Validate at the edge
Check that input is well-formed in the receive pipeline, before it becomes a published message. A bad payload stopped at the door is a single clean rejection; the same payload let onto the bus is a problem every subscriber inherits.
The bus assumes its messages are valid canonical instances. Once a malformed message is published, every subscription picks it up and every downstream map and send port has to cope with data that should never have existed. The cheapest place to catch it is the moment it arrives, against the source schema, while there is still a single party to reject it back to.
Validate structure and the invariants that matter — required fields present, types and formats correct, business keys non-empty — in the receive pipeline. What fails is rejected loudly to a dead-letter channel (never dropped), with enough context to fix and replay. Only clean, canonical messages reach the bus, which is what lets every subscriber downstream trust what it receives.