[HN Gopher] Cloudflare Email Service
       ___________________________________________________________________
        
       Cloudflare Email Service
        
       Author : jilles
       Score  : 389 points
       Date   : 2026-04-16 13:21 UTC (9 hours ago)
        
 (HTM) web link (blog.cloudflare.com)
 (TXT) w3m dump (blog.cloudflare.com)
        
       | bjord wrote:
       | finally, more spam!
        
       | john_strinlai wrote:
       | > _Everyone already has an email address, which means everyone
       | can already interact with your application or agent. And your
       | agent can interact with anyone._
       | 
       | please no.
       | 
       | > _Sending email that actually reaches inboxes usually means
       | wrestling with SPF, DKIM, and DMARC records. When you add your
       | domain to Email Service, we configure all of it automatically.
       | Your emails are authenticated and delivered, not flagged as
       | spam._
       | 
       | this is going to be an absolute nightmare for spam. i cant
       | exactly block all of cloudflare...
       | 
       | it would be nice if anyone at cloudflare could write about how
       | they plan to proactively reduce abuse of this feature, how they
       | will respond to spam reports, what the punishment for abuse will
       | be, etc.
        
         | cuu508 wrote:
         | Sure you can, look at Spain ;-)
        
       | moribvndvs wrote:
       | While we're adding antiquated and shitty ways to interface with
       | your agent, can we add fax support? Maybe direct-to-mail service
       | for postcards and flyers?
        
         | tclancy wrote:
         | I knew I hung onto that C64 cassette player for a reason!
         | Beyond the new Sturgill album, I mean.
        
         | doublerabbit wrote:
         | Can we go minidisc if we're going for obsolete tech?
        
         | verdverm wrote:
         | This has been possible for many years, before agents were a
         | thing. They will open the mail and scan the contents into a pdf
         | for you, requires filing a form with the post office. It gets
         | expensive because they nickel and dime you where they can.
         | There are many more services should you wish to send snail
         | mail.
         | 
         | https://www.virtualpostmail.com/
        
           | spaghettifythis wrote:
           | As an aside, this company's services seem incredibly sketchy
           | - they let you have fake residential or commercial addresses
           | so you can pretend to have a US office or other address
        
       | amazingamazing wrote:
       | More spam at scale. I wish recipients of email had more control
       | over the conditions to which the email is delivered to them,
       | rather than after the fact curation...
        
         | synkarius wrote:
         | Along these lines, I am experimenting with a two-tiered system
         | where I use Proton's sieve filters to create a sender/cc/bcc
         | whitelist for personal emails (which alert my phone) and a non-
         | Proton collection of burnable aliases for everything else
         | (which do not alert my phone). It doesn't solve the problem
         | completely, but it is mitigating it pretty well so far.
        
       | tornikeo wrote:
       | Oof. I know of a startup that recently Show HN'd here, the agent
       | mail.to, that is NOT having a good time right now. I don't know
       | what all these new startups having moats thinner than Durex are
       | thinking -- like, what the plan if someone does what you do,
       | faster and cheaper?
        
         | Hendrikto wrote:
         | The plan is to have exited by then. These people are mostly
         | just grifters.
        
         | delfinom wrote:
         | Write an angry blog post about how big business is using their
         | power to kill their _totally_ unique original idea that nobody
         | could possibly copy in a hour?
        
         | Kye wrote:
         | Classic "is this a feature or a product?" problem. You're going
         | to have a bad time if you spend all your effort on a feature
         | and nothing to set it apart.
        
         | CWwdcdk7h wrote:
         | > We raised $6M in Seed Funding
         | 
         | Well that part was impressive. It looks like they focused on
         | receiving emails, that is probably even worse, as I expect
         | OpenAI/Anthropic to add such ability directly to agents, if it
         | really is useful.
        
           | strbean wrote:
           | > It looks like they focused on receiving emails
           | 
           | That's wild. $6M for an MCP server for SMTP?
        
         | nozzlegear wrote:
         | > _new startups having moats thinner than Durex are thinking_
         | 
         | Haha, great visual. Really illustrative of what these AI
         | startups and bootstrapped indie developers are dealing with
         | (and, if I had to guess, why most of them don't go anywhere).
        
         | bridgetburch wrote:
         | I'm building something similar (Dead Simple Email - same
         | category, different pricing structure). The moat criticism is
         | fair and worth being honest about. The defensible part isn't
         | the feature set, it's infrastructure and price. We run our own
         | mail servers rather than reselling SES, which gives us direct
         | control over deliverability and costs. That's what lets us
         | charge $29/mo for 100 inboxes where AgentMail is at $200.
         | Whether that's a real moat or just a head start is a legitimate
         | question. Email deliverability is genuinely hard to get right
         | at scale, but I can't say with confidence they won't eventually
         | just absorb this. Building fast and staying cheap is the only
         | real answer I have to that.
        
         | FlyingSnake wrote:
         | "Each agent gets its own identity from a single domain." That
         | too on the edge, along with the futuristic CF Dev primitives.
         | 
         | I had the same thought when I read this part. The $6MM
         | investment on Agent Mail is in serious trouble right now.
        
       | baal80spam wrote:
       | Ugh, who asked for this?
        
         | bdangubic wrote:
         | Everyone paying $20/month to Resend et al to send few thousand
         | emails
        
         | cdrnsf wrote:
         | The same people that think letting OpenClaw access their inbox
         | is a good idea.
        
         | esseph wrote:
         | People wanting an AWS service but from Cloudflare instead of
         | Amazon.
        
       | VikingCoder wrote:
       | $0.35 per 1,000 outbound emails. Unlimited inbound emails.
       | 
       | How's that compare?
        
         | sammy2255 wrote:
         | Where did you find the pricing page? I can't find it anywhere
        
           | tom1337 wrote:
           | https://developers.cloudflare.com/email-
           | service/platform/pri...
        
             | sammy2255 wrote:
             | Thanks, hiding the pricing under a submenu called
             | "Platform" is an .. interesting design choice
        
         | tom1337 wrote:
         | AWS SES is 10ct per 1000 emails (same price for inbound +
         | outbound) but you also need to pay for attachments etc.
        
           | Computer0 wrote:
           | What is the minimum monthly amount though?
        
       | Hamuko wrote:
       | How awful is the reputation on those IP addresses going to be?
        
         | lagniappe wrote:
         | It's cloudflare, they type iddqd before every request.
        
           | rc_kas wrote:
           | what is iddqd?
        
         | dbbk wrote:
         | Good luck trying to send emails during a LaLiga match I guess
        
       | ghoshbishakh wrote:
       | Pricing:
       | 
       | $0.35 per 1,000 emails
       | 
       | Here are the limits:
       | 
       | "Your account may have daily sending limits based on Cloudflare's
       | assessment of your account standing. "
       | 
       | Source: https://developers.cloudflare.com/email-
       | service/platform/pri... https://developers.cloudflare.com/email-
       | service/platform/lim...
        
         | pier25 wrote:
         | Pretty good pricing.
         | 
         | Currently using ZeptoMail ($2.5 per 10,000 emails) but if this
         | service by Cloudflare proves reliable once it reaches GA I'd be
         | happy to switch.
        
           | ghoshbishakh wrote:
           | Why not use SES?
        
             | pier25 wrote:
             | I just avoid AWS as much as I can.
        
             | vlod wrote:
             | It is a major pita dealing with the SES team. I originally
             | wanted to send email from my web app (simply notification
             | flow. i.e. you have a new request from user-123) and it is
             | (IMHO) impossible to get past them. They won't tell you any
             | reasons why. (Because they don't want devs gaming the
             | system).
             | 
             | Nothing I could do could convince them that I wasn't trying
             | to do 'bad' stuff. Just gave up and decided not to use any
             | AWS tech.
             | 
             | Just used GMail api to send email.
        
       | TimCTRL wrote:
       | > Everyone already has an email address
       | 
       | Things developers believe about email
        
         | arkaoss wrote:
         | There is not much developers UNDERSTAND about email, let alone
         | believe... There's soo much to read into this product.. and it
         | boils down to JASS ( just another spam source) .
        
         | AtNightWeCode wrote:
         | Or the even worse category. People sharing email.
        
       | freefaler wrote:
       | A classic "the tragedy of the commons" with the SMTP protocol.
       | 
       | When the cost of spamming is near 0.00, all open platforms will
       | be abused to the tilt. We have seen the email channel get less
       | and less reliable with our own clients (password recovery,
       | notifications and etc).
       | 
       | This might evolve into a couple of oligopolies (Microsoft 365
       | Outlook, Google Gmail, may be some legacy email providers like
       | Yahoo) and if you want delivery you'd need to pay them, because
       | they'd be the verifiers that you're not a spammer.
       | 
       | And these platforms will have a hell of time to fight the
       | spammers that will create millions of email addresses and spam
       | trough them.
        
         | ajsnigrutin wrote:
         | I'd be happy if we at least started punishing the large, well
         | known and established companies for spamming us...
         | 
         | ...you know the one, where you have email preferences, and you
         | only have "new messages" and "commercial offers" in the
         | settings, and you uncheck the "commercial offers" and think
         | you're sae. Then you get a spam email from them... check the
         | preferences again, and there's a "new product notification"
         | preference, checked by default, and you uncheck that too. Bam!
         | another spam! "personalized offers" option appeared, check by
         | default. "limited time offers". "value deals", etc.
        
         | Youden wrote:
         | I don't think the protocol is necessarily the problem. For
         | example we don't say the HTTP protocol is the problem when
         | spammers abuse website comment forms or forums, we say it's the
         | server on the other side.
         | 
         | I think the answer is somewhat the same as where we've gone
         | with many HTTP servers: proof of work. Just like Captcha and
         | more recently Cloudflare turnstile required you complete a task
         | before you'd be able to access as website, senders should be
         | required to complete a task before you'll accept their email.
         | 
         | It can even be a sliding scale: the higher you want the chances
         | of the recipient seeing it to be, the more work you need to do.
         | 
         | However this also break emails considered "legitimate" by
         | businesses, like marketing newsletters and other nonsense,
         | which is why it'll likely never happen.
        
           | freefaler wrote:
           | The legacy compatibility of the protocol has brought all the
           | hacks on top of it for identity verification like SPF, DMARC,
           | DKIM ...
           | 
           | Even with those, the amount of farmed accounts from a
           | reputable platforms is still high, and it will go higher with
           | the cheap AI targeting that will make the texts much more
           | well crafted and spam filters much more aggressive.
           | 
           | My other conjecture is that the big mail providers would have
           | enough data to catch the spammers based on a number of
           | signals.
        
         | xhkkffbf wrote:
         | I've gotten my email routed to spam even though it never left
         | the Google cloud. They don't say, "Gosh, this is coming from
         | inside the house. Therefore it's trustworthy." Nope. The push
         | legit mail from other Google hosted domains into spam without a
         | second thought.
        
           | nutjob2 wrote:
           | I've had emails from Google end up in spam and I'm using
           | Google Workspace, it's driven by what people flag as spam,
           | not domain trust.
        
       | ryangst_1 wrote:
       | $0.35 per 1,000 emails it's fair pricing.
       | 
       | Looks better than fixed $20 for Resend.
        
         | skc wrote:
         | Yep, and I'm both a Cloudflare and Resend customer.
         | 
         | I like Resend, a lot, but this is probably something I can't
         | pass up, especially if it does what it says on the tin
        
           | bdangubic wrote:
           | Resend will change the pricing - guaranteed. Not sure how
           | soon but I'd expect _very soon._
        
             | STRiDEX wrote:
             | I guess if they're big enough they should be working on
             | moving off of amazon SES for emails and warming up ip
             | addresses? Otherwise they need to keep a markup on top of
             | amazon.
             | 
             | Edit: didn't realize people were paying resend $20. AWS
             | already exists at a low price and people pick them anyway,
             | i'm sure they're fine.
        
               | pupppet wrote:
               | I'm betting a non-small chunk of these are users AWS
               | wouldn't let out of sandbox mode.
        
               | bdangubic wrote:
               | and you'd be 100% right!
        
               | slig wrote:
               | It's _very_ easy to get started with Resend, and they
               | have a free tier that basically works for any
               | bootstrapped project, and by the time you have to
               | upgrade, you can pay $20 /m.
        
               | stewartjarod wrote:
               | And if you want a SaaS like experience for your own AWS,
               | there is wraps.dev ;d
        
       | qJaskkT wrote:
       | Did anyone ask the poor people who unknowingly send mail to
       | someone who feeds it to an AI surveillance company?
       | 
       | It would be interesting to send GDPR requests and have Cloudflare
       | figure out all of the parties who got or use your mail.
        
       | nope1000 wrote:
       | It's funny. All the examples they show in the blogpost are just
       | things that were already pretty easy without agents. Sending an
       | email when the CI pipeline passes, when a support request is
       | incoming, when an order is shipped. I think we haven't found a
       | problem for this solution.
        
         | written-beyond wrote:
         | The problem is how bullshit transactional emails are when
         | you're outside of AWS. If you're not expecting to use 10,000
         | emails a month but would like the option to go over the free
         | tier without committing to 10,000 more. Just let me pay per use
         | FFS.
        
           | jedberg wrote:
           | The reason AWS does that is because there is a lot of base
           | level work to verify you as "not a spammer" and to keep
           | verifying you. So this is their way of making sure you pay
           | the base cost.
           | 
           | They could price per use, but it would have to start with a
           | base fee that is about the same at 10,000 emails.
        
             | written-beyond wrote:
             | The base fee doesn't need to be monthly, they can take $50
             | dollars as a one time registration verification fee. That
             | should be enough to cover their compute costs for the year,
             | specially when you pool in that from multiple customers.
             | Who is spamming with 100 monthly emails? How much compute
             | do they need to verify you aren't spamming. They can bake
             | all of that into the pay per use price, they choose not to
             | and I'm glad cloudflare is offering this.
        
               | jedberg wrote:
               | Maintaining the reputation of an IP address is the issue
               | here. If one bad actor sends just a few emails that get
               | marked as spam, the entire IP gets marked as bad. That's
               | basically what you're paying for.
               | 
               | Also, the person who just wants to send a few 100 emails
               | a month is actually far _more_ likely to be a spammer. So
               | it 's also a way for them to eliminate those folks.
               | 
               | And lastly, the support burden can be high.
               | 
               | AWS has basically said they only want serious customers,
               | let the other guys worry about the small senders.
        
           | purrcat259 wrote:
           | Scaleway TEM offer pay per use. I moved off of resend when my
           | side project went beyond their free tier and now pay <0.5EUR
           | a month
        
       | btown wrote:
       | https://developers.cloudflare.com/email-service/reference/po...
       | 
       | Cloudflare is very transparent about their prefixes and reverse
       | DNS, which is generally a good thing for the ecosystem! But it
       | makes it trivial for operators who want to block the entire
       | service, and extremely bad for Cloudflare's deliverability.
       | 
       | And while there are many open blacklists which I have no doubt
       | Cloudflare monitors, there are many (including soft spam-
       | classification signals) that are proprietary and
       | difficult/impossible to monitor other than by watching rates of
       | actual customer/prospect replies and engagement.
       | 
       | Amazon SQS has similar dynamics, and its reputation is far from
       | stellar.
       | 
       | (If the Cloudflare team is reading this, and I'm missing an on-
       | ramp to a company purchasing dedicated IPs with distinct PTR
       | records, I do apologize! I'm not seeing documentation about this,
       | though.)
        
       | daft_pink wrote:
       | I'm really just curious how they guard against prompt injection.
       | Otherwise this seems awesome.
        
       | yalogin wrote:
       | Isn't email already scriptable? What does cf provide that is
       | different? I clicked on it assuming they are launching their own
       | email service.
        
         | dawnerd wrote:
         | It really is showing how dumb this whole bubble is when you can
         | launch the same service that's been around for decades but slap
         | ai and agent on it.
        
       | Meekro wrote:
       | I'm not sure why this announcement has generated so much
       | irritation in the comments-- Cloudflare has been transitioning
       | from "DDoS protection" to "AWS competitor" for many years now,
       | and this is just their alternative to AWS SES.
       | 
       | It's an email sender that you can access through an API, or
       | directly through Workers. For those who haven't been keeping up
       | over the years, Workers is their product for running code on
       | Cloudflare's platform directly (an AWS Lambda competitor, more or
       | less) and they've been trying to make it the centerpiece of an
       | ecosystem where you deploy your code to their platform and get
       | access to a variety of tools: databases, storage, streaming, AI,
       | and now email sending. All of this is stuff that AWS has had for
       | years, but some people like Cloudflare more (I certainly do).
       | 
       | One thing that surprised me is the price-- Cloudflare's cloud
       | offerings are usually much cheaper, and I've saved plenty of
       | money by migrating from AWS S3 to Cloudflare's R2. This new
       | offering is 3x the AWS price, though. Weird. Anyway, most small
       | companies don't send enough email for it to matter.
       | 
       | But getting back to the consensus in the comments here: I'm not
       | sure why people think that they'll be worse about policing spam
       | than AWS SES, Azure Email, etc.
        
         | embedding-shape wrote:
         | > But getting back to the consensus in the comments here: I'm
         | not sure why people think that they'll be worse about policing
         | spam than AWS SES, Azure Email, etc.
         | 
         | Cloudflare is (in)famous for not acting against spammers,
         | fraud, piracy and other less savory groups that are hosting
         | their stuff at/behind Cloudflare, so reasonably, people who've
         | been affected by that are now afraid the same thing will happen
         | with email.
        
           | ttul wrote:
           | When it comes to email delivery, you can't ignore spam. It's
           | the bane of existence of every email sending service and the
           | number one business challenge in that segment. After all,
           | orchestrating delivery over SMTP is not rocket science. But
           | getting that email to not be rejected totally IS rocket
           | science and it's simultaneously an art form known only to a
           | handful of email nerds working at the core of the big email
           | sending services...
        
             | embedding-shape wrote:
             | Ok, but what about as a CDN/website-proxy/WAF? I know we
             | don't have the same automated reputation-propagation as
             | with email, but same thing supposedly happens there, where
             | eventually you get turned off if you don't act on lawful
             | requests, which is exactly why Cloudflare is unavailable in
             | Spain during La Liga matches, because Cloudflare don't take
             | piracy streams down.
             | 
             | In theory, Cloudflare should take those down, when
             | requested by legal means, but that doesn't matter. How sure
             | are we that they'll act differently for email, instead of
             | trying to get rid of the reputation system instead?
             | 
             | > getting that email to not be rejected totally IS rocket
             | science and it's simultaneously an art form known only to a
             | handful of email nerds working at the core of the big email
             | sending services
             | 
             | It really isn't, you need a clean IP and a clean domain,
             | send handful of emails and you're pretty much whitelisted
             | on most services out there. Maybe you'd say I'm one of the
             | handful, but I personally know more than a handful others
             | who also run their own email services, just like me, and
             | besides the usual hassle of running your own service, as
             | long as you don't spam, your emails will arrive as usual.
        
               | ttul wrote:
               | I run an email sending service at scale (billions of
               | messages per month, tens of millions of end users,
               | thousands of customers). Most of our software development
               | and operational effort revolves around abuse mitigation.
               | That has been the case for 15 years. It's a cat-and-mouse
               | game with two different mice: the senders, who are
               | constantly trying to figure out how to get you to deliver
               | their garbage; and the receivers, who are constantly
               | trying to figure out how to block it. We're stuck in the
               | middle.
               | 
               | It's hard to appreciate how difficult this battle is when
               | running at scale.
        
               | pbronez wrote:
               | What structural changes could we make to improve the
               | situation?
        
               | edoceo wrote:
               | Signed senders?
        
               | jgalt212 wrote:
               | Hashcash, or BTC.
        
               | ttul wrote:
               | I always loved the hashcash concept and actually raised
               | our original funding because of it (our Microsoft angels
               | loved the idea of making spamming more expensive, and our
               | Series A concept was tar-pitting to dissuade botnets). In
               | the context of email sending services, we have a modern
               | version of hashcash that we might at some point turn to.
               | If someone can figure out how to tokenize sending at
               | scale, then senders could pay recipients to open their
               | emails by attaching a "tip" to each message.
               | 
               | If even a small fraction of legitimate email recipients
               | altered their mail client settings to route "tipped"
               | messages to their inbox, that would probably suffice to
               | get senders to participate in the scheme. Senders are
               | starved for high quality engagement data. Meanwhile,
               | anything we can do to make spam less likely - on a
               | relative scale - to reach the inbox in comparison to
               | "legitimate" traffic, is a win.
        
               | b112 wrote:
               | It's simple, there's a standard, a new one, which takes
               | into account SPF, DKIM, DMARC, ARC, and even DANE along
               | with upcoming and purposed SPKF, DKIM+, DMARC2, and
               | ARCv4. It should fix just about everything.
        
               | brightball wrote:
               | Obligatory https://xkcd.com/927/
        
               | ttul wrote:
               | That is such a great question and there is no easy
               | answer. There have been enormous efforts to do better for
               | at least the last 20 years. An entire organization,
               | M3AAWG, was founded for that reason and it meets three
               | times a year, bringing together all the people that
               | matter for making the situation better. It's a great
               | organization and the people are all really smart and
               | awesome. The IETF is no slouch either, coming up with
               | excellent new standards and improving existing ones, such
               | as the recent update to DKIM.
               | 
               | That's about as good of an answer as I can provide: keep
               | sending smart people to the conferences!
        
               | embedding-shape wrote:
               | Right, I won't disagree with any of that, but I'm not
               | sure how it's related to what I wrote either. Maybe I
               | should have been more specific that I'm talking about
               | hosting your own email, not hosting emails for others,
               | which brings out a lot of other types of problems.
        
               | ttul wrote:
               | Apologies. When you said "email services" I thought you
               | were implying "email services for use by others". Yeah,
               | you can definitely run your own mail server in 2026 and I
               | think the internet community should always strongly
               | endorse being able to do so. Unfortunately, large email
               | receivers have to make do with imperfect signals when
               | making filtering decisions, and your traffic from a
               | lonely IP that happens to have a bad neighbour might get
               | blocked as collateral damage.
               | 
               | One long term hope: That domain name reputation
               | eventually overtakes IP address reputation entirely.
        
               | pocksuppet wrote:
               | Cloudflare acts on lawful requests during LaLiga matches.
               | The problem is that the Spanish government doesn't want
               | to bother doing things the lawful way because that takes
               | too long. They want piracy to magically disappear and
               | they'll randomly shut down more parts of the internet
               | until it does. Actual illegal sports streams are not
               | impacted by Cloudflare being down, and Cloudflare is not
               | the only impacted network.
        
               | embedding-shape wrote:
               | > problem is that the Spanish government doesn't want to
               | bother doing things the lawful way because that takes too
               | long
               | 
               | In Spain, what they are doing, is the "lawful way", it's
               | literally happening via the courts and judges. Do you
               | think ISPs are blocking Cloudflare specifically just for
               | fun, out of their own accord?
               | 
               | > Actual illegal sports streams are not impacted by
               | Cloudflare being down, and Cloudflare is not the only
               | impacted network.
               | 
               | Some are, many aren't. Cloudflare is indeed the only
               | impacted network, at least for me. Which other networks
               | are being blocked for you during the La Liga matches?
        
               | Dylan16807 wrote:
               | The specific blocks don't go through courts and judges.
        
               | embedding-shape wrote:
               | Yes, the specific block of blocking Cloudflare in Spain
               | during La Liga matches literally has gone through a court
               | and been ordered by a judge, I'm not sure how you could
               | have missed this. Judges have also dismissed the requests
               | from Cloudflare and others to remove the "dynamic block"
               | as there is collateral damage.
        
               | Dylan16807 wrote:
               | My understanding was that cloudflare was being blocked by
               | the same IP blocking list as everything else. And while
               | that _system_ went through courts, the _list_ didn 't.
               | 
               | There are also direct actions against cloudflare, but
               | that's not what's taking everything down, is it?
               | 
               | Did I misunderstand something?
        
               | embedding-shape wrote:
               | The sites are directed to be blocked by IP and DNS, this
               | is the list I suppose you're talking about, I'm not sure
               | of any specific "system vs list" distinction. Since some
               | of the sites are behind Cloudflare, some of the IPs are
               | IPs used by Cloudflare for any customer, not just the
               | streams, so then Cloudflare gets blocked wholesale, the
               | collateral damage that we get to joyfully experience
               | every game.
               | 
               | Remains to be seen if the block will remain in place or
               | not, you could argue it goes against some other laws, but
               | it has to be argued legally, just like how the block
               | initially happened because La Liga went through the
               | courts. So far us developers or people who visit more
               | American websites tend to be hit the worst, since they're
               | talking about "protecting" other matches too, in other
               | sports, I'm guessing it'll get worse before it gets
               | better.
        
           | thomas_gauvin wrote:
           | Blog author chiming in here:
           | 
           | We have reserved IPs for Email Service and will be protecting
           | the reputation and fighting spam from originating on Email
           | Service.
           | 
           | If we did not do so, our IPs would get flagged and then
           | emails end up in spam or not delivered. That defeats the
           | purpose of having a transactional Email Service. We're well
           | aware of this.
        
             | embedding-shape wrote:
             | Will you also do this for other spammers using Cloudflare
             | infrastructure, or just specifically for this email
             | product?
             | 
             | > For years, Spamhaus has observed abusive activity
             | facilitated by Cloudflare's various services.
             | Cybercriminals have been exploiting these legitimate
             | services to mask activities and enhance their malicious
             | operations, a tactic referred to as living off trusted
             | services (LOTS) [2].
             | 
             | > With 1201 unresolved Spamhaus Blocklist (SBL) listings
             | [3], it is clear that the state of affairs at Cloudflare's
             | Connectivity Cloud looks less than optimal from an abuse-
             | handling perspective. 10.05% of all domains listed on
             | Spamhaus's Domain Blocklist (DBL), which indicates signs of
             | spam or malicious activity, are on Cloudflare nameservers
             | 
             | https://www.spamhaus.org/resource-hub/service-
             | providers/too-...
        
               | Meekro wrote:
               | I would note that Cloudflare has been doing better-- the
               | SBL listings page mentioned in that article[1] shows only
               | 47 active complaints, down from 1201 when the article was
               | written 2 years ago. Many of those complaints are stale,
               | too: I spot-checked a few (referencing the domains
               | fireplacecoffee.com and expansionus.com) and the domains
               | are expired and not being hosted by anyone.
               | 
               | [1]
               | https://check.spamhaus.org/sbl/listings/cloudflare.com/
        
             | wang_li wrote:
             | I think you should put your money where your mouth is. For
             | each spam message sent to a recipient server, you send
             | $1000 to the recipient.
        
             | Bender wrote:
             | As someone that has managed very large outbound
             | transactional email environments, email campaign platforms
             | and some corporate email I just wanted to wish Cloudflare
             | the best of luck on this endeavor. This is an entirely
             | different animal from anything related to a CDN. Stay
             | vigilant and don't let the cute and fuzzy bunnies ruin it
             | for everyone else. They are evil and mischievous and _will_
             | do whatever they technically _can_ do.
        
             | chinathrow wrote:
             | > We're well aware of this.
             | 
             | Then how about not market it as "for agents" when said
             | agents are just LLM output?
        
             | themafia wrote:
             | So what are the thresholds?
             | 
             | For example with SES I will get automatically suspended if
             | my bounce rate is more than 10% or if my complaint rate is
             | more than 0.1%.
        
             | creatonez wrote:
             | Agent-produced emails are by definition spam. Everyone
             | should be reacting to this news by immediately blocking
             | your service.
        
               | ttul wrote:
               | Recent outreach after creating an AgentMail account:
               | 
               | "Thanks for being a user of AgentMail - a lot of people
               | use AgentMail for outbound (spin up and warm up inboxes,
               | send sequences, handle replies), ..."
               | 
               | Yes, that's right. The first use case mentioned is to
               | send automated outbound emails. "Cold prospecting"
               | workflows are likely going to be a big slice of usage on
               | the new Cloudflare service, as it seems to be on
               | AgentMail.
        
             | ttul wrote:
             | If you take the approach of policing individual sender
             | accounts with a strict anti-abuse policy, you have a chance
             | of succeeding. I'm sure you have already discovered that
             | the moment you allow anyone to sign up for an email sending
             | account, the worst of the worst actors immediately take up
             | the opportunity to do so! Cloudflare has a massive amount
             | of data about web traffic and I would hope that this data
             | can be recycled into effective threat detection and
             | control. No doubt you already know this and have people
             | working on it. Good luck!
        
         | sixhobbits wrote:
         | I'm not sure if it's a correct impression but my impression is
         | still that AWS is the "devil you know" and Cloudflare is less
         | predictable with more individual decision making from high ups.
         | 
         | I guess they got that reputation years ago when the founders
         | (?) got into public spats about what they would and wouldn't
         | host. AWS is more lawyers and committees and seems more
         | anonymous, so people don't necessarily like it more but they do
         | trust it to be what it looks like more.
         | 
         | Probably just a function of time and size.
        
           | pocksuppet wrote:
           | Cloudflare will predictably shut down your account until you
           | pay $150k. They will not transfer out any of your domains or
           | files - they will be inaccessible until you pay $150k.
        
             | b2m9 wrote:
             | Excuse me, what are you referring to?
        
               | foolswisdom wrote:
               | There have been stories about people with heavy internet
               | traffic (generally media streaming I think) being more or
               | less shut down unless they upgrade their cloudflare plan
               | (to enterprise I guess). Some were posted on HN in the
               | past.
        
               | NoahZuniga wrote:
               | And a gambling site
        
         | Joel_Mckay wrote:
         | Almost every SaaS (Spam as a Service) API ends up arguing its
         | minority of legitimate users are a justified excuse for the
         | majority of nuisance traffic.
         | 
         | Most cloud IP blocks already have very poor reputations, and or
         | already on Spamhaus blacklists.
         | 
         | People have a right to choose to be upset. =3
        
           | Meekro wrote:
           | My experience has been the opposite of what you're saying:
           | AWS SES (one of AWS's flagship products, and probably the
           | biggest email sender in the world) is a pretty responsible
           | anti-spam citizen. Spamhaus even wrote this article[1]
           | praising SES's anti-spam efforts. From the article: "Amazon
           | SES has a long-standing relationship with Spamhaus, working
           | closely to prevent suspicious IPs and domains from impacting
           | their network." Though I'm sure that new incidents come up
           | daily, Spamhaus themselves seem to disagree with the notion
           | that SES's IP blocks have "poor reputations."
           | 
           | [1] https://www.spamhaus.org/resource-hub/service-
           | providers/how-...
        
             | Joel_Mckay wrote:
             | Whatever IP people temporarily host on a cloud incurs the
             | prior users reputation.
             | 
             | Again, using legitimate traffic to shim network spam is a
             | common counterargument against black listing.
             | 
             | Of the approximate 274000 banned hosts I stare at... many
             | nuisances are from Amazon, Azure, digital ocean, and
             | Hetzner. I am sure Maildrill or Mailchimp does have
             | legitimate use cases, but generally the majority of the
             | traffic suggests otherwise. I am certainly biased in this
             | opinion. =3
        
               | tracker1 wrote:
               | Are those hosts using hosted VPS instances, or are they
               | sending through SES? There's a pretty significant
               | difference... FWIW, I get why a lot of VPSes simply block
               | email hosting altogether. It makes it a bit harder for me
               | to find a host for my own small server, but I do
               | understand the pain. Some services are better or worse,
               | and I can imagine at the scale of many cloud hosts,
               | trying to keep the IPs for general hosting out of
               | blocklists would impact the bottom line more than
               | reputational damage for a handful of legit email hosting
               | accounts.
               | 
               | TBF, the demo app referenced in TFA and depending on how
               | many emails you actually send for however many domains
               | may well be a better option for me than my small MTA
               | server.
        
         | password4321 wrote:
         | Cloudflare is spending years of goodwill earned through
         | technical skill, trending towards AI enshittification starting
         | with their blog posts and vibe coded features/products.
        
           | Meekro wrote:
           | I also kind of rolled my eyes at the blog post and its
           | obsessive focus on "agents" -- definitely feels like a
           | solution looking for a problem. But the email-sending product
           | being promoted is probably ok, right? They just happened to
           | write a lot of words observing that ChatGPT can, in fact,
           | call sendmail() through their platform (if you give it
           | access) -- a fact that shouldn't surprise anyone.
        
             | thomas_gauvin wrote:
             | Blog author chiming in:
             | 
             | Our initial blog covered most of Email Service's API and
             | what you can expect from it in terms of deliverability, DNS
             | records setup, etc. https://blog.cloudflare.com/email-
             | service/
             | 
             | Email Service can definitely be used as a transactional
             | email API, and it has everything you would expect like
             | SDKs, binding, observability and more coming on the way
             | 
             | The agent angle in this post reflects what we're actually
             | seeing from developers during our private beta. And the
             | idea that an agent can have an inbox to communicate is a
             | new piece in the developer toolbelt.
        
               | fernandotakai wrote:
               | >The agent angle in this post reflects what we're
               | actually seeing from developers during our private beta.
               | 
               | legit question: did you invite anyone that isn't doing
               | agentic whatever during your beta?
        
               | Meekro wrote:
               | Thomas can probably speak to this better, but as someone
               | who has participated in other Cloudflare betas: there's
               | usually a button or a form and you can request access.
        
               | tracker1 wrote:
               | It's most likely people doing active development, willing
               | to experiment on a test/beta platform... which probably
               | correlates strongly with those testing/trying agent based
               | workflows.
        
               | Meekro wrote:
               | Thanks for the clarification! Sounds like some
               | developers, including your beta users, are experimenting
               | with new ideas (which includes plugging agents into
               | different workflows to see what happens), while old farts
               | like myself bemoan AI getting plugged into everything and
               | every app sprouting "Ask AI" buttons that they never
               | asked for or wanted.
               | 
               | I can definitely understand some of the ire-- people are
               | probably imagining how they'll try to contact Verizon and
               | will get back a totally unhelpful email from ChatGPT when
               | all they wanted was to talk to a real human for 5
               | minutes. Your blog post about hooking up agents to email
               | probably speaks to that fear.
        
               | dbbk wrote:
               | It's just email man you do not need to throw an AI
               | buzzword in front of everything
        
             | gardnr wrote:
             | It's like the author handed the copy to the editor who then
             | added a new broken sentence after each original sentence
             | that somehow jams "agents" in there.
        
           | gpi wrote:
           | Unfortunate situation. Also, what is cloudflare exactly? They
           | seemed to have diversified a tad much.
        
             | foresto wrote:
             | > what is cloudflare exactly?
             | 
             | Man-in-the-middle and gatekeeper of (large parts of) the
             | web.
             | 
             | It's getting harder and harder to participate online
             | without being subject to their surveillance and/or
             | approval.
        
               | gpi wrote:
               | That's a good way to put it.
        
             | pfortuny wrote:
             | Cloudflare is, believe it or not, the owner of several IP
             | blocked by Telefonica in Spain durong football matches.
             | Soon to be tennis, basket, too.
        
         | Onavo wrote:
         | > _Cloudflare 's cloud offerings are usually much cheaper, and
         | I've saved plenty of money by migrating from AWS S3 to
         | Cloudflare's R2. This new offering is 3x the AWS price, though.
         | Weird. Anyway, most small companies don't send enough email for
         | it to matter._
         | 
         | For certain types of marketing and transactional emails, it's
         | cheaper I think. AWS SES pricing doesn't include attachments.
         | If you assume a maxed out 25MB email attachment body, I think
         | the price comes out to be mostly similar, amortized at least.
         | 
         | But if you are sending basic text/mostly text transactional
         | emails for stuff like password resets, then SES comes out ahead
         | for sure.
        
         | arpinum wrote:
         | The pricing is disappointing. I'm surprised Cloudflare has not
         | tried to compete on price against AWS lately after a good start
         | with R2. Queues, database storage, database writes, worker
         | invocation all more expensive than the AWS offering.
        
         | navigate8310 wrote:
         | I've used their email relay services to forward it to my
         | Microsoft account, every forward is rejected by Microsoft due
         | to spam generated by Cloudflare. So I don't have much faith at
         | least in their email services.
        
           | tracker1 wrote:
           | Of all email services, delivery to MS hosted systems is
           | absolutely the worst to deal with. It's completely opaque and
           | almost impossible to resolve most of the time. They tend to
           | direct you to paid channels to try to mitigate issues instead
           | of actually responding to complaints for false positive
           | flagging as spam.
           | 
           | For my small, personal email server, I just gave up on
           | trying... I can deliver to Gmail and every other major email
           | provider without issue, and even MS seems to be split into a
           | couple different backing orgs.
        
           | magguzu wrote:
           | This isn't unique to Cloudflare. Microsoft email spam filter
           | absolutely sucks. I hit it a lot too from my small provider.
        
         | EGreg wrote:
         | Can Cloudflare do an SMS service? That would be something :)
        
       | TechSquidTV wrote:
       | I feel like a lot of folks down here are focusing too much on the
       | agent part. That's purely marketing. No one who worked on the
       | service, I am sure, was building exclusively for agent usage.
       | 
       | This is simply the framing device that all marketing needs to
       | present these days.
        
         | bakugo wrote:
         | Of course it's just marketing, but that doesn't mean it's above
         | criticism, especially when it's shoved so hard down our
         | throats.
         | 
         | "Please stop talking about the thing we can't stop talking
         | about"
        
       | hardsnow wrote:
       | I seriously think this great! I've been saying that email is the
       | right interface for agents for a while now. It is available
       | anywhere, natively threaded, and works for asynchronous long-form
       | communication. Comes with great clients as well.
       | 
       | I've been developing last three months by emailing Claude, with
       | email threads mapping to an isolated workspace and claude -p.
       | Works super well, especially when trying to get some coding done
       | between everything else.
       | 
       | With right CLAUDE.md and a bit of workflow tooling this extends
       | itself to building other kinds of agents as well. For example, I
       | do my bookkeeping by emailing Claude my statements and receipts,
       | which it then imports into a plain-text accounting system. And
       | we've proven this in corporate environment as well, creating
       | agent that can troubleshoot more complex issues by correlating
       | diagnostic logs against product source code.
       | 
       | Once the basic "email agent" infrastructure is there, creating
       | new agents becomes super simple.
        
         | shauntest12321 wrote:
         | Awesome, checkout https://ainative.email
        
       | johtso wrote:
       | Another email sending service without support for idempotency?
        
         | esseph wrote:
         | AFAIK there is no communication service or protocol on the
         | internet designed with idempotency in mind. (That was
         | worthwhile and adopted)
        
           | johtso wrote:
           | Sure, but this is not a protocol, this is an API. APIs that
           | allow actions that cost money, potentially annoy users /
           | effect your reputation in the eyes of email recipients, I
           | believe, should allow the caller to supply a unique key to
           | enforce idempotency.
        
             | esseph wrote:
             | Track state on your side.
        
               | johtso wrote:
               | It's impossible to know whether an action completed
               | successfully if an error occurs between sending the
               | request and persisting the result
        
               | esseph wrote:
               | You also have no idea if it's been blocked or dropped
               | before delivery unless you're using things like tracking
               | pixels etc, right? And even then, that only works if they
               | aren't being blocked (Proton Mail can do this, etc.)
               | 
               | It just seems like this is trying to force something that
               | was never remotely designed for it.
        
       | mlhpdx wrote:
       | I'll have to take a look at this as a way to move off my
       | homegrown serverless email on AWS. Doesn't look like it has
       | parity with being able to send email from many subsystems safely
       | (with delay and veto)[1], but is pretty close on the receive side
       | automation[2].
       | 
       | [1] https://github.com/mlhpdx/email-origin [2]
       | https://github.com/mlhpdx/email-delivery
        
       | _pdp_ wrote:
       | Good! However, ...
       | 
       | Sending and receiving is in my mind the easy part. The hardest
       | part is to make this work with actual AI agents. This is the same
       | problem as with sub-agent communication because you need to
       | implement all kinds of additional fictionality to ensure the
       | agent is not just responding for no good reason, go into loops,
       | etc.
       | 
       | My $0.02 from experience.
        
       | cdrnsf wrote:
       | If I get _one_ email from your agent, I 'm torching your entire
       | domain.
        
       | ttul wrote:
       | How might this affect
       | https://www.ycombinator.com/companies/agentmail?
        
       | pupppet wrote:
       | After ticking every documented box to get out of AWS SES sandbox
       | mode and being told nope and we can't tell you why, I'm all for
       | this.
        
       | opengrass wrote:
       | No thanks I'll keep my Mailgun. After 2.5M it's half the SES
       | bill.
        
       | csomar wrote:
       | This is a very long post just to say they're now running an SMTP
       | server. I've been sending and receiving emails from Workers for
       | two years; though for sending, you still need an external SMTP
       | server like SES or Postmark.
       | 
       | Don't get me wrong, sending (and delivering) emails is genuinely
       | hard. But we'll only know how good Cloudflare is at it after a
       | couple years of real-world experience.
        
       | cdrnsf wrote:
       | Slop spam? Slam?
        
       | freitzzz wrote:
       | If we're letting agents send e-mail, what's the point of reading
       | e-mail? Surely I can have an agent to reply to e-mail that other
       | agent has sent. Do we really want to create dead internet?
        
       | edsimpson wrote:
       | I wish they had developed the open source Inbox into a consumer
       | hosted email service for users. It would have been nice to see
       | more competition with Google and Microsoft.
        
         | rc_kas wrote:
         | Yeah I had thought this was what they were building when I
         | first heard they had an email project. I guess not.
        
       | AtNightWeCode wrote:
       | I never got email routing to work. I doubt this will work in the
       | general case.
        
       | karimf wrote:
       | Ok I just tried the service since I want to migrate from Resend.
       | 
       | Seems like you can only send email via the worker or REST API for
       | now?
       | 
       | Can I send via SMTP? I'm using Supabase and it needs the SMTP
       | credentials.
       | 
       | I can't find anything on the dashboard or on the docs, even
       | though last year they said it supports SMTP [0]
       | 
       | [0] https://blog.cloudflare.com/email-service/
        
         | tracker1 wrote:
         | Not to oversimplify the issue... but you could probably run a
         | small VPS and SMTP relay service that requires tls+auth and
         | just relays all email from your domain through to API calls.
         | You could probably get something operational in a couple hours
         | with Claude Code.
         | 
         | My first thought in reading this would be using this service
         | and the default mail app's structure to back end typical email
         | protocols so you can still use a regular email client to
         | access/use the system as a gateway.
         | 
         | That said, I still think Cloudflare is in a unique position to
         | compete with gmail/m365 mail/calandar/contacts... possibly
         | funding Thunderbird development to tighten the integration as a
         | mail client.
         | 
         | For that matter, I still think cloudflare is in a good position
         | to create a new
        
           | karimf wrote:
           | Oh yeah for sure. At that point, using SES is probably a
           | better option compared to running a VPS just for SMTP. I
           | posted that to let them know that SMTP support is a
           | requirement for some developers.
        
         | scrollaway wrote:
         | Yeah one of their devs
         | (https://news.ycombinator.com/threads?id=thomgo) said SMTP will
         | be available, but I cannot find any info on this either. I'm
         | glad to be switching from the horror that is Sendgrid, though.
         | I migrated a few projects that have basic contact forms and
         | it's been super easy so far.
        
       | ksajadi wrote:
       | I think this is going to be a really good service: the service
       | can be used easily with Workers making it super easy to not only
       | send transactional emails but use it for forms embedded in Pages.
       | I am very much looking forward to using this.
       | 
       | However, I still think AWS SES is the gold standard of
       | deliverability because of their constant monitoring of your
       | reputation (bounces etc). I always combine it with SendOps
       | (https://sendops.dev/) for easy setup and deep analytics to avoid
       | those issues.
        
       | dgb23 wrote:
       | It's certainly interesting that they provide an email service
       | now. In their documentation/blog recommendations they switched
       | their recommended approach twice or three times already.
       | 
       | If they establish a solid email solution I will likely use that
       | for some of the projects I'm hosting there.
        
       | pradn wrote:
       | How much do existing services trust new email service providers?
       | It would seem to be an uphill battle for Cloudflare to start a
       | new service. It's easy to automate from the start, meaning it's
       | easier to send spam. I suppose reputation is not simply based on
       | the domain the email comes from?
        
         | efalcao wrote:
         | Hi, I work on this team at Cloudflare. We've been sending email
         | for years via our free email routing product and email sending
         | is built on top of the same infrastructure, code and knowledge.
        
           | tracker1 wrote:
           | I hope you've (your org) been able to curate something
           | resembling higher level contacts with Microsoft. They seem to
           | be the single largest email provider that consistently has
           | deliverability issues.
        
       | cbg0 wrote:
       | How far off are we from Cloudflare releasing a Gmail competitor?
        
       | aaronbrethorst wrote:
       | I am so excited for this. I've used Amazon SES begrudgingly for
       | years and have wanted a better UI and easier routing level
       | automation.
        
       | potato-peeler wrote:
       | I can use this to set up my own custom mail service, like an
       | alternative to gmail? Or at the very least, my own personal mail
       | provider?
        
         | tracker1 wrote:
         | You'd need to write your own mail protocol host/gateway on top
         | of this service... Pop/smtp/imap, etc.
         | 
         | Also, search is a bigger/harder issue to solve, assuming you
         | want to support clients searching for emails without a full
         | scan of their mailbox for matches.
        
       | woodylondon wrote:
       | I would pay for Cloudflare Workers Paid ($5) in a heartbeat and
       | currently use the free version of cloudflare for all my DNS /
       | Hosting etc. Where it does not meet my needs i have Dokpoly +
       | Digital Ocean. I would use CloudFlare Containers. I currently pay
       | for resend.com for all my email API needs.
       | 
       | The problem is that once you're on the paid plan, you're exposed
       | to unlimited risk if your worker goes crazy due to a stupid code
       | bug or if you're hacked. As a solo dev, it's a risk I simply
       | cannot take; I could wake to a bankruptcy bill from Cloudflare.
       | Even as a company, an employee could sign you up and your
       | accounts team would have no idea of the risk.
       | 
       | I am using Supabase at the moment, and see they have a hard cap
       | now. and so does Vercel after they had some nightmare stories of
       | large bills in the past.
       | 
       | I am not sure why / what CloudFlare think about this - or simply
       | dont care.
        
         | NicoJuicy wrote:
         | They are working on it
         | 
         | Source : post on x from an employee
         | 
         | Side note: the bills from cloudflare are much lower than the
         | ones from AWS/Vercel when there's a mistake. The most I saw
         | passing by was 150EUR, with Vercel and AWS > 10 k.
        
         | laurisbernhart wrote:
         | 100% agree. Spending limits for Workers would be a game
         | changer.
         | 
         | There are many services I wanted to use Workers for but ended
         | up with some self hosted service simply because I can't
         | properly limit my monetary risk here.
        
       | bob1029 wrote:
       | I'm having a hard time figuring out if I could use this as a
       | replacement for something like AWS WorkMail or E365. The
       | "Agentic" inbox looks really nice, but is this intended for
       | humans to use? I am really confused due to the marketing hype.
        
       | AnonC wrote:
       | > Everyone already has an email address, which means everyone can
       | already interact with your application or agent. And your agent
       | can interact with anyone.
       | 
       | That's a huge assumption unless you exclude several countries
       | where people have a phone number but not really an email address
       | (or even if they do, they may not know what an email address is)
       | and exclude many very old (say, 70+) people who wouldn't know
       | what email is or what their email address is.
       | 
       | Moving on, I assumed the title meant the launch of a new consumer
       | email service or platform. Reading the announcement, it's not.
       | That was disappointing to me.
        
         | tracker1 wrote:
         | It is a new customer email service/platform... analogous to AWS
         | SES for being able to send emails. They also have a baseline
         | web email application.
         | 
         | That said, would be nice if CF offered an analog to gmail/m365
         | email, contacts and calendars as a service to go along side the
         | application access. As it is, I'd probably use a subdomain for
         | service based emails, separate from user emails if using this
         | service.
        
       | balupton wrote:
       | No mention in the announcement that it is restricted to the paid
       | plans. Also no mentioned of it in the paid plan comparison.
       | 
       | From the dashboard link:
       | 
       | > Enable Email Sending Email Sending is currently only available
       | with the Workers Paid plan. Upgrade your plan to start sending
       | emails.
        
       | sltr wrote:
       | > Email is the most accessible interface in the world
       | 
       | Email is one of the most gatekept interfaces in the world.
        
       | TimLeland wrote:
       | How easy is it to switch from other email providers?
        
       | schainks wrote:
       | Sendgrid is such an enshittified product, I am grateful this now
       | exists and integrates directly with tools I have on cloudflare
       | already.
        
       | fny wrote:
       | I've been very happy with agentmail.to for a while with great
       | success. You get 3K free emails per month with 3 inboxes. Paid
       | tier starts at $0.20 per 1000 emails.
       | 
       | Disclaimer: I don't work for agentmail.
        
       | gck1 wrote:
       | Not all email automation is spam and if you want your emails to
       | not end up in spam folder, you pretty much have to go with Google
       | Workspace and pay for essentially entire business suite when you
       | just want to send emails. I needed something like this for my
       | project and it's pretty much Google Workspace or nothing.
       | 
       | Cloudflare just filled a huge gap.
        
       | creatonez wrote:
       | AI agents should be nowhere near email, full stop. Who comes up
       | with this shit? Why would Cloudflare ruin their email
       | deliverability by allowing this?
        
       | lloydatkinson wrote:
       | Sounds like this is only for AI or something. Does it support
       | normal usage or only """agents"""?
        
       | paultopia wrote:
       | Hah, what I wish Cloudflare would supply in the email space is a
       | "prove you're a human" except for access to my inbox
        
       | 8organicbits wrote:
       | Pushing agent workflows over email has some risks not present for
       | HTTP. Transit security is still a problem for email as we're
       | stuck in the opportunistic encryption stage. If you decide to use
       | email-based agents, look into MTA-STS as a way to prevent
       | downgrade attacks. It looks like Cloudflare supports this, but it
       | isn't enabled by default or called out in the on-boarding
       | process.
       | 
       | https://developers.cloudflare.com/email-routing/setup/mta-st...
        
       ___________________________________________________________________
       (page generated 2026-04-16 23:00 UTC)