Email — Cloudflare Demo Shop

What is the challenge?

Why is 'just send an email' still hard, and why does phishing keep getting through?

Teams need to send transactional mail (receipts, verification codes, alerts) and route inbound mail (support@, sales@) without standing up and maintaining SMTP infrastructure — SPF/DKIM/DMARC, bounce handling, deliverability. At the same time, email remains the #1 initial-access vector for ransomware, account takeover, wire fraud, and supply-chain compromise. Native filters in Microsoft 365 and Google Workspace catch the obvious spam, but business email compromise (BEC), credential phishing on lookalike domains, and zero-day attachments routinely slip past. Once delivered, the clock is ticking on someone clicking the link or wiring the money.

Architecture

How it fits together

Diagram coming soon

Architecture diagram for this solution will be added here.

Cloudflare's Solution

How Cloudflare solves it

Email Sending — transactional email, no mail server. Call env.EMAIL.send() from a Worker (or use the REST API / authenticated SMTP) to send receipts, magic links, and alerts from a domain you already onboarded to Cloudflare. DKIM/DMARC signing, delivery logs, and bounce handling are built in.
Email Routing — inbound mail without a mailbox to run. Route mail sent to addresses on your domain (support@, sales@) to a verified inbox, or to a Worker for custom logic — forward, auto-reply, or process programmatically. No mail server to patch or scale.
Pre-delivery inspection at machine speed. Cloudflare Email Security inspects every message before it lands in the inbox: sender reputation, content analysis, URL detonation, attachment sandboxing, and ML-based BEC detection. Bad mail never arrives.
Domain impersonation & BEC detection. Models trained on billions of messages flag executive-impersonation, look-alike domains (cl0udflare.com vs cloudflare.com), and conversation hijacking — the cases that DKIM/SPF/DMARC alone don't catch.
Post-delivery retraction. If a threat is identified after delivery (intel updates, user reports, IOC matches), Cloudflare can remove the message from every inbox it reached. No 'please don't click that email' all-staff.
One platform with the rest of Cloudflare One. Indicators detected by Email Security feed back into Gateway, Access, and CASB — so a URL flagged in a phishing email is automatically blocked across the entire org's web traffic too.

FAQ

Common questions

Is Email Sending / Email Routing the same product as Email Security?

No — different products on the same platform. Email Sending and Email Routing (this demo) handle the mail flow: sending transactional email and routing inbound mail to inboxes or Workers. Email Security is the enterprise threat-protection product that inspects, classifies, and quarantines malicious messages before or after delivery. Many customers use both.

Do I need my own mail server to use Email Sending or Email Routing?

No. Both run entirely on Cloudflare's platform. Email Sending uses a Workers binding, REST API, or authenticated SMTP; Email Routing forwards inbound mail to a verified address or a Worker. DNS (MX, SPF, DKIM) is configured automatically when you onboard the domain.

We already have Microsoft Defender / Proofpoint. Why add Email Security?

Most customers deploy Cloudflare Email Security as a layered defense in front of (or alongside) native filters. Cloudflare's models catch a substantial fraction of BEC and targeted phishing that slipped past the existing layer — measured directly in customer environments.

Will Email Security slow down email delivery?

No. Inline mode adds typically <1s of inspection latency. The API-based deployment for M365/Google Workspace inspects messages just after they hit Microsoft's or Google's servers, with no impact on transit time.

Can I use Email Sending for marketing or bulk email?

No — Email Sending is intended for transactional email (receipts, verification, notifications), not marketing or bulk sends.

Let's Test!

Try it live

This demo exercises Email Sending and Email Routing end-to-end, with the send action itself gated behind Cloudflare Access at /email-security/send so it can't be spammed by an anonymous visitor. Email Security (phishing/BEC inspection) isn't part of the live demo — see the solution points above for that half of the platform. Presenter tip: route replies to a personal inbox rather than a heavily-filtered corporate one — an auto-forwarded reply with a rewritten envelope sender is exactly the kind of pattern inbound security stacks quarantine, which corporate mailboxes protected by Cloudflare Email Security do especially well.

The live demo sends a real message from support@remydemo.com using Email Sending, and replying exercises Email Routing — but sending is gated behind Cloudflare Access first, so the capability can't be spammed by an anonymous visitor.

Try it — sign-in required

You'll be asked to authenticate via Cloudflare Access before you can send anything. Once signed in, you pick the recipient — sender and message content stay fixed server-side.

Open the send demo →

What this demonstrates

Access sits in front of the demo's only side-effecting action (sending mail), gating it to signed-in identities before the request ever reaches Cloudflare Pages.
Email Sending delivers the message entirely from Cloudflare's platform — no mail server to run or maintain.
Email Routing forwards any reply from support@remydemo.com on automatically.

Dive Deeper

Docs & blogs

Documentation

Blogs

Browse every Cloudflare blog post tagged "Email Security" →

← Back to all solutions