) and the Gemini-in-Gmail hidden-HTML hijack. We present e2a, a deployable, open-source authenticated-email gateway that gives an agent a verified email identity and exposes two agent- agnostic defense hook points. The (G)ateway authenticates senders via SPF/DKIM/DMARC and parses MIME structure; the (L)LM-layer screens the normalized prompt for injection. On top of the gateway, we construct a bench- mark that isolates email structure as the first- class injection surface: one payload rendered across eight transport surfaces. We measure the per-surface evasion delta for open-source classifiers, three commercial security APIs, and frontier LLM judges. We find that structural hiding defeats detection. A naive text/plain- first parse costs every detector substantial AUC, dropping most classifiers below chance, and even on the gateway’s structure-aware view no non-LLM detector survives. A frontier LLM judge on the same view recovers most of the loss, and conditioning the threshold on crypto- graphic sender authentication (DMARC) lifts held-out recall further. No single layer suf- fices. e2a is live and open-source (Apache-2.0) at https://e2a.dev, released with the bench- mark and harness.