Email Infrastructure & Protocols · Cloudflare Feature Trail

Jun 2026Cloudflare DMARC Management is now generally availableThis post announces the general availability of a redesigned Cloudflare DMARC Management experience. Key technical contributions include: a redesigned reporting experience with source IP address investigation and integration with the Investigate tab for threat intelligence; automated analysis of DMARC, DKIM, SPF, and BIMI records with pass/warning/fail statuses and plain-language recommendations; and an SPF lookup audit to identify and mitigate SPF record lookup limit violations. The post also details the importance of DMARC, SPF, and DKIM for email deliverability and brand protection in light of recent industry enforcement changes by Google, Microsoft, and Yahoo.

Apr 2026Email for agents - Cloudflare Email Service now in public betaThis post announces the public beta of Cloudflare Email Service, specifically highlighting the graduation of Email Sending from private beta. It details the native Workers binding for sending emails directly from Workers, including code examples and mentions of the REST API and SDKs for other platforms. It emphasizes the automatic configuration of SPF, DKIM, and DMARC for improved deliverability. The post also details how Email Sending enhances the Agents SDK by enabling asynchronous replies and secure routing, providing code examples for an `onEmail` hook and agent state persistence. New tooling for agents is introduced: the Cloudflare MCP server, Wrangler CLI email commands, and a Cloudflare Email Service skill. Finally, the open-source Agentic Inbox reference application is presented as a demonstration of building full email clients with agent automations.

Sep 2025Announcing Cloudflare Email Service’s private betaThis post announces the private beta of Cloudflare Email Sending, a new capability allowing transactional emails to be sent directly from Cloudflare Workers. It expands upon the existing Email Routing product to form the new Cloudflare Email Service. Key technical contributions include: a new `Email` binding for secure credential management within Workers, automatic DNS record configuration (SPF, DKIM, DMARC) for deliverability, global low-latency delivery, local emulation via `wrangler`, and observability features for bounce rates and delivery events. It also details integration with external services via REST APIs or SMTP, and support for rich HTML emails using frameworks like React Email. The post also reiterates the capabilities of Email Routing for processing incoming emails with Workers, including AI-powered classification and integration with other services.

Dec 2024The role of email security in reducing user risk amid rising threatsThis post details Cloudflare's evolution in email security, moving beyond traditional SEGs and authentication measures to an integrated, platform-based approach for assessing holistic user risk. It highlights how Cloudflare's email security solution works with its network solutions to provide SOC teams with visibility into who is being targeted, who attackers are impersonating, and what risky behaviors users are performing. Key contributions include: AI-driven predictive models for email security that leverage diverse network data, automated isolation of browser sessions based on content categories, automated blocking of risky websites with custom block pages, and the integration of these signals into a Unified Risk Score. The post also emphasizes the platform's ability to extend protection beyond email into the broader security ecosystem, addressing multi-channel threats and insider threats.

Apr 2024How Cloudflare Cloud Email Security protects against the evolving threat of QR phishingThis post details Cloudflare's strategy for defending against quishing (QR phishing) attacks, a novel threat that circumvents traditional URL-based detection engines. The contribution involves enhancing Cloudflare's cloud email security solution (formerly Area 1) with specialized machine learning and computer vision models. These models are trained to identify, process, and decode obfuscated QR codes embedded within emails. The analysis of decoded QR codes involves deconstructing complex URLs, scanning for malicious attachments and websites, and attempting to decrypt password-protected content. The system continuously updates its databases with new obfuscation techniques and threat data to improve detection accuracy. The post also highlights the use of link reputation models and proactive hunting strategies to identify potential threats before they can inflict harm, providing creative examples of quishing attacks impersonating Microsoft Authenticator and DocuSign.

Mar 2024From .com to .beauty: The evolving threat landscape of unwanted emailThis post analyzes email security trends, focusing on the correlation between Top-Level Domains (TLDs) and the prevalence of spam and malicious emails. It details Cloudflare's findings from 2023, highlighting that recently introduced generic TLDs (gTLDs) and those associated with specific industries like beauty are disproportionately used for malicious purposes. The analysis quantifies the percentage of spam and malicious emails for various TLDs and categorizes them by TLD type (ccTLDs, .com/.net, new gTLDs). It also tracks changes in TLD patterns from the first half to the second half of 2023, noting the rise of certain gTLDs in problematic rankings. The post discusses the historical context of email and domain names, the scale of unwanted emails processed by Cloudflare Email Security, and the evolving tactics of cybercriminals leveraging TLDs for phishing and spam.

Mar 2024Launching email security insights on Cloudflare RadarThis post introduces the new Email Security section on Cloudflare Radar, which provides insights into global email security trends. It details metrics for tracking malicious emails, categorizing threats (attachment, link, impersonation, other), and identifying dangerous TLDs. The data is derived from Cloudflare's Email Routing and Area 1 Security services, which process millions of emails daily. The new section aims to help users understand the state of email security and real-time trends in email-borne threats.

Oct 2023Email Routing subdomain support, new APIs and security protocolsThis post introduces support for Authenticated Received Chain (ARC) and MTA Strict Transport Security (MTA-STS) for Cloudflare Email Routing. ARC preserves email authentication results (SPF, DKIM, DMARC) through intermediaries by adding `Arc-Authentication-Results`, `Arc-Message-Signature`, and `Arc-Seal` headers. MTA-STS is enabled by creating a CNAME record for `_mta-sts` and deploying a Worker to serve a policy file from `mta-sts.example.com/.well-known/mta-sts.txt`. Additionally, new Email Workers APIs allow sending emails from scratch and programmatically processing incoming emails, enhancing the capabilities of the Email Routing service.

Sep 2023See what threats are lurking in your Office 365 with Cloudflare Email Retro ScanIntroduces 'Retro Scan' for Office 365 inboxes, enabling customers to scan historical emails (7-14 days back) for threats missed by existing security tools. This feature leverages Cloudflare's machine learning models for threat detection (Malicious, Suspicious, Spoof, Spam, Bulk). The post details the authorization process (Office 365 permissions, Active Directory access) and the configuration steps (domain selection, identification of other security vendors). It also outlines the analysis of scan results, including threat breakdown by type, top targeted employees, and threat origins. The feature is currently in closed beta, with sign-up via Cloudflare contact or a 'Request Trial' button on the report.

Sep 2023Cloudflare Email Security now works with CrowdStrike Falcon LogScaleThis post details the integration of Cloudflare Email Security with CrowdStrike Falcon LogScale. It outlines the technical steps required to set up webhook alerts from Cloudflare Email Security to ingest detection data into Falcon LogScale, including generating ingest tokens and configuring the SIEM target. It also highlights the provision of a parser and dashboard within Falcon LogScale for analyzing this data.

Mar 2023Cloudflare partners with KnowBe4 to equip organizations with real-time security coaching to avoid phishing attacksThis post details the integration of Cloudflare's Area 1 email security solution with KnowBe4's SecurityCoach. It describes the technical steps required to set up the integration, including creating service accounts and API keys in the Area 1 dashboard and configuring the integration within the KnowBe4 KMSAT console. The post also provides examples of the real-time coaching messages users will receive when a phishing attempt is detected.

Mar 2023How we built DMARC Management using Cloudflare WorkersThis post details the technical implementation of Cloudflare's DMARC Management feature, which leverages Cloudflare Workers and Email Routing to process incoming DMARC reports. It outlines the architecture involving Email Workers for receiving and parsing emails, Workers KV for domain information storage, Workers Analytics Engine for publishing report details to an analytics platform, and R2 object storage for long-term storage of raw reports. The post provides code snippets demonstrating how to extract RUA IDs, fetch account information, parse email content using postal-mime, and store compressed reports in R2.

Mar 2023Stop brand impersonation with Cloudflare DMARC ManagementIntroduced DMARC Management, a new feature that simplifies the configuration and monitoring of DMARC policies. It provides full insight into who is sending emails on behalf of a domain, allows one-click approval of legitimate senders, and enables setting a DMARC policy to reject emails from unapproved clients. The feature processes DMARC aggregated reports, displays email volume trends, and breaks down DMARC, SPF, and DKIM statistics by sending client and IP address. It also integrates with Cloudflare DNS for RUA record configuration and uses Workers and Email Workers for report processing and analytics.

Mar 2023Accelerate building resiliency into systems with Cloudflare WorkersIntroduced a weighted traffic routing module implemented as a Cloudflare Worker to improve the resiliency of email notification systems. This worker sits between internal services and external Email Service Providers (ESPs), dynamically routing emails based on configurable weights. This approach allows for rapid failover between ESPs during outages, maintains sender reputation by ensuring continuous traffic to all configured ESPs, and leverages Workers for automatic scaling and near-instantaneous global deployment upon configuration changes.

Jan 2023API-based email scanningIntroduced API-based onboarding for Microsoft 365 domains to Cloudflare Area 1 email security product, enabling faster deployment and increased flexibility compared to traditional MX record changes. This leverages the Microsoft Graph API to evaluate incoming messages, reducing configuration steps and DNS propagation delays. Future plans include retroactive scanning and hybrid deployment options.

Jan 2023Email Link Isolation: your safety net for the latest phishing attacksThis post announces the General Availability (GA) of Email Link Isolation, a new feature within Cloudflare Area 1. It details how Email Link Isolation works by rewriting suspicious links, presenting an interstitial page to users for increased vigilance, and leveraging Cloudflare Browser Isolation for protection against malware and vulnerabilities when users choose to proceed. The post highlights the feature's integration with Area 1's existing capabilities, its ease of deployment, and the positive feedback received during its beta phase, emphasizing its role as a crucial last layer of defense against sophisticated phishing attacks.

Jan 2023How Cloudflare Area 1 and DLP work together to protect data in emailThis post details how Cloudflare Area 1 Email Security and Cloudflare One Data Loss Prevention (DLP) work together to protect sensitive data within corporate email. It explains how DLP inspects and filters HTTP(s) traffic to corporate email applications like Google Suite and O365, preventing the upload of sensitive information. Area 1's role is highlighted in enforcing TLS standards for partner domains, preventing passive data loss through account takeover prevention (phishing detection), protecting against malicious links via Email Link Isolation, and stopping ransomware by analyzing attachment hashes. The post emphasizes the layered security approach provided by the combination of these products.

Dec 2022Expanding Area 1 email security to the Athenian ProjectThis post details the expansion of the Athenian Project to include Cloudflare's Area 1 email security suite for state and local governments. It highlights how Area 1 provides advanced phishing and ransomware protection, complementing existing web security services offered under the Athenian Project. The post includes a case study of Rowan County, North Carolina, demonstrating the ease of deployment and effectiveness of Area 1 in detecting and blocking malicious emails.

Dec 2022How Cloudflare helps secure the inboxes of democracyThis post details how Cloudflare's Area 1 solution protects political campaigns by analyzing millions of emails and stopping phishing attacks. It highlights specific attack vectors such as domain proximity, suspicious links, and malicious attachments, and explains how Area 1's machine learning models identify these threats. The post emphasizes the ease of deployment for campaigns and the importance of inbound technical controls given the complexity of implementing email hygiene and authentication standards like SPF, DKIM, and DMARC in rapid campaign cycles.

Oct 2022Email Routing leaves BetaThis post announces that Cloudflare Email Routing is leaving beta. New features include public APIs and Terraform support for programmatic management, IPv6 egress for sending emails, enhanced observability with Analytics and Detailed Logs (including bounce messages), integration with Audit Logs for configuration changes, and improved anti-spam measures using IP reputation and RBL lists. Internationalized Domain Names (IDNs) are now supported for email routing.

Sep 2022Click Here! (safely): Automagical Browser Isolation for potentially unsafe links in emailThis post introduces 'Email Link Isolation,' a new capability integrated with Cloudflare Area 1. It addresses the risk of users clicking on potentially unsafe email links by automatically rewriting them to open in a remote, isolated browser. This protects users and organizations from credential theft, malicious downloads, and browser exploits by executing untrusted content away from the user's device and corporate network. The feature leverages Cloudflare's DNS resolver, Gateway classifiers, and Browser Isolation technology.

Sep 2022Cloudflare Area 1 - how the best email security keeps getting betterThis post announces the integration of Cloudflare Area 1 email security into the main Cloudflare dashboard, offering trials and demos. It highlights the product's ability to proactively identify and protect against phishing campaigns by scanning the internet for attacker infrastructure and leveraging machine learning models trained on years of threat intelligence. The post also details how Area 1's threat intelligence is now a signal for Cloudflare Gateway, extending protection beyond email. It introduces Cloudforce One, a team focused on threat research and operations to improve product security and offer threat data to customers. Finally, it announces the integration of the Email Security DNS Wizard into the Email Security stack to help customers configure SPF, DKIM, and DMARC records.

Jun 2022Introducing browser isolation for email links to stop modern phishing threatsThis post marks a significant integration of Cloudflare's Area 1 Security acquisition into the broader Cloudflare One platform. It introduces Remote Browser Isolation (RBI) specifically for email links, a new capability that enhances email security by executing suspicious links in an isolated browser. This directly addresses the challenge of modern phishing attacks that bypass traditional security controls, especially deferred and multi-channel campaigns, by accepting human error as a factor and providing a robust, post-delivery protection layer.

Jun 2022Area 1 threat indicators now available in Cloudflare Zero TrustThis post details the integration of Area 1's threat indicator data into Cloudflare's Zero Trust suite, specifically enhancing phishing detection capabilities within Gateway and Page Shield. It highlights how the combined threat intelligence from both Area 1 and Cloudflare's existing pipelines creates a more robust dataset for identifying and blocking phishing threats, leveraging Area 1's adversary-focused research and web crawling tools.

May 2022Send email using Workers with MailChannelsThis post introduces a partnership with MailChannels to enable sending emails directly from Cloudflare Workers without domain validation or separate accounts, offering a free tier for this service. It also details a Pages Plugin Framework for forms to email users without exposing their addresses. The integration requires requests to originate from a Cloudflare IP address.

May 2022Route to Workers, automate your email processingIntroduces 'Route to Workers' for Cloudflare Email Routing, allowing Cloudflare Workers to process incoming emails. This feature provides an `email` event handler in Workers, exposing sender, recipient, headers, and raw body. It enables custom logic for filtering, tagging, alerting (e.g., to Slack), and forwarding emails. The post also highlights starter templates for common use cases and the integration with the existing Email Routing dashboard for easy creation and management of email-processing Workers.

Apr 2022Email Routing InsightsIntroduced a new 'Overview' page for Email Routing, providing users with visibility into routing status, DNS configuration, custom/destination address counts, and detailed metrics (forwarded, dropped, rejected emails). Added an Activity Log with filtering capabilities for message ID, sender, custom address, and action, including SPF, DMARC, and DKIM status for each message.

Mar 2022Democratizing email security: protecting individuals and businesses of all sizes from phishing and malware attacksThis post announces the planned acquisition of Area 1 and the subsequent integration of its email security technology into Cloudflare's offerings. It details the planned 'one-click deployment' for email security records (MX, SPF, DKIM, DMARC) for customers already managing DNS with Cloudflare. It also outlines the integration of this email security solution with other Zero Trust products like Gateway and Remote Browser Isolation, and the enhancement of threat intelligence by connecting data sources between Area 1 and Cloudflare. For Microsoft Office 365 customers, deeper integration and post-delivery message redaction capabilities are mentioned.

Feb 2022Why we are acquiring Area 1This post announces the acquisition of Area 1 Security, a company specializing in cloud-native email security. The integration of Area 1's technology with Cloudflare's global network aims to provide a complete Zero Trust security platform. The post details the rationale behind focusing on email security, highlighting its importance as a threat vector and the limitations of existing solutions. It also describes Cloudflare's internal use of Area 1's technology to protect employees from phishing attempts, demonstrating its effectiveness in reducing reported phishing emails. The acquisition is positioned as a significant step in enhancing Cloudflare's security offerings by combining email threat data with Cloudflare's network threat data.

Feb 2022Email Routing is now in open beta, available to everyoneThis post announces the open beta of Cloudflare Email Routing, making it available to all users without a waitlist. It highlights the journey from closed beta, the adoption by hundreds of thousands of zones, and the ongoing efforts to address known limitations. The core functionality of creating custom email addresses for domains without managing mailboxes remains the same, but the availability is now universal.

Jan 2022Migrating to Cloudflare Email RoutingThis post announces the global availability of Cloudflare Email Routing, a free service for custom domain email forwarding. It details the migration path for users of the G Suite legacy free edition, highlights the service's privacy-first, secure, and scalable design, and provides a step-by-step tutorial for configuration. It also explains how to leverage Gmail's address conventions (plus addressing and dot ignoring) with Email Routing's catch-all feature. Future plans include improved metrics and advanced routing options.

Oct 2021Cloudflare and the IETFThis post details Cloudflare's active participation in the IETF and its contributions to the evolution of core internet protocols. It highlights how Cloudflare works to improve performance, security, privacy, and availability through standardization efforts, providing examples of incremental innovations (DoH, ECH, ODoH, MASQUE) and architectural advancements (QUIC, HTTP/3). The post emphasizes Cloudflare's commitment to building a better internet by developing, advocating, and advancing open standards.

Oct 2021Exported Authenticators: The long road to RFCThis post introduces Exported Authenticators (EAs), a new TLS extension that significantly enhances application-layer authentication. It explains how EAs allow for stronger authentication than traditional TLS, enabling features like multiple certificates per connection and passwordless logins. The post details the design and standardization process of EAs within the IETF, highlighting their close adherence to TLS 1.3 design principles and the importance of channel binding for security. This represents a significant advancement in securing web communications beyond basic TLS.

Sep 2021Easily creating and routing email addresses with Cloudflare Email RoutingThis post introduces Cloudflare Email Routing, a new service that simplifies the creation and management of email addresses for custom domains. It allows users to create any number of email addresses that are redirected to an existing mailbox. The service acts as a transport layer router, preserving original headers and message bodies to maintain email security protocols. It operates in real-time without storing or queuing emails. The configuration process involves adding a domain to Cloudflare DNS, selecting the desired email address, and validating the destination email. The post also mentions upcoming features and encourages community feedback.

Sep 2021Tackling Email Spoofing and PhishingThis post introduces the Email Security DNS Wizard, a new tool designed to simplify the configuration of SPF, DKIM, and DMARC records. It explains the concepts behind email spoofing and phishing, detailing how SPF, DKIM, and DMARC work to authenticate email senders and prevent malicious use of domains. The wizard aims to guide users through the process of creating these essential DNS records, thereby improving email deliverability and enhancing security.

Mar 2021Sophisticated Microsoft Spoof Targets Financial DepartmentsThis post details a sophisticated Microsoft Office 365 credential harvesting campaign that targeted financial departments and executives. It highlights the advanced techniques used by attackers, including spoofing Microsoft-themed domains, using PDF/HTM/HTML attachments, and leveraging advanced phishing kits to bypass email authentication and Microsoft's native defenses. Area 1 Security's role in blocking these campaigns is emphasized, showcasing the effectiveness of their threat detection capabilities in identifying and mitigating such advanced threats.

Jan 2021KEMTLS: Post-quantum TLS without signaturesThis post introduces KEMTLS, a novel mechanism for achieving post-quantum TLS without relying on traditional signatures. It addresses the challenge of larger post-quantum cryptographic primitives by replacing handshake signatures with key encapsulation mechanisms (KEMs), significantly reducing handshake data size and improving efficiency. Cloudflare has implemented this in Golang's TLS 1.3 suite, demonstrating a commitment to future-proofing internet security against quantum computing threats.

Oct 2020NTS is now an RFCThis post announces the official RFC standardization of Network Time Security (NTS) for NTP, a protocol Cloudflare has been instrumental in developing and promoting. It highlights the importance of NTS for overall internet security by ensuring the integrity of time synchronization, and details Cloudflare's role in its development, implementation, and ongoing support, including making their time service NTS-compatible and encouraging wider adoption.

Dec 2017Why Some Phishing Emails Are Mysteriously DisappearingThis post details a new technique for combating phishing by dynamically rewriting DMARC records for known malicious domains. When a DNS query for DMARC records of a known phishing domain is made, Cloudflare rewrites the policy to 'reject' on the fly. This prevents phishing emails from being delivered by instructing receiving email clients to reject them. The post also explains the underlying email authentication protocols (SPF, DKIM, DMARC) and demonstrates the technique using a fake phishing domain.

What this trail covers