Cloudflare Email Routing vs Email Sending

Choose the lane in one minute

Receive or forward mail

Use Email Routing. It accepts inbound mail for a Cloudflare-managed domain and forwards it to a verified address or an Email Worker.

Notify a fixed internal address

A send_email binding can send to destination addresses already verified in the account, including on the free path documented by Cloudflare.

Send signup, reset, or order mail to users

Use Email Sending. Arbitrary-recipient outbound mail is available on Workers Paid and can be submitted through a Worker binding, REST API, or authenticated SMTP.

Send and receive

Configure both products. Keep their DNS records, event models, data handling, and failure states separate.

Three similar names, three different contracts

Email Routing is an inbound product

Email Routing publishes MX records so Cloudflare receives mail addressed to your domain. A routing rule then forwards the message to a verified mailbox, invokes a Worker email handler, or drops it. It does not create a mailbox, and enabling it does not by itself authorize arbitrary outbound transactional mail.

Restricted sending is for verified destinations

Cloudflare documents a free path for sending directly to destination addresses that the account has already verified. A send_email binding without an outbound Email Sending entitlement is therefore useful for a fixed operator alert or test recipient. It is not a customer-mail system: every new user address cannot be pre-verified as an account destination.

Email Sending is the outbound product

Email Sending entered public beta in April 2026. It accepts arbitrary transactional recipients through env.EMAIL.send(), the REST API, or authenticated SMTP. Cloudflare's current pricing page places arbitrary-recipient sending on Workers Paid, with 3,000 outbound messages included per account each month and metered usage after that. Check the live pricing page before budgeting because plan terms can change.

Do not merge the inbound and outbound DNS identities

Cloudflare's current authentication documentation gives Email Routing and Email Sending separate record locations. Use the exact records generated for your account rather than copying examples from another domain.

• Email Routing uses the domain's inbound MX records and a routing SPF record on the root domain.
• Email Routing currently documents DKIM selector cf2024-1.
• Email Sending places bounce MX and SPF on cf-bounce.yourdomain.example.
• Email Sending currently documents DKIM selector cf-bounce at cf-bounce._domainkey.yourdomain.example.
• DMARC remains on _dmarc.yourdomain.example; verify alignment using a real message's visible From, Return-Path, and DKIM signing identity.

Adding the sending SPF example at the root, replacing an existing root SPF record, or treating an inbound MX record as outbound authorization can break other legitimate senders. Inventory every sender before changing shared DNS.

Implementation patterns that match the contract

Inbound support or reply processing

1. Onboard Email Routing and verify the inbound DNS state.
2. Route to a mailbox when a human owns the reply, or to an Email Worker when code must parse it.
3. Treat raw MIME as sensitive input. Bound message size, reject unexpected types, and keep addresses and bodies out of analytics.
4. For threading, store an opaque internal correlation ID and map trusted Message-ID, In-Reply-To, and References values only after bounded parsing.

Fixed internal alert

1. Verify the destination address in the Cloudflare account.
2. Restrict the binding with destination_address or allowed_destination_addresses.
3. Do not accept an arbitrary recipient from a public request and pass it to this binding.
4. Record a stable alert ID and the send result without logging credentials or private payloads.

User-facing transactional email

1. Use Workers Paid and onboard the sending domain under Email Sending.
2. Choose one submission interface: Worker binding, REST API, or SMTP. Keep provider details behind a small application adapter.
3. Write the business event and an outbox record atomically; send asynchronously with a stable idempotency and correlation key.
4. Track provider acceptance, delivered, deferred, bounced, failed, rejected, and complained as distinct outcomes.
5. Give verification and password-recovery flows a safe resend and alternate recovery state when a permanent failure arrives later.

Submission success is not final delivery

A successful binding, REST, or SMTP submission proves that Cloudflare accepted the request at that boundary. It does not prove that the recipient server accepted the message or that a user saw it. Cloudflare added Queue event subscriptions for Email Sending in July 2026, including delivered, deferred, bounced, failed, rejected, and complained events.

• Scope each subscription to the exact sending domain.
• Verify and normalize events before they change application state.
• Reduce outcomes monotonically so a late delayed event cannot overwrite a permanent bounce or complaint.
• Deduplicate by provider message identity and event identity.
• Do not retry hard bounces, rejects, suppressions, or complaints unchanged.

A controlled rollout

1. Write the use case first: inbound routing, fixed alert, arbitrary-recipient sending, or two-way mail.
2. Record the plan entitlement, expected monthly volume, destination model, sending domain, and data-retention boundary.
3. Publish only the dashboard-generated DNS records and confirm them independently.
4. Send one consented test per important receiver class and preserve provider and SMTP evidence.
5. Exercise delayed, bounced, rejected, complained, duplicate, and out-of-order events before production.
6. Keep a rollback path and do not delete the previous provider until the new route has receiver evidence for the real target segment.