Cloudflare Email Service vs MailPace

Cloudflare Email Service 89

Cloudflare's public OpenAPI 3.0.3 file, re-read on 1 November, still has 29 operations under /email/sending and 46 under /email/routing (25). llms.txt for the product and a Markdown copy of every docs page (10). Operation descriptions state the purpose and the guides say when to pick REST, the binding or SMTP, with little on when not to call an operation (14 of 20). Address fields are typed as a string, a named object or an array, attachments use a discriminator on disposition, and error messages are enums. Custom headers are a free map (12 of 15). Request samples in curl, TypeScript, Python, Go and Terraform, a table of 15 REST error codes (10207, sending paused for the account, added since 8 October) and 20 binding codes. The guide's sample response omits message_id and suppressed_recipients, and its error table omits the 409 the OpenAPI file documents (13 of 15). Version in the path (/client/v4) and a dated product changelog with RSS (15).

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

Cloudflare Email Service 79

Cloudflare API tokens are revocable and scoped by permission, with separate send and read permissions, an optional expiry and an IP address filter. A send token covers every onboarded domain on the account, and the OpenAPI operation also accepts the legacy global API key (27 of 30). A read-only permission exists, and a Workers binding can be limited to named sender or destination addresses. Accounts without a sending domain can reach only verified addresses. No approval step for sends or deletes (14 of 20). Sending returns no untrusted content, but Email Routing hands inbound mail to Worker code and the docs suggest email as a way to drive agents, with no prompt-injection guidance found (6 of 15). Account audit logs record domain and suppression changes for 18 months, and each send is visible in the activity log and GraphQL datasets for about 30 days (14 of 15). security.txt, re-read on 1 November, names HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), ISO 27018 and ISO 27701, with a scope of the Cloudflare global cloud platform, which doesn't name Email Service. 2 held back for the missing Expires field, which RFC 9116 requires, as cloudflare-r2, cloudflare-workers-ai and cloudflare-sandbox-sdk read the same evidence (18 of 20, 16 before, when certifications went unread). 27 + 14 + 6 + 14 + 18 = 79.

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

Cloudflare Email Service 53

Graded on the hosted Email Sending REST API with the hosted lines. www.cloudflarestatus.com is a Statuspage with Email Sending and Email Routing as separate components, both operational on 1 November (20). The incidents feed read on 8 October held 50 incidents from 19 September to 8 October 2026, and the feed read on 1 November holds 50 from 16 to 31 October. Neither names either email component. The labelled majors since 16 October are regional or limited to one product (network connectivity in North America on 23 October, customers behind an external vendor firewall on 27 October, R2 and Durable Objects on 21 October), so they read as partial. The history page loads by script, so 3 August to 18 September and 9 to 15 October went unread. 12 of 30 (10 before), as cloudflare-r2, cloudflare-mcp and cloudflare-workers-ai read the same page with an unread stretch on 1 November. 1,200 API requests per five minutes per token and 200 a second per IP, 50 recipients and 25 MiB per message. The daily sending quota and the send rate limit still have no published number (12 of 15). The send endpoint documents 429 with code 10004, the Cloudflare API returns retry-after and Ratelimit headers, and the SDKs back off. No idempotency key for sends (9 of 15). No SLA found, and the agreement gives no commitment for beta services (0). Email Sending is still marked Beta on the docs home page (updated 15 October), although the OpenAPI send operation is tagged generally-available. We scored from the docs (0). 20 + 12 + 12 + 9 + 0 + 0 = 53.

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.

Cloudflare Email Service 81

Read for a closed service. The newest Email Service changelog entry is still 25 September 2026 (per-domain suppressions), 37 days before 1 November. The cloudflare TypeScript SDK 7.3.0, dated 2 October 2026 in its changelog, adds a per-domain scope (one sending domain or the whole account) to the emailSending.suppressions methods, a change to this service's client, so it sets the line (30). It drops to 20 after 1 November unless a newer Email Service change lands. In the 90 days from 3 August, changelog entries on 4 and 25 September, plus SDK releases counted at half, TypeScript 7.1.0 (17 August), 7.2.0 (25 September) and 7.3.0 (2 October) and Python 5.7.0 (3 September), 5.8.0 (25 September) and 5.9.0 (2 October) (20). A public changelog with RSS, a community forum and a developer Discord. We didn't sample reply times (10 of 15). The cloudflare SDKs for TypeScript, Python and Go are current, Go at v7.13.1 (20 October) by the repository tags (15). The OpenAPI file carries the sending paths. Nothing else to measure for a hosted endpoint (6 of 10). 30 + 20 + 10 + 15 + 6 = 81.

MailPace 65

Email Status API documented on 22 October 2026, and the MCP server rewritten as 2.0.0 on 4 November 2026, two days before this check (30). In the 90 days from 8 August, the Q3 changelog post of 31 August, the Email Status docs of 22 October, a mailpace-rails push on 17 October and the MCP rewrite, but only one changelog post (15 of 20). A closed service with email support. Three pull requests to the MCP repository from 2025 have no reply (8 of 15). Not in the official MCP registry (search for mailpace returned nothing on 6 November). The Node library was last pushed in October 2024 and Go in January 2024, while mailpace-rails is current (7 of 15). The MCP server gained CI with tests on 4 November; the older SDKs weren't checked for CI (5 of 10). Total 65.

Cloudflare Email Service 30

No x402, MPP or L402 on the Email Sending endpoints (0). $0.35 per 1,000 emails after 3,000 a month, and the $5 Workers Paid minimum, are public without a login (20). The only free sending is to the account's own verified destination addresses, on any plan. Arbitrary recipients need the paid plan, and we didn't check whether signup asks for a card (10 of 20). An account, an API token and a domain on Cloudflare DNS are set up by a person in the dashboard (0).

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.