Cloudflare email
Cloudflare Email Hosting: What's Possible, and How to Do It Right
Search "Cloudflare email hosting" and the striking thing is what's missing: no plan to pick, no price per mailbox, no "Add to cart." Most people read that absence as "Cloudflare doesn't do email." It does — it just hands you the parts and a workbench instead of a finished inbox. That one swap, a little setup in exchange for real ownership, is the whole story of this page.
So "Cloudflare email hosting" is real, but it's a ladder, not a product. At the bottom you forward mail with a few clicks; at the top you run a full encrypted inbox on your own account. This is the orientation map: what each rung gives you, what it costs in effort, and how to pick the one that fits.
What Cloudflare email hosting can and can't mean
It helps to separate the two halves of email.
Receiving is where Cloudflare is strong and free. Email Routing publishes your MX records, catches all mail for a domain, and either forwards it to an existing inbox or hands it to your own code. For a lot of people, that alone solves the problem: custom-domain addresses that quietly forward into the inbox they already use.
Sending is the part Cloudflare doesn't do directly. There's no outgoing mail server you rent. To send — replies, notifications, anything that leaves your domain — you connect a transactional email provider's API and authenticate your domain. That's by design, and it's the same pattern every modern setup uses.
Three ways to do Cloudflare email hosting
Think of it as a ladder. Each rung gives you more ownership and control, at the cost of a bit more setup.
Rung 1: Routing forwards to an inbox you already have
The simplest option. Turn on Email Routing, set a catch-all, and forward everything to your personal Gmail, iCloud, or wherever you read mail. You get professional-looking addresses with almost no effort. The catch: you're still reading mail inside someone else's service, and replies come from your personal address unless you add real sending.
Rung 2: Routing plus Workers for automation
Add Email Workers and your inbox gains a brain. Code runs the moment mail arrives, so you can sort by domain, auto-respond, filter noise, log messages, or trigger notifications. You're no longer just forwarding — you're shaping how mail behaves. This is the sweet spot for tinkerers who want control without building a whole app.
Rung 3: A full self-hosted inbox on your account
The top rung is a complete mail app you deploy to your own Cloudflare account. Routing receives, Workers seal each message, R2 stores the encrypted bodies, D1 keeps the index, a sending API handles replies, and an installed web app is the inbox you read in. This is true hosting-on-Cloudflare: your domains, your data, your key, one inbox for all of it. We walk through the whole assembly in building an email "server" on Cloudflare.
The three rungs, side by side
Same ladder, one view. Each rung adds ownership and capability and asks a little more setup. Pick the lowest rung that does what you need — you can climb higher later without moving your domains.
| Rung | What you get | Setup | Can it send? | Deliverability it needs |
|---|---|---|---|---|
| 1 · Forward-only | Custom addresses that land in an inbox you already read | Minutes — turn on Routing, set a catch-all | No — replies come from your personal address | Just the MX records Routing adds for you |
| 2 · Receive + send via Worker | Automation, sorting, and real replies from the right address | An afternoon — add Email Workers and a provider | Yes — through a provider API | MX, plus SPF, DKIM and DMARC for sending |
| 3 · Full encrypted inbox app | One encrypted inbox for every domain, on your own account | A guided deploy — or a done-for-you install | Yes — a provider API wired into the app | MX, plus SPF, DKIM and DMARC on every sending domain |
Rung one is a forwarding trick that looks professional; rung two is where it becomes yours to shape; rung three is a mailbox you own outright. Notice the deliverability column only grows from rung two onward — the moment you send, SPF, DKIM and DMARC stop being optional.
How to do it right: deliverability
No matter which rung you're on, the thing that separates a setup that works from one that frustrates you is authentication. Send mail from your domain and three DNS records do the heavy lifting:
- SPF declares which services may send on your domain's behalf.
- DKIM signs each message so receivers can verify it's genuine and unaltered.
- DMARC links those checks and tells receivers how to treat failures — and can report attempts to spoof you.
Because your domain already lives on Cloudflare for Routing, these are just a few entries in the same DNS dashboard. Get them wrong and your mail lands in spam; get them right and it's trusted like any established sender. Verify yours with our SPF, DKIM and DMARC checker and the DNS and MX lookup tools.
The records, with real values
Most guides stop at "add SPF, DKIM and DMARC" and leave you at a blank DNS form. Here's the concrete shape for a sample domain, example.com, through a typical provider. Your exact strings differ — Cloudflare and your provider generate them — but every setup has this skeleton:
| Record | Type | Name / host | Sample value |
|---|---|---|---|
| MX | MX | example.com | Three *.mx.cloudflare.net hosts — Cloudflare picks the names and priorities and adds them when Routing turns on |
| SPF | TXT | example.com | v=spf1 include:_spf.provider.com ~all |
| DKIM | TXT / CNAME | key1._domainkey.example.com | v=DKIM1; k=rsa; p=MIGfMA0GCSq… (a long public key) |
| DMARC | TXT | _dmarc.example.com | v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com |
The pattern is the whole lesson: the MX row is the receive side, written for you by Cloudflare; the other three are the send side, filled in from your provider's dashboard. Begin DMARC at p=none to read the reports, then tighten to quarantine once legitimate mail passes.
What it costs, and what you own
This is where Cloudflare's model genuinely differs from mailbox rental. Routing's forwarding is free — no per-seat or per-domain subscription. The full self-hosted route adds only a small Cloudflare bill for the storage and compute it uses, whether you run one domain or forty. Against a traditional hosted suite the trade is clean: a hosted provider hands you a mailbox the instant you sign up, but the meter runs forever, usually per user and often per domain, and you read your mail inside their service on their terms. Cloudflare asks for more setup up front and gives you ownership in return — your data in your account, and a key only you hold if the app encrypts at rest.
A practical way to decide: count your domains and your appetite for setup. One address and no interest in tinkering? Rung one — or a hosted suite — is the path of least resistance. Several domains and a preference for owning your data? The top rung pays off quickly, and because your domains stay on Cloudflare throughout, you can start low and climb without starting over.
The honest limits
Three straight truths. First, Cloudflare alone isn't a complete mailbox — receiving is built in; sending always involves a provider you choose. Second, the full self-hosted route is a build, not a signup — very doable, but assembly, unless you use an app that has already done the assembling. Third, if you encrypt stored mail, there's still a brief plaintext moment when a message first arrives, before it's sealed: zero-access encryption protects data at rest, not the instant of receipt. Knowing these up front is how you pick the right rung.
- Does Cloudflare offer hosted email mailboxes?
- Not in the rent-a-mailbox sense. It offers free Email Routing to receive and forward, plus building blocks (Workers, R2, D1) to assemble a full inbox. Sending uses a provider's API.
- Is Cloudflare Email Routing free?
- Receiving and forwarding through Email Routing is free. A full self-hosted inbox adds a small Cloudflare bill for storage and compute, paid directly to Cloudflare, with no per-domain charge.
- Can I host email for several domains on Cloudflare?
- Yes, and that's a core strength — there's no per-domain fee. Point multiple domains at Routing and, with a self-hosted app, share one inbox across all of them.
- What do I need to get deliverability right?
- SPF, DKIM and DMARC on every sending domain, plus a reputable sending provider. With those in place, your mail is treated as legitimate and authenticated.