Cloudflare Email Service vs SendLayer

Cloudflare Email Service 79

Cloudflare API tokens are revocable and scoped by permission, with separate send and read permissions, an optional expiry and an IP address filter. A send token covers every onboarded domain on the account, and the OpenAPI operation also accepts the legacy global API key (27 of 30). A read-only permission exists, and a Workers binding can be limited to named sender or destination addresses. Accounts without a sending domain can reach only verified addresses. No approval step for sends or deletes (14 of 20). Sending returns no untrusted content, but Email Routing hands inbound mail to Worker code and the docs suggest email as a way to drive agents, with no prompt-injection guidance found (6 of 15). Account audit logs record domain and suppression changes for 18 months, and each send is visible in the activity log and GraphQL datasets for about 30 days (14 of 15). security.txt, re-read on 1 November, names HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), ISO 27018 and ISO 27701, with a scope of the Cloudflare global cloud platform, which doesn't name Email Service. 2 held back for the missing Expires field, which RFC 9116 requires, as cloudflare-r2, cloudflare-workers-ai and cloudflare-sandbox-sdk read the same evidence (18 of 20, 16 before, when certifications went unread). 27 + 14 + 6 + 14 + 18 = 79.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Cloudflare Email Service 81

Read for a closed service. The newest Email Service changelog entry is still 25 September 2026 (per-domain suppressions), 37 days before 1 November. The cloudflare TypeScript SDK 7.3.0, dated 2 October 2026 in its changelog, adds a per-domain scope (one sending domain or the whole account) to the emailSending.suppressions methods, a change to this service's client, so it sets the line (30). It drops to 20 after 1 November unless a newer Email Service change lands. In the 90 days from 3 August, changelog entries on 4 and 25 September, plus SDK releases counted at half, TypeScript 7.1.0 (17 August), 7.2.0 (25 September) and 7.3.0 (2 October) and Python 5.7.0 (3 September), 5.8.0 (25 September) and 5.9.0 (2 October) (20). A public changelog with RSS, a community forum and a developer Discord. We didn't sample reply times (10 of 15). The cloudflare SDKs for TypeScript, Python and Go are current, Go at v7.13.1 (20 October) by the repository tags (15). The OpenAPI file carries the sending paths. Nothing else to measure for a hosted endpoint (6 of 10). 30 + 20 + 10 + 15 + 6 = 81.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Cloudflare Email Service 77

Closed service under the Self-Serve Subscription Agreement and service-specific terms with an Email Service section updated on 28 September 2026, unchanged on 1 November. The SDKs are Apache-2.0 (18 of 30). The privacy policy of 4 November 2025 (re-read on 1 November) makes Cloudflare a processor of customer content and a DPA is published. The docs give about seven days for message previews, 31 days for send events and 18 months for audit logs. The terms say message content may be scanned by automated tools. No retention period for message content in transit or queued was found (20 of 30). No deprecation policy found. The agreement lets Cloudflare change or end a service without notice and remove a beta service at any time (4 of 20). The sub-processor list, last updated 1 October 2025, names Google and Oracle for the Developer Platform with locations. Where email is processed isn't stated (15 of 20).

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Cloudflare Email Service 89

Cloudflare's public OpenAPI 3.0.3 file, re-read on 1 November, still has 29 operations under /email/sending and 46 under /email/routing (25). llms.txt for the product and a Markdown copy of every docs page (10). Operation descriptions state the purpose and the guides say when to pick REST, the binding or SMTP, with little on when not to call an operation (14 of 20). Address fields are typed as a string, a named object or an array, attachments use a discriminator on disposition, and error messages are enums. Custom headers are a free map (12 of 15). Request samples in curl, TypeScript, Python, Go and Terraform, a table of 15 REST error codes (10207, sending paused for the account, added since 8 October) and 20 binding codes. The guide's sample response omits message_id and suppressed_recipients, and its error table omits the 409 the OpenAPI file documents (13 of 15). Version in the path (/client/v4) and a dated product changelog with RSS (15).

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.

Cloudflare Email Service 72

A send returns a small object grouping recipients into delivered, queued and permanent_bounces. Send events are read through the GraphQL Analytics API, where the caller picks fields (18 of 25). Suppression lists page by cursor with per_page up to 1,000 and filters for email, reason and scope. The GraphQL datasets filter by status, date and domain (17 of 20). REST errors carry a numeric code and a machine-readable message, SMTP returns enhanced status codes with a troubleshooting section, and the binding throws string codes (18 of 20). No idempotency key on send or send_raw. Only the DNS re-apply call is described as idempotent (4 of 20). A send needs to, from, subject and one body field, and Cloudflare publishes SDKs for Node, Python and Go (15).

SendLayer 62

Small responses and five MCP tools (18 of 25). Events filter by start and end date, event type and message ID, with an offset and a count (15 of 20). Errors are JSON with a numbered code and message per field, and documented (14 of 20). No idempotency key on sends, and the MCP annotations can't be read (0 of 20). A send needs from, to, subject, content type and content; official SDKs for Node, Python, PHP, Ruby and Go (15). Total 62.

Cloudflare Email Service 30

No x402, MPP or L402 on the Email Sending endpoints (0). $0.35 per 1,000 emails after 3,000 a month, and the $5 Workers Paid minimum, are public without a login (20). The only free sending is to the account's own verified destination addresses, on any plan. Arbitrary recipients need the paid plan, and we didn't check whether signup asks for a card (10 of 20). An account, an API token and a domain on Cloudflare DNS are set up by a person in the dashboard (0).

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.