What is the challenge?
Why does phishing keep getting through, and what happens when it does?
Email remains the #1 initial-access vector for ransomware, account takeover, wire fraud, and supply-chain compromise. Native filters in Microsoft 365 and Google Workspace catch the obvious spam — but business email compromise (BEC), credential phishing on lookalike domains, and zero-day attachments routinely slip past. Once delivered, the clock is ticking on someone clicking the link or wiring the money.
Architecture
How it fits together
Diagram coming soon
Architecture diagram for this solution will be added here.
Cloudflare's Solution
How Cloudflare solves it
- Pre-delivery inspection at machine speed. Cloudflare Email Security inspects every message before it lands in the inbox: sender reputation, content analysis, URL detonation, attachment sandboxing, and ML-based BEC detection. Bad mail never arrives.
- Domain impersonation & BEC detection. Models trained on billions of messages flag executive-impersonation, look-alike domains (cl0udflare.com vs cloudflare.com), and conversation hijacking — the cases that DKIM/SPF/DMARC alone don't catch.
- Post-delivery retraction. If a threat is identified after delivery (intel updates, user reports, IOC matches), Cloudflare can remove the message from every inbox it reached. No 'please don't click that email' all-staff.
- Easy deployment. Inline via MX record change, or API-based add-on for Microsoft 365 / Google Workspace that requires no MX changes. Onboard in minutes.
- One platform with the rest of Cloudflare One. Indicators detected in email feed back into Gateway, Access, and CASB — so a URL flagged in a phishing email is automatically blocked across the entire org's web traffic too.
FAQ
Common questions
We already have Microsoft Defender / Proofpoint. Why add this?
Most customers deploy Cloudflare Email Security as a layered defense in front of (or alongside) native filters. Cloudflare's models catch a substantial fraction of BEC and targeted phishing that slipped past the existing layer — measured directly in customer environments.
Will this slow down email delivery?
No. Inline mode adds typically <1s of inspection latency. The API-based deployment for M365/Google Workspace inspects messages just after they hit Microsoft's or Google's servers, with no impact on transit time.
What about emails sent to mobile devices?
Email Security runs in the cloud at the mail flow layer — it's independent of the device. Whether users read mail on the iPhone Mail app, Outlook desktop, or webmail, the protection is the same.
How is this different from Cloudflare Email Routing (the free product)?
Email Routing is a free service that forwards email for domains you own (e.g. me@mydomain.com → mygmail@gmail.com). Email Security is the enterprise threat-protection product that inspects, classifies, and quarantines malicious messages. Different products.
Let's Test!
Try it live
Demo coming soon
An interactive demo for Email Security is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.
Dive Deeper