Email - Support mailboxes with Cloudflare Email Routing

RailsFast names three customer-facing mailboxes once, in config/railsfast/railsfast.yml:

support_email: "[email protected]"
legal_email: "[email protected]"
privacy_email: "[email protected]"

Every mailer reply-to and every "write to us" line reads them. The legal pages spell the same addresses out, and a test fails the build if they drift from these values. So mail must actually arrive there. You do not need a mail host for that. Cloudflare Email Routing receives mail for your domain for free and forwards each address to an inbox that you already read. SES still sends your app's mail (SES per app); Email Routing only receives.

1. Turn on Email Routing for the zone

cf email-routing enable -z example.com

Cloudflare adds and locks the MX records and the SPF record at the apex (v=spf1 include:_spf.mx.cloudflare.net ~all), and a DKIM record for forwarding. If the zone has other MX records, remove them first: mail goes to one provider only.

IMPORTANT

This apex SPF record is now the only SPF record of example.com. Do not add another one for SES. SES has its own SPF record on its MAIL FROM subdomain (mail.example.com), so the two never clash.

2. Add the destination inbox (one human step)

The destination is an address that Cloudflare forwards to. Destinations belong to the account, not to the zone, so one verified inbox serves all your apps.

cf email-routing addresses create --email [email protected]

Cloudflare sends a verification email to that address. Somebody must click the link in it. Rules that forward to an unverified address do not deliver. Check the status with cf email-routing addresses list.

3. One rule per mailbox

for box in support legal privacy; do
  cf email-routing rules create -z example.com --name "$box" \
    --matchers "[{\"type\":\"literal\",\"field\":\"to\",\"value\":\"$box@example.com\"}]" \
    --actions '[{"type":"forward","value":["[email protected]"]}]'
done

cf email-routing rules list -z example.com

Add --dry-run to see each request first. Each rule forwards to exactly one verified address. To send a mailbox to two people, use a group address at your mail provider as the destination.

Prefer explicit rules to a catch-all. A catch-all forwards every address of the domain, spam to random addresses included.

4. Check it

cf email-routing get -z example.com      # the status must say it is enabled and ready

Then send a test email to [email protected] from another account and check that it arrives. Cloudflare's dashboard (Email → Email Routing → Activity log) shows each message and why a message was dropped.

Replies

Email Routing forwards mail; it does not send. When you reply from your inbox, the reply comes from your inbox's address. To reply as [email protected], add it as a "send mail as" address in your mail client, with SMTP credentials of a sender that may send for example.com (for example SES SMTP credentials for your domain identity).