Email Routing exits beta with API, IPv6, and anti-spam upgrades

Cloudflare has moved Email Routing out of beta, roughly a year after the service was introduced during Birthday Week 2021. The free offering now handles traffic for more than 550,000 inboxes and forwards an average of two million messages per day, according to the company.

The service has picked up a range of new capabilities since its initial launch, from publicly documented APIs to IPv6 egress support. Here is what has changed.

Public API and Terraform resources

Email Routing's management APIs were initially private and undocumented. That has changed: they are now listed in the public Cloudflare API catalog, where developers can find method definitions and parameters for managing destination addresses, rules, and other settings. The documentation includes curl examples.

Infrastructure-as-code users can also configure Email Routing through Cloudflare's Terraform provider. The provider's latest releases incorporate the Email Routing API resources, which can be used with HCL configuration syntax.

IPv6 egress and delivery improvements

Email Routing has supported IPv6 on the ingress side since launch. The team has now closed the loop by adding IPv6 egress: when the MX server of a forwarding destination supports IPv6, outbound email will attempt to use it. Gmail is cited as a high-traffic destination with IPv6 MX records. Most email is now delivered to upstreams over IPv6.

Better visibility into message flow

Email Routing now offers two observability tools to help troubleshoot deliverability. The Analytics widget shows aggregate statistics — messages received over a selected timeframe, how they were handled, and a time-series chart. The Activity Log provides per-message detail, including sender, custom address, timestamp, and delivery attempt results, plus the results of SPF, DMARC, and DKIM validations. Filters help narrow down entries at higher volumes.

The Activity Log now also surfaces bounce messages. These occur when an upstream SMTP server accepts delivery but the recipient inbox later rejects it — due to quota limits, virus checks, forged messages, or other issues — and returns an error to the last MTA in the chain, read from the Return-Path headers.

Audit Log integration

Email Routing configuration changes are now recorded in Cloudflare's Audit Logs, a feature available across all plan types. Actions such as adding a new address, changing a rule, or editing the catch-all address are logged. Administrators can review entries in the dashboard under "Manage Account" or download the list via API.

Anti-spam filtering at the SMTP level

Email Routing has supported SPF, DKIM, and DMARC validation on incoming messages since day one, but those checks do not catch malicious mail sent from domains that ignore those standards. The team has now added blocking of emails from IP addresses deemed untrustworthy, using a combination of heuristics and reputation databases, including RBL lists. The block happens at the SMTP level.

This filtering benefits both recipients who get a lot of spam and the broader user base: keeping bad senders out improves the reputation of Cloudflare's own IP space and forwarding domain, which in turn boosts deliverability success rates to other providers.

IDN support goes end to end

Email Routing previously did not support Internationalized Domain Names (IDNs) — domains containing non-ASCII characters. The challenge is that IDNA conversions must work across DNS, SMTP, TLS, and DKIM signatures stacked together; a break anywhere in the chain causes failures. IDNs now work end to end within Email Routing.

8-bit MIME transport

The SMTP server has added support for the 8-bit MIME Transport (8BITMIME) extension. When a client connects via EHLO, the server announces support for Secure SMTP over TLS, Enhanced Error Codes, and 8BITMIME. This allows binary file transmission without conversions to and from 7-bit encoding. Email Routing now handles 8BITMIME messages end to end, adjusting DKIM signatures accordingly.

Smaller fixes and infrastructure changes

  • The SMTP server has been ported to use BoringSSL, Cloudflare's SSL/TLS library of choice, and now supports more ciphers for STARTTLS connections from clients and to upstream servers.
  • DKIM signing went through several improvements. Cloudflare's Rust DKIM implementation is open source on GitHub, and the team contributes to Lettre, a Rust mailer library used in the service.
  • When a destination domain has multiple MX records, delivery attempts now iterate through all of them in preference value order per RFC until successful or all are exhausted.

Route to Workers nearing completion

Route to Workers, announced in May 2022, will let users process incoming email programmatically with a Cloudflare Worker script before forwarding or dropping it. The project is nearly complete: APIs, dashboard configuration screens, the SMTP service, and the Cap'n Proto interface to Workers are largely done. Remaining work involves adding Email Workers primitives to the runtime and testing before opening a public beta.

What's on the roadmap

Two protocol extensions are in the pipeline. ARC (Authenticated Received Chain) is a signature-based authentication system designed for email forwarding services. EAI (Email Address Internationalization) is also planned.

Email Routing remains free to use and is available to all Cloudflare customers. Setup takes a few minutes; the Developers Documentation page covers getting started and troubleshooting. Cloudflare is soliciting feedback via its Discord server, community forum, and Twitter.