Cloudflare Email Service vs Zoho CPaaS (formerly ZeptoMail)

Cloudflare Email Service

Cloudflare API tokens can be limited to sending, given an expiry and restricted by IP address, and a public OpenAPI file covers 29 Email Sending operations. Sending is still in beta, with no SLA, no idempotency key and no published daily quota, and it needs a domain on Cloudflare DNS and the Workers Paid plan.

Zoho CPaaS (formerly ZeptoMail)

A public OpenAPI 3.0 file covers all 42 operations, and each Agent has its own send-only key. Email costs $2.50 per 10,000 with the first credit free. No API rate limit, 429 handling, idempotency key or SLA was found in the reviewed documentation, and new accounts wait for a manual review.

Cloudflare Email Service

1. POST to https://api.cloudflare.com/client/v4/accounts/{account_id}/email/sending/send with Authorization: Bearer <token>. The body needs to, from, subject and one of html or text
2. Don't retry a timed-out send blindly. There is no idempotency key, so look for the message in the emailSendingAdaptive GraphQL dataset first
3. On 429 (code 10004) wait for the retry-after header. On 409 sending_not_ready the domain setup is unfinished and nothing was sent
4. Read result.delivered, result.queued and result.permanent_bounces in the response. A 200 does not mean every recipient was accepted
5. Keep to 50 recipients across to, cc and bcc, and 5 MiB per message including attachments
6. For SMTP use smtp.mx.cloudflare.net on port 465 with implicit TLS, username api_token and the API token as password. Port 587 is not supported
7. By default one suppressed recipient fails the whole send. Turn on Drop suppressed recipients for the domain to send to the rest

Zoho CPaaS (formerly ZeptoMail)

1. Call the base URL for the account's region (cpaas.zoho.com, .eu, .in, .com.au, .jp or .com.cn). A key from one region fails on another
2. Send with Authorization: Zoho-enczapikey <key>. Logs, domains, templates, agents and suppressions need a Zoho OAuth token as Authorization: Zoho-oauthtoken <token>
3. Post OAuth client secrets and refresh tokens in the request body, not the query string the guide shows, so they stay out of logs
4. Don't retry a timed-out send blindly. There is no idempotency key, so look the message up by client_reference in the email logs first
5. Count one email per recipient, including cc and bcc, and keep each address field to 500 entries and each attachment to 15 MB
6. Use a sandbox Agent for tests. It accepts up to 10,000 emails a day and sends none of them