diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4566ffa5..bbf6153b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 ## Fixed
 - DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
 - TLS: Update search index when file-backed certificates are refreshed.
+- JMAP: `Principal/query` returns broad results when a `name` or `email` filter cannot be resolved.
 
 ## [0.16.10] - 2026-06-21
 
diff --git a/crates/jmap/src/principal/query.rs b/crates/jmap/src/principal/query.rs
index 81172176..e38de82d 100644
--- a/crates/jmap/src/principal/query.rs
+++ b/crates/jmap/src/principal/query.rs
@@ -62,11 +62,14 @@ impl PrincipalQuery for Server {
             match cond {
                 Filter::Property(cond) => match cond {
                     PrincipalFilter::Name(name) | PrincipalFilter::Email(name) => {
-                        if let Some(account_id) = self.account_id_from_email(&name, false).await? {
-                            filters.push(SearchFilter::is_in_set(
-                                RoaringBitmap::from_sorted_iter([account_id]).unwrap(),
-                            ));
-                        }
+                        filters.push(SearchFilter::is_in_set(
+                            match self.account_id_from_email(&name, false).await? {
+                                Some(account_id) => {
+                                    RoaringBitmap::from_sorted_iter([account_id]).unwrap()
+                                }
+                                None => RoaringBitmap::new(),
+                            },
+                        ));
                     }
                     PrincipalFilter::AccountIds(ids) => {
                         filters.push(SearchFilter::is_in_set(