# Cloudflare Email Service vs SendLayer (slim)

> Cloudflare Email Service scores 65.2 (B) to SendLayer's 47.7 (D) for sending email. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cloudflare-email-service-vs-sendlayer.md (~5,250 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/cloudflare-email-service-vs-sendlayer.json · canonical https://www.anchorterminal.com/compare/cloudflare-email-service-vs-sendlayer
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cloudflare Email Service scores 65.2 (B) on agent readiness against SendLayer's 47.7 (D), and leads in every scored category. Both do sending email.

- Cloudflare Email Service: B 65.2, rank #427 of 1510 · https://www.anchorterminal.com/tools/cloudflare-email-service.min.md
- SendLayer: D 47.7, rank #1148 of 1510 · https://www.anchorterminal.com/tools/sendlayer.min.md
- Cloudflare Email Service, good for Teams already on Cloudflare DNS and Workers that want transactional sending and inbound handling in one account at a low unit price. Ahead on Reliability, 53 against 48; Schema & documentation, 89 against 68; Agent ergonomics, 72 against 62; Security & auth, 79 against 38; Payments & pricing, 30 against 20; Maintenance & community, 81 against 40; Transparency & trust, 77 against 49.
- SendLayer, good for Low-volume transactional mail for WordPress and small sites. Also No incidents deducted, where Cloudflare Email Service loses 3 points for them.

| Category | Cloudflare Email Service | SendLayer |
| --- | --- | --- |
| Reliability (16%) | 53 | 48 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 89 | 68 |
| Agent ergonomics (13%) | 72 | 62 |
| Security & auth (14%) | 79 | 38 |
| Payments & pricing (10%) | 30 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 81 | 40 |
| Transparency & trust (7%) | 77 | 49 |

| Fact (where they differ) | Cloudflare Email Service | SendLayer |
| --- | --- | --- |
| Vendor | Cloudflare | SendLayer, LLC |
| Hosted endpoint | `https://api.cloudflare.com/client/v4` | `https://mcp.sendlayer.com` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Pricing | Pay per use | Paid |
| Licence | Proprietary service under Cloudflare's Self-Serve Subscription Agreement and Developer Platform service-specific terms. The official `cloudflare` SDK on npm is Apache-2.0 | none |
| Tools exposed | none | 5 |
| Last release | 2026-09-25 | 2026-08-21 |
| Terms last updated | 2025-09-12 | no date given |
| Terms restrict automated access | yes | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 3.8M npm/wk, 364k PyPI/wk | 113 npm/wk, 9 PyPI/wk |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Security & auth, Cloudflare Email Service +41: Cloudflare Email Service 79 (Cloudflare API tokens are revocable and scoped by permission, with separate send and read permissions, an optional expiry and an IP address filter. A send token covers every onboarded domain on the account, and the OpenAPI operation also accepts the legacy global API key (27 of 30). A read-only permission exists, and a Workers binding can be limited to named sender or destination addresses. Accounts without a sending domain can reach only verified addresses. No approval step for sends or deletes (14 of 20). Sending returns no untrusted content, but Email Routing hands inbound mail to Worker code and the docs suggest email as a way to drive agents, with no prompt-injection guidance found (6 of 15). Account audit logs record domain and suppression changes for 18 months, and each send is visible in the activity log and GraphQL datasets for about 30 days (14 of 15). security.txt, re-read on 1 November, names HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), ISO 27018 and ISO 27701, with a scope of the Cloudflare global cloud platform, which doesn't name Email Service. 2 held back for the missing Expires field, which RFC 9116 requires, as cloudflare-r2, cloudflare-workers-ai and cloudflare-sandbox-sdk read the same evidence (18 of 20, 16 before, when certifications went unread). 27 + 14 + 6 + 14 + 18 = 79.); SendLayer 38 (Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.)
- Maintenance & community, Cloudflare Email Service +41: Cloudflare Email Service 81 (Read for a closed service. The newest Email Service changelog entry is still 25 September 2026 (per-domain suppressions), 37 days before 1 November. The `cloudflare` TypeScript SDK 7.3.0, dated 2 October 2026 in its changelog, adds a per-domain scope (one sending domain or the whole account) to the `emailSending.suppressions` methods, a change to this service's client, so it sets the line (30). It drops to 20 after 1 November unless a newer Email Service change lands. In the 90 days from 3 August, changelog entries on 4 and 25 September, plus SDK releases counted at half, TypeScript 7.1.0 (17 August), 7.2.0 (25 September) and 7.3.0 (2 October) and Python 5.7.0 (3 September), 5.8.0 (25 September) and 5.9.0 (2 October) (20). A public changelog with RSS, a community forum and a developer Discord. We didn't sample reply times (10 of 15). The `cloudflare` SDKs for TypeScript, Python and Go are current, Go at v7.13.1 (20 October) by the repository tags (15). The OpenAPI file carries the sending paths. Nothing else to measure for a hosted endpoint (6 of 10). 30 + 20 + 10 + 15 + 6 = 81.); SendLayer 40 (The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.)
- Transparency & trust, Cloudflare Email Service +28: Cloudflare Email Service 77 (Closed service under the Self-Serve Subscription Agreement and service-specific terms with an Email Service section updated on 28 September 2026, unchanged on 1 November. The SDKs are Apache-2.0 (18 of 30). The privacy policy of 4 November 2025 (re-read on 1 November) makes Cloudflare a processor of customer content and a DPA is published. The docs give about seven days for message previews, 31 days for send events and 18 months for audit logs. The terms say message content may be scanned by automated tools. No retention period for message content in transit or queued was found (20 of 30). No deprecation policy found. The agreement lets Cloudflare change or end a service without notice and remove a beta service at any time (4 of 20). The sub-processor list, last updated 1 October 2025, names Google and Oracle for the Developer Platform with locations. Where email is processed isn't stated (15 of 20).); SendLayer 49 (Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.)
- Schema & documentation, Cloudflare Email Service +21: Cloudflare Email Service 89 (Cloudflare's public OpenAPI 3.0.3 file, re-read on 1 November, still has 29 operations under `/email/sending` and 46 under `/email/routing` (25). llms.txt for the product and a Markdown copy of every docs page (10). Operation descriptions state the purpose and the guides say when to pick REST, the binding or SMTP, with little on when not to call an operation (14 of 20). Address fields are typed as a string, a named object or an array, attachments use a discriminator on `disposition`, and error messages are enums. Custom headers are a free map (12 of 15). Request samples in curl, TypeScript, Python, Go and Terraform, a table of 15 REST error codes (10207, sending paused for the account, added since 8 October) and 20 binding codes. The guide's sample response omits `message_id` and `suppressed_recipients`, and its error table omits the 409 the OpenAPI file documents (13 of 15). Version in the path (`/client/v4`) and a dated product changelog with RSS (15).); SendLayer 68 (OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.)
- Agent ergonomics, Cloudflare Email Service +10: Cloudflare Email Service 72 (A send returns a small object grouping recipients into `delivered`, `queued` and `permanent_bounces`. Send events are read through the GraphQL Analytics API, where the caller picks fields (18 of 25). Suppression lists page by cursor with `per_page` up to 1,000 and filters for email, reason and scope. The GraphQL datasets filter by status, date and domain (17 of 20). REST errors carry a numeric code and a machine-readable message, SMTP returns enhanced status codes with a troubleshooting section, and the binding throws string codes (18 of 20). No idempotency key on send or `send_raw`. Only the DNS re-apply call is described as idempotent (4 of 20). A send needs `to`, `from`, `subject` and one body field, and Cloudflare publishes SDKs for Node, Python and Go (15).); SendLayer 62 (Small responses and five MCP tools (18 of 25). Events filter by start and end date, event type and message ID, with an offset and a count (15 of 20). Errors are JSON with a numbered code and message per field, and documented (14 of 20). No idempotency key on sends, and the MCP annotations can't be read (0 of 20). A send needs from, to, subject, content type and content; official SDKs for Node, Python, PHP, Ruby and Go (15). Total 62.)
- Payments & pricing, Cloudflare Email Service +10: Cloudflare Email Service 30 (No x402, MPP or L402 on the Email Sending endpoints (0). $0.35 per 1,000 emails after 3,000 a month, and the $5 Workers Paid minimum, are public without a login (20). The only free sending is to the account's own verified destination addresses, on any plan. Arbitrary recipients need the paid plan, and we didn't check whether signup asks for a card (10 of 20). An account, an API token and a domain on Cloudflare DNS are set up by a person in the dashboard (0).); SendLayer 20 (No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.)