{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "cloudflare-email-service", "name": "Cloudflare Email Service", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/email-service/", "kind": "http-api", "category": "email", "summary": "Cloudflare Email Service sends transactional email through a REST API, a Workers binding or SMTP, and routes inbound mail to Workers or verified addresses. Email Sending is in public beta and needs the Workers Paid plan for arbitrary recipients.", "url": "https://www.anchorterminal.com/tools/cloudflare-email-service", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-email-service.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-email-service.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-email-service.json", "license": "Proprietary service under Cloudflare's Self-Serve Subscription Agreement and Developer Platform service-specific terms. The official `cloudflare` SDK on npm is Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.cloudflare.com/client/v4", "packages": [ { "registry": "npm", "name": "cloudflare" }, { "registry": "pypi", "name": "cloudflare" } ], "auth": "api-key", "authNotes": "A Cloudflare API token as a Bearer header, created by the account owner in the dashboard. The SMTP guide names the permission Email Sending: Edit, and the OpenAPI file lists `com.cloudflare.api.account.email.sending.create` for sends and `.read` for limits and reputation. Tokens can carry an expiry and an IP address filter. The same token is the SMTP password. The OpenAPI file also accepts the legacy global API key. Access is self-serve, but the sending domain must be on Cloudflare DNS and new accounts start with a daily quota that Cloudflare raises over time.", "pricing": "usage", "pricingNotes": "$0.35 per 1,000 outbound emails after 3,000 included a month, on the Workers Paid plan (minimum $5 a month). Sending to arbitrary recipients is not available on Workers Free. Sends to the account's own verified destination addresses are free on every plan, and inbound Email Routing is free and unmetered. Hard bounces count towards the quota. Sends rejected at the API boundary or by the suppression list don't (https://developers.cloudflare.com/email-service/platform/pricing/).", "priceSummary": "$5 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Email Service docs, the pricing page or the Email Sending paths of the OpenAPI file (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 3766696, "pypiWeekly": 363923, "asOf": "2026-10-08" }, "docsUrl": "https://developers.cloudflare.com/email-service/", "llmsTxt": "https://developers.cloudflare.com/email-service/llms.txt", "openapi": "https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.json", "capabilities": [ "email.send", "email.inbound", "email.domains", "email.analytics" ], "tags": [ "hosted", "usage", "beta", "openapi", "llms-txt", "smtp", "typescript", "python", "go", "graphql", "status-page", "bug-bounty" ], "lastRelease": "2026-09-25", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 212, "ranked": true, "rankOf": 722, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 81, "payments": 30, "reliability": 51, "schema": 89, "security": 77, "transparency": 76 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 51, "points": 10.2, "reason": "Graded on the hosted Email Sending REST API with the hosted lines. cloudflarestatus.com is a Statuspage with Email Sending and Email Routing as separate components (20). The incidents feed held 50 incidents from 19 September to 8 October 2026, none naming either email component. The API component had a minor incident of 18 minutes on 7 October and delayed permission changes on 30 September. The history page loads by script, so the rest of the 90 days went unread (10 of 30). 1,200 API requests per five minutes per token and 200 a second per IP, 50 recipients and 5 MiB per message. The daily sending quota and the send rate limit have no published number (12 of 15). The send endpoint documents 429 with code 10004, the Cloudflare API returns `retry-after` and `Ratelimit` headers, and the SDKs back off. No idempotency key for sends (9 of 15). No SLA found, and the agreement gives no commitment for beta services (0). Email Sending is marked Beta in the docs, although the OpenAPI operation is tagged generally-available. We scored from the docs (0)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 89, "points": 14.46, "reason": "Cloudflare's public OpenAPI 3.0.3 file has 29 operations under `/email/sending` and 46 under `/email/routing` (25). llms.txt for the product and a Markdown copy of every docs page (10). Operation descriptions state the purpose and the guides say when to pick REST, the binding or SMTP, with little on when not to call an operation (14 of 20). Address fields are typed as a string, a named object or an array, attachments use a discriminator on `disposition`, and error messages are enums. Custom headers are a free map (12 of 15). Request samples in curl, TypeScript, Python, Go and Terraform, a table of 14 REST error codes and 20 binding codes. The guide's sample response omits `message_id` and `suppressed_recipients`, and its error table omits the 409 the OpenAPI file documents (13 of 15). Version in the path (`/client/v4`) and a dated product changelog with RSS (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "A send returns a small object grouping recipients into delivered, queued and bounced. Send events are read through the GraphQL Analytics API, where the caller picks fields (18 of 25). Suppression lists page by cursor with `per_page` up to 1,000 and filters for email, reason and scope. The GraphQL datasets filter by status, date and domain (17 of 20). REST errors carry a numeric code and a machine-readable message, SMTP returns enhanced status codes with a troubleshooting section, and the binding throws string codes (18 of 20). No idempotency key on send or `send_raw`. Only the DNS re-apply call is described as idempotent (4 of 20). A send needs `to`, `from`, `subject` and one body field, and Cloudflare publishes SDKs for Node, Python and Go (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 77, "points": 13.48, "reason": "Cloudflare API tokens are revocable and scoped by permission, with separate send and read permissions, an optional expiry and an IP address filter. A send token covers every onboarded domain on the account, and the OpenAPI operation also accepts the legacy global API key (27 of 30). A read-only permission exists, and a Workers binding can be limited to named sender or destination addresses. Accounts without a sending domain can reach only verified addresses. No approval step for sends or deletes (14 of 20). Sending returns no untrusted content, but Email Routing hands inbound mail to Worker code and the docs suggest email as a way to drive agents, with no prompt-injection guidance found (6 of 15). Account audit logs record domain and suppression changes for 18 months, and each send is visible in the activity log and GraphQL datasets for about 30 days (14 of 15). security.txt names HackerOne and a disclosure policy with no Expires field. The compliance page lists no certifications without a dashboard login, so none were confirmed (16 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 on the Email Sending endpoints (0). $0.35 per 1,000 emails after 3,000 a month, and the $5 Workers Paid minimum, are public without a login (20). The only free sending is to the account's own verified destination addresses, on any plan. Arbitrary recipients need the paid plan, and we didn't check whether signup asks for a card (10 of 20). An account, an API token and a domain on Cloudflare DNS are set up by a person in the dashboard (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 81, "points": 7.09, "reason": "Read for a closed service. The newest Email Service changelog entry is 25 September 2026, per-domain suppressions (30). Four entries in the last 90 days, on 15 July, 17 July, 4 September and 25 September (20). A public changelog with RSS, a community forum and a developer Discord. We didn't sample reply times (10 of 15). The `cloudflare` SDKs on npm (7.3.0) and PyPI (5.9.0) were both published on 3 October 2026. The Go SDK wasn't checked (15). The OpenAPI file carries the sending paths. Nothing else to measure for a hosted endpoint (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 76, "points": 6.65, "note": "editorial 57, provenance 95", "reason": "Closed service under the Self-Serve Subscription Agreement and service-specific terms with an Email Service section updated on 28 September 2026. The SDKs are Apache-2.0 (18 of 30). The privacy policy of 4 November 2025 makes Cloudflare a processor of customer content and a DPA is published. The docs give about seven days for message previews, 31 days for send events and 18 months for audit logs. The terms say message content may be scanned by automated tools. No retention period for message content in transit or queued was found (20 of 30). No deprecation policy found. The agreement lets Cloudflare change or end a service without notice and remove a beta service at any time (4 of 20). The sub-processor list, last updated 1 October 2025, names Google and Oracle for the Developer Platform with locations. Where email is processed isn't stated (15 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "A send returns a small object grouping recipients into delivered, queued and bounced. Send events are read through the GraphQL Analytics API, where the caller picks fields (18 of 25). Suppression lists page by cursor with `per_page` up to 1,000 and filters for email, reason and scope. The GraphQL datasets filter by status, date and domain (17 of 20). REST errors carry a numeric code and a machine-readable message, SMTP returns enhanced status codes with a troubleshooting section, and the binding throws string codes (18 of 20). No idempotency key on send or `send_raw`. Only the DNS re-apply call is described as idempotent (4 of 20). A send needs `to`, `from`, `subject` and one body field, and Cloudflare publishes SDKs for Node, Python and Go (15).", "maintenance": "Read for a closed service. The newest Email Service changelog entry is 25 September 2026, per-domain suppressions (30). Four entries in the last 90 days, on 15 July, 17 July, 4 September and 25 September (20). A public changelog with RSS, a community forum and a developer Discord. We didn't sample reply times (10 of 15). The `cloudflare` SDKs on npm (7.3.0) and PyPI (5.9.0) were both published on 3 October 2026. The Go SDK wasn't checked (15). The OpenAPI file carries the sending paths. Nothing else to measure for a hosted endpoint (6 of 10).", "payments": "No x402, MPP or L402 on the Email Sending endpoints (0). $0.35 per 1,000 emails after 3,000 a month, and the $5 Workers Paid minimum, are public without a login (20). The only free sending is to the account's own verified destination addresses, on any plan. Arbitrary recipients need the paid plan, and we didn't check whether signup asks for a card (10 of 20). An account, an API token and a domain on Cloudflare DNS are set up by a person in the dashboard (0).", "reliability": "Graded on the hosted Email Sending REST API with the hosted lines. cloudflarestatus.com is a Statuspage with Email Sending and Email Routing as separate components (20). The incidents feed held 50 incidents from 19 September to 8 October 2026, none naming either email component. The API component had a minor incident of 18 minutes on 7 October and delayed permission changes on 30 September. The history page loads by script, so the rest of the 90 days went unread (10 of 30). 1,200 API requests per five minutes per token and 200 a second per IP, 50 recipients and 5 MiB per message. The daily sending quota and the send rate limit have no published number (12 of 15). The send endpoint documents 429 with code 10004, the Cloudflare API returns `retry-after` and `Ratelimit` headers, and the SDKs back off. No idempotency key for sends (9 of 15). No SLA found, and the agreement gives no commitment for beta services (0). Email Sending is marked Beta in the docs, although the OpenAPI operation is tagged generally-available. We scored from the docs (0).", "schema": "Cloudflare's public OpenAPI 3.0.3 file has 29 operations under `/email/sending` and 46 under `/email/routing` (25). llms.txt for the product and a Markdown copy of every docs page (10). Operation descriptions state the purpose and the guides say when to pick REST, the binding or SMTP, with little on when not to call an operation (14 of 20). Address fields are typed as a string, a named object or an array, attachments use a discriminator on `disposition`, and error messages are enums. Custom headers are a free map (12 of 15). Request samples in curl, TypeScript, Python, Go and Terraform, a table of 14 REST error codes and 20 binding codes. The guide's sample response omits `message_id` and `suppressed_recipients`, and its error table omits the 409 the OpenAPI file documents (13 of 15). Version in the path (`/client/v4`) and a dated product changelog with RSS (15).", "security": "Cloudflare API tokens are revocable and scoped by permission, with separate send and read permissions, an optional expiry and an IP address filter. A send token covers every onboarded domain on the account, and the OpenAPI operation also accepts the legacy global API key (27 of 30). A read-only permission exists, and a Workers binding can be limited to named sender or destination addresses. Accounts without a sending domain can reach only verified addresses. No approval step for sends or deletes (14 of 20). Sending returns no untrusted content, but Email Routing hands inbound mail to Worker code and the docs suggest email as a way to drive agents, with no prompt-injection guidance found (6 of 15). Account audit logs record domain and suppression changes for 18 months, and each send is visible in the activity log and GraphQL datasets for about 30 days (14 of 15). security.txt names HackerOne and a disclosure policy with no Expires field. The compliance page lists no certifications without a dashboard login, so none were confirmed (16 of 20).", "transparency": "Closed service under the Self-Serve Subscription Agreement and service-specific terms with an Email Service section updated on 28 September 2026. The SDKs are Apache-2.0 (18 of 30). The privacy policy of 4 November 2025 makes Cloudflare a processor of customer content and a DPA is published. The docs give about seven days for message previews, 31 days for send events and 18 months for audit logs. The terms say message content may be scanned by automated tools. No retention period for message content in transit or queued was found (20 of 30). No deprecation policy found. The agreement lets Cloudflare change or end a service without notice and remove a beta service at any time (4 of 20). The sub-processor list, last updated 1 October 2025, names Google and Oracle for the Developer Platform with locations. Where email is processed isn't stated (15 of 20)." }, "sources": [ { "what": "docs home with the Beta mark", "url": "https://developers.cloudflare.com/email-service/", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://developers.cloudflare.com/email-service/llms.txt", "seen": "2026-10-08" }, { "what": "REST API guide and error codes", "url": "https://developers.cloudflare.com/email-service/api/send-emails/rest-api/", "seen": "2026-10-08" }, { "what": "SMTP guide", "url": "https://developers.cloudflare.com/email-service/api/send-emails/smtp/", "seen": "2026-10-08" }, { "what": "Workers binding and error codes", "url": "https://developers.cloudflare.com/email-service/api/send-emails/workers-api/", "seen": "2026-10-08" }, { "what": "send bindings", "url": "https://developers.cloudflare.com/email-service/configuration/send-bindings/", "seen": "2026-10-08" }, { "what": "getting started", "url": "https://developers.cloudflare.com/email-service/get-started/send-emails/", "seen": "2026-10-08" }, { "what": "limits", "url": "https://developers.cloudflare.com/email-service/platform/limits/", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://developers.cloudflare.com/email-service/platform/pricing/", "seen": "2026-10-08" }, { "what": "Workers pricing", "url": "https://developers.cloudflare.com/workers/platform/pricing/", "seen": "2026-10-08" }, { "what": "FAQ", "url": "https://developers.cloudflare.com/email-service/reference/faq/", "seen": "2026-10-08" }, { "what": "email lifecycle", "url": "https://developers.cloudflare.com/email-service/concepts/email-lifecycle/", "seen": "2026-10-08" }, { "what": "suppression lists", "url": "https://developers.cloudflare.com/email-service/concepts/suppressions/", "seen": "2026-10-08" }, { "what": "email logs", "url": "https://developers.cloudflare.com/email-service/observability/logs/", "seen": "2026-10-08" }, { "what": "metrics and analytics", "url": "https://developers.cloudflare.com/email-service/observability/metrics-analytics/", "seen": "2026-10-08" }, { "what": "audit logs", "url": "https://developers.cloudflare.com/email-service/observability/audit-logs/", "seen": "2026-10-08" }, { "what": "audit log retention", "url": "https://developers.cloudflare.com/fundamentals/account/account-security/review-audit-logs/", "seen": "2026-10-08" }, { "what": "event subscriptions", "url": "https://developers.cloudflare.com/email-service/platform/event-subscriptions/", "seen": "2026-10-08" }, { "what": "Email Sending API reference", "url": "https://developers.cloudflare.com/api/resources/email_sending/", "seen": "2026-10-08" }, { "what": "send operation reference", "url": "https://developers.cloudflare.com/api/resources/email_sending/methods/send/", "seen": "2026-10-08" }, { "what": "OpenAPI file", "url": "https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.json", "seen": "2026-10-08" }, { "what": "Cloudflare API rate limits and headers", "url": "https://developers.cloudflare.com/fundamentals/api/reference/limits/", "seen": "2026-10-08" }, { "what": "token expiry and IP filtering", "url": "https://developers.cloudflare.com/fundamentals/api/how-to/restrict-tokens/", "seen": "2026-10-08" }, { "what": "token permissions reference", "url": "https://developers.cloudflare.com/fundamentals/api/reference/permissions/", "seen": "2026-10-08" }, { "what": "Email Service changelog", "url": "https://developers.cloudflare.com/changelog/product/email-service/", "seen": "2026-10-08" }, { "what": "Email Service changelog RSS", "url": "https://developers.cloudflare.com/changelog/rss/email-service.xml", "seen": "2026-10-08" }, { "what": "status components", "url": "https://www.cloudflarestatus.com/api/v2/components.json", "seen": "2026-10-08" }, { "what": "status incidents feed", "url": "https://www.cloudflarestatus.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "status history page", "url": "https://www.cloudflarestatus.com/history", "seen": "2026-10-08" }, { "what": "Self-Serve Subscription Agreement", "url": "https://www.cloudflare.com/terms/", "seen": "2026-10-08" }, { "what": "Developer Platform service-specific terms", "url": "https://www.cloudflare.com/service-specific-terms-developer-platform/", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.cloudflare.com/privacypolicy/", "seen": "2026-10-08" }, { "what": "customer DPA", "url": "https://www.cloudflare.com/cloudflare-customer-dpa/", "seen": "2026-10-08" }, { "what": "sub-processors", "url": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/", "seen": "2026-10-08" }, { "what": "compliance resources", "url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.cloudflare.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "npm registry record for cloudflare", "url": "https://registry.npmjs.org/cloudflare", "seen": "2026-10-08" }, { "what": "PyPI record for cloudflare", "url": "https://pypi.org/pypi/cloudflare/json", "seen": "2026-10-08" }, { "what": "RDAP for cloudflare.com", "url": "https://rdap.verisign.com/com/v1/domain/cloudflare.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: status history before 19 September 2026. The history page loads by script and the incidents feed holds only the latest 50 incidents", "unchecked: Cloudflare's certifications. The compliance page lists none without a dashboard login", "unchecked: whether Cloudflare signup or the Workers Free plan asks for a card. The signup flow wasn't run", "unchecked: the Go SDK's current version and whether the SDKs' generated methods cover every sending operation", "The daily sending quota for a new account and the send rate limit have no published number", "Docs and OpenAPI disagree on status. The docs mark Email Sending as Beta, and the OpenAPI send operation is tagged generally-available", "The token permissions reference page has no Email Sending entry. The permission names come from the SMTP guide and the OpenAPI file", "Whether the legacy `/email/sending/suppression` paths in the OpenAPI file, alongside the newer `/suppressions` ones, are due for removal", "Whether Cloudflare's MCP servers, listed separately as cloudflare-mcp, expose Email Sending. Not checked for this listing", "The lead was right about the interfaces and the beta status. Email Routing is part of the same product, so the listing also covers inbound mail" ] }, "negative": 0, "verdict": "Cloudflare API tokens can be limited to sending, given an expiry and restricted by IP address, and a public OpenAPI file covers 29 Email Sending operations. Sending is still in beta, with no SLA, no idempotency key and no published daily quota, and it needs a domain on Cloudflare DNS and the Workers Paid plan.", "bestFor": "Teams already on Cloudflare DNS and Workers that want transactional sending and inbound handling in one account at a low unit price.", "strengths": [ "Public OpenAPI 3.0.3 file with 29 Email Sending and 46 Email Routing operations, plus llms.txt and a Markdown copy of every docs page", "$0.35 per 1,000 emails after 3,000 included a month on Workers Paid. Sends rejected at the API boundary or blocked by the suppression list don't count", "API tokens carry separate send and read permissions, an optional expiry and an IP address filter, and Workers bindings can be limited to named senders and recipients", "The Cloudflare API returns 429 with `retry-after` and `Ratelimit` headers, and the send endpoint has its own throttled error code 10004", "Email Sending and Email Routing are separate components on cloudflarestatus.com, and the changelog has four dated entries since 15 July 2026" ], "weaknesses": [ "Email Sending has been in public beta since 16 April 2026. Cloudflare's terms let it remove a beta service at any time, and no SLA was found", "No idempotency key on `/email/sending/send`, in the docs or the OpenAPI file", "The daily sending quota for new accounts is described as conservative with no number. It can be read per account from `/email/sending/limits`", "The sending domain must use Cloudflare DNS, and sending to arbitrary recipients needs the Workers Paid plan at $5 a month", "A token with the send permission can send from every onboarded domain on the account. No per-domain token scope was found", "No template storage, and the terms and FAQ allow transactional email only" ], "agentNotes": [ "POST to `https://api.cloudflare.com/client/v4/accounts/{account_id}/email/sending/send` with `Authorization: Bearer \u003ctoken\u003e`. The body needs `to`, `from`, `subject` and one of `html` or `text`", "Don't retry a timed-out send blindly. There is no idempotency key, so look for the message in the `emailSendingAdaptive` GraphQL dataset first", "On 429 (code 10004) wait for the `retry-after` header. On 409 `sending_not_ready` the domain setup is unfinished and nothing was sent", "Read `result.delivered`, `result.queued` and `result.permanent_bounces` in the response. A 200 does not mean every recipient was accepted", "Keep to 50 recipients across to, cc and bcc, and 5 MiB per message including attachments", "For SMTP use `smtp.mx.cloudflare.net` on port 465 with implicit TLS, username `api_token` and the API token as password. Port 587 is not supported", "By default one suppressed recipient fails the whole send. Turn on Drop suppressed recipients for the domain to send to the rest" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 72, "maintenance": 81, "payments": 30, "reliability": 51, "schema": 89, "security": 77, "transparency": 57 }, "provenanceScore": 95 }, "connect": { "http": "curl \"https://api.cloudflare.com/client/v4/accounts/{account_id}/email/sending/send\" \\\n --header \"Authorization: Bearer \u003cAPI_TOKEN\u003e\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"to\":\"recipient@example.com\",\"from\":\"welcome@yourdomain.com\",\"subject\":\"Welcome to our service!\",\"html\":\"\u003ch1\u003eWelcome!\u003c/h1\u003e\u003cp\u003eThanks for signing up.\u003c/p\u003e\",\"text\":\"Welcome! Thanks for signing up.\"}'" }, "letme": { "capability": "https://letme.dev/email.send", "tool": "https://letme.dev/cloudflare-email-service" }, "sameCompany": [ "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-mcp", "cloudflare-r2", "cloudflare-clef" ], "notable": [ "Email Sending entered public beta on 16 April 2026 and is still marked Beta on the docs home page, while Email Routing carries no beta mark (https://developers.cloudflare.com/email-service/)", "Three ways to send. A REST call to `/accounts/{account_id}/email/sending/send`, the `send_email` Workers binding, and SMTP on `smtp.mx.cloudflare.net` port 465, added in beta on 8 June 2026 (https://developers.cloudflare.com/email-service/api/send-emails/smtp/)", "The public OpenAPI 3.0.3 file has 29 operations under `/email/sending` and 46 under `/email/routing`. The rendered API reference lists 14 of the sending ones (https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.json)", "New accounts start with a daily quota the docs call conservative, with no number, and can send only to verified destination addresses until a sending domain is onboarded (https://developers.cloudflare.com/email-service/platform/limits/)", "The service-specific terms limit the Email Service to transactional email, say Cloudflare may scan message content for malware, phishing and spam, and say it is not durable storage (https://www.cloudflare.com/service-specific-terms-developer-platform/)", "Delivery events for a sending domain can be published to Cloudflare Queues since 15 July 2026. No HTTP webhook was found (https://developers.cloudflare.com/email-service/platform/event-subscriptions/)", "The npm and PyPI download counts are for Cloudflare's general API SDKs, which cover every Cloudflare product, not Email Service alone" ], "area": "communication", "details": [ { "label": "Status", "value": "Email Sending is in public beta (since 16 April 2026). Email Routing is generally available on Free and Paid plans" }, { "label": "API", "value": "REST under `https://api.cloudflare.com/client/v4`. `POST /accounts/{account_id}/email/sending/send` for structured mail and `/send_raw` for a MIME message, plus suppressions, sending subdomains and their DNS records, limits and reputation. 29 sending operations in the OpenAPI 3.0.3 file" }, { "label": "Workers binding", "value": "`send_email` binding with a `send()` method that returns one `messageId`. A binding can be limited with `destination_address`, `allowed_destination_addresses` or `allowed_sender_addresses`" }, { "label": "SMTP", "value": "`smtp.mx.cloudflare.net` port 465, implicit TLS only, AUTH PLAIN or LOGIN, username `api_token`, password an API token. 50 recipients a session" }, { "label": "Credentials", "value": "Cloudflare API token, account-owned or user-owned, with optional expiry and IP address filter. Send and read are separate permissions" }, { "label": "Limits", "value": "50 recipients per email across to, cc and bcc, 5 MiB per message, 32 attachments, 16 KB of custom headers, 998 characters in a subject. Daily quota per account with no published number. Cloudflare API limit of 1,200 requests per five minutes per token" }, { "label": "Free allowance", "value": "3,000 emails a month included on Workers Paid. Sends to verified destination addresses in the account are free on every plan" }, { "label": "Domains", "value": "The domain must use Cloudflare DNS. Onboarding adds MX, SPF, DKIM and DMARC records, and up to 30 domains per zone can be configured" }, { "label": "Inbound", "value": "Email Routing forwards mail to verified addresses or passes it to a Worker's `email()` handler, which can forward, reply or reject. 200 rules per domain, 25 MiB per inbound message" }, { "label": "Suppressions", "value": "Account-wide or per sending domain since 25 September 2026. Hard bounces suppress for seven days or with no expiry, soft bounces for 24 hours. Bulk import of 1,000 entries, 10 requests a minute" }, { "label": "Logs", "value": "Activity log in the dashboard for up to 30 days, the same events in the GraphQL Analytics API for 31 days, message previews kept about seven days, and account audit logs for configuration changes kept 18 months" }, { "label": "Events", "value": "Delivered, deferred, bounced and rejected events per sending domain go to Cloudflare Queues. No HTTP webhook found" }, { "label": "Templates", "value": "None found" }, { "label": "SDKs", "value": "Cloudflare's general API SDKs for Node (`cloudflare` 7.3.0 on npm, 3 October 2026), Python (`cloudflare` 5.9.0 on PyPI, 3 October 2026) and Go" } ], "unitPrices": [ { "item": "Outbound email", "unit": "1k-emails", "usd": 0.35, "note": "After 3,000 included a month, Workers Paid plan only. Sends to verified destination addresses are free" }, { "item": "Workers Paid plan", "unit": "month", "usd": 5, "note": "Minimum monthly charge for the plan that Email Sending to arbitrary recipients needs" } ], "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": true, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://developers.cloudflare.com/changelog/product/email-service/", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "Terms are the Self-Serve Subscription Agreement, last updated 12 September 2025, which names Cloudflare, Inc. at 101 Townsend St, San Francisco. Its section 5 covers beta services.", "The Developer Platform service-specific terms (https://www.cloudflare.com/service-specific-terms-developer-platform/), last updated 28 September 2026, have their own sections for Cloudflare Email Service and Email Routing and supplement the agreement.", "The privacy policy is effective from 4 November 2025 and makes Cloudflare a data processor for customer content that crosses its network. A customer DPA is at https://www.cloudflare.com/cloudflare-customer-dpa/.", "www.cloudflare.com/.well-known/security.txt, read on 8 October 2026, names HackerOne and a disclosure policy and has no Expires field. It is recorded as valid to match the other Cloudflare listings.", "The REST endpoint is on api.cloudflare.com. The SMTP endpoint is on smtp.mx.cloudflare.net, a different registered domain.", "The status page lists Email Sending and Email Routing as separate components, both operational on 8 October 2026.", "RDAP for cloudflare.com gives a registration date of 2009-02-17." ], "score": 95, "checks": [ { "check": "Legal entity named", "value": "Cloudflare, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "cloudflare.com, registered 2009-02-17 (17 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.cloudflare.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "www.cloudflarestatus.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.cloudflare.com/terms/", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-09-12", "words": 7048, "points": 6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated September 12, 2025", "says": "Last updated 2025-09-12" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement will be governed by the laws of the State of California without regard to conflict of law principles.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…THROUGH THE SERVICES) OR OTHERWISE UNDER THIS AGREEMENT, WHETHER IN CONTRACT, TORT, OR OTHERWISE, IS LIMITED TO THE AMOUNTS YOU HAVE PAID TO CLOUDFLARE TO ACCESS AND USE THE SERVICE IN THE 12 MONTHS PRIOR TO THE CLAIM.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may discontinue, suspend, or remove Beta Services (including any of Customer Content stored as part of the Beta Services) or your access thereto at any time in our sole discretion and may never make them generally available." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Unless otherwise specified, any modifications to this Agreement will take effect at the start of Subscription Term following the notice.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Unless otherwise expressly permitted in writing by Cloudflare, you will not and you have no right to:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Service Level Agreements" } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(e) introduce software or automated agents or scripts into the Services so as to produce multiple accounts, generate automated searches, requests or queries, or to strip or mine data from the Services;", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We also reserve the right to modify or discontinue the Service at any time (including, without limitation, by limiting or discontinuing certain features of the Service) without notice to you.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "THIS AGREEMENT CONTAINS PROVISIONS REQUIRING THAT YOU AGREE TO THE USE OF ARBITRATION TO RESOLVE ANY DISPUTES ARISING UNDER THIS AGREEMENT RATHER THAN A JURY TRIAL OR ANY OTHER COURT PROCEEDINGS, AND TO WAIVE YOUR PARTICIPATION IN CLASS ACTION OF ANY KIND AGAINST CLOUDFLARE." } ], "notes": [ { "date": "2026-10-08", "text": "A customer who lets a third party into the account with an API token or OAuth does so at its own risk, and that party may change or delete account data.", "quote": "You acknowledge that by permitting a third party to access your Cloudflare account, the third party may obtain, modify, or delete your account data and settings." }, { "date": "2026-10-08", "text": "Fees are non-refundable, and a customer who cancels is billed in full for the subscription term in which it cancels.", "quote": "YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM." }, { "date": "2026-10-08", "text": "Cloudflare accepts no liability for harm arising from free or trial versions of the Services.", "quote": "We will have no liability for any harm or damage arising out of or in connection with any Free Services." } ] }, { "kind": "privacy", "url": "https://www.cloudflare.com/privacypolicy/", "state": "read", "readAt": "2026-10-08", "words": 7595, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Customer Account Information: When you register for an account, we collect contact information." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of this policy or as long as needed to fulfill and comply with legal obligations.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Non-personally identifiable, aggregated data may be shared with third parties." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We will not sell or rent your personal information.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Where we rely on your consent to process your personal data, you have the right to withdraw or decline consent at any time." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us at privacyquestions@cloudflare.com.", "says": "privacyquestions@cloudflare.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "The Global CBPR System means the data privacy framework established by the Global CBPR Forum against which data controllers can voluntarily certify and undergo assessment by third-party accountability agents to enable accountable cross-border data flows among participating jurisdictions, and the Global PRP System mean…", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Making Personal Information (such as online identifiers or browsing activity) available to these companies may be considered a “sale” or “sharing” of your Personal Information under the CCPA." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-email-service.json", "live": { "slug": "cloudflare-email-service", "probe": { "target": "https://api.cloudflare.com/client/v4", "method": "get", "lastAt": "2026-10-08T21:53:19.291726976Z", "lastOk": true, "lastStatus": 404, "lastMs": 45, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 41, "p95ms24h": 97, "samples24h": 28, "samples30d": 28, "days": [ { "date": "2026-10-08", "probes": 28, "ok": 28 } ] }, "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-10-08T21:57:45.248579178Z" }, "updatedAt": "2026-10-08T21:57:45.248579178Z" } } }