Free email on your own domain with Cloudflare Email Routing
Email Routing receives. It does not send. Cloudflare's own documentation is explicit: it "does not support sending or replying from your Cloudflare domain". When you reply to a forwarded message, the reply goes out from your destination inbox, so a customer who emails info@yourbusiness.com.au gets an answer from yourname@gmail.com.
For a lot of businesses that single sentence ends the discussion, and it is buried three pages deep in most guides on this subject. Decide it now rather than after the address is on your van.
Cloudflare will give you unlimited addresses on your own domain and forward them to an inbox you already have, for free, with no mailbox to manage. That is a genuinely good deal for the case it fits, and a trap for the case it does not. This guide covers the real limits, the DNS it writes into your zone, and the point where you should stop and buy actual mailboxes instead.
What it actually is
Email Routing is a forwarder. Mail addressed to anything@yourdomain.com.au arrives at Cloudflare, which matches it against your rules and passes it on to a verified inbox somewhere else. Nothing is stored, there is no mailbox, and there is no webmail to log into.
Worth knowing before you go looking for it: Email Routing is now part of a larger product called Cloudflare Email Service, and the dashboard path is Compute, then Email Service, then Email Routing. Most tutorials still describe a standalone Email tab that no longer matches what you will see, which is the usual reason people conclude the feature has been removed.
What it costs
Nothing. It runs on the Free plan, there is no per-address charge, and the number of addresses on your domain is effectively unlimited within the rule limits below. You do need your domain's DNS hosted at Cloudflare, which is also free, and which for a .com.au means leaving the domain registered with your Australian registrar and pointing its nameservers at Cloudflare.
The limits that actually bite
| Limit | Value | What it means for you |
|---|---|---|
| Routing rules per domain | 200 | Each rule maps one address pattern to one destination. Generous for a small business. |
| Destination addresses per account | 200 | Shared across every domain in the account, and each one must be verified before it will receive anything. |
| Inbound message size | 25 MiB | Larger messages are rejected. Anyone sending you big attachments will need another route. |
| Sending from your domain | Not supported | The one in the box above. Replies come from the destination inbox. |
| One rule, one destination | Yes | Forwarding a single address to two people requires a Worker that calls forward() once per destination. There is no tick box for it. |
Two more limitations worth knowing
- Bounces do not reach the sender. Cloudflare does not forward non-delivery reports to the original sender, so if a forward fails, the person who emailed you gets no notification that it did not arrive. They will assume you are ignoring them.
- Inbound mail failing DMARC is rejected. Email Routing rejects incoming messages that fail authentication according to the sender's own DMARC policy. This is correct behaviour and occasionally surprising: a supplier with a badly configured domain can find their mail to you refused, and the fault is at their end.
- No internationalised local parts.
info@piñata.esworks,piñata@piñata.esdoes not.
Setting it up
-
Check what your MX records say right now
dig MX yourdomain.com.au +short. Enabling Email Routing replaces your MX records. If that command returns Microsoft 365, Google Workspace or your host's mail servers, then mail is being delivered to real mailboxes today and turning this on will take it away from them. Stop and read the last section of this page first. -
Verify a destination inbox
Add the address you want mail forwarded to. Cloudflare sends it a verification link, and until someone clicks that link the destination does not work. A rule pointing at an unverified address fails quietly, which is the most common "it is not forwarding" support question.
-
Let Cloudflare write the DNS
Accept the records it offers rather than hand writing them. It adds MX records under
mx.cloudflare.netand an SPF record on the root domain. Details in the next section. -
Create addresses, or turn on catch-all
Either add individual rules (
info@,accounts@,hello@) or enable the catch-all, which forwards every address on the domain to one inbox. Catch-all is convenient and it will also forward every piece of spam aimed at addresses that never existed. -
Send a real test, then reply to it
Email the new address from an outside account and confirm it arrives. Then hit reply and look at the From address on your reply. That is the moment the limitation becomes real, and it is much better experienced now than in front of a customer.
What it writes into your DNS
Cloudflare provisions these automatically, and it is worth understanding them because they will show up in any future audit of your zone:
| Record | Value | Purpose |
|---|---|---|
MX × 3 | Hostnames under mx.cloudflare.net, each with a different priority | Routes incoming mail to Cloudflare. |
TXT (SPF) | v=spf1 include:_spf.mx.cloudflare.net ~all | Authorises Cloudflare's infrastructure for the domain. |
TXT (DKIM) | On a Cloudflare selector subdomain | Signing, added on the domains where Cloudflare handles it. |
Cloudflare announces its inbound mail servers under *.mx.cloudflare.net, and the specific hostnames and priorities differ between zones. Cloudflare's own documentation illustrates this with names like amir, linda and isaac; the domain this website runs on was issued a route1, route2, route3 set instead. Both are correct, for their own zone.
Take the values from your own dashboard. A guide that gives you literal MX hostnames to type in is giving you somebody else's.
If you already had an SPF record, check what happened to it. You are allowed only one SPF record per domain, and a second one is a misconfiguration rather than a merge. If you also send through a CRM, a mail platform or a website contact form, all of those need to be inside the same single record.
A practitioner note from doing this on our own domain. An API token with DNS edit rights will happily enable Email Routing and write the MX and SPF records, and then return 403 on the rules and addresses endpoints, so the forwarding rules themselves cannot be created. The missing permission is Zone, Email Routing Rules, Edit, and the reason it is hard to find is that it does not appear in the permission list until the token already has a Zone resource selected.
The practical answer, if you only need it once: create the rules in the dashboard by hand. It takes a minute and costs nothing.
When to use it, and when to pay instead
| Situation | Verdict |
|---|---|
A new business that wants hello@ on the domain today, replying from a personal address is fine | Use it. This is exactly what it is for. |
Catching info@, sales@, accounts@ and funnelling them to one person | Use it. Cheaper and simpler than aliases on a paid plan. |
| Forwarding a legacy domain after a rebrand | Use it. Ideal, since nobody needs to send from the old domain. |
| You need replies to come from your business address | Pay for mailboxes. Microsoft 365 or Google Workspace. There is no workaround inside Email Routing. |
| Two or more staff need their own addresses and calendars | Pay for mailboxes. Forwarding everyone into one inbox stops working the day the second person is hired. |
| You send quotes, invoices or anything a customer must trust | Pay for mailboxes. An invoice arriving from a gmail address is exactly what payment redirection scams look like. |
That last row is the one we would push hardest on. If your business emails invoices, the sending address is part of your fraud protection, and training customers to accept replies from a personal account undoes it. Our IT side has written about how payment redirection scams actually work, and about setting up business email properly when you reach that point.
Questions we get asked
Can I reply from my domain address?
Not with Email Routing alone. Replies are sent from the destination inbox. Some people work around this by adding a send-as identity in Gmail through a separate SMTP provider, which works but is no longer a free single-product setup and is more moving parts than most small businesses want.
Will it break my existing email?
Yes, if you already have mailboxes, because enabling it replaces your MX records. Check dig MX yourdomain.com.au +short first. If that returns Microsoft or Google, do not enable Email Routing on that domain.
Is there a limit on how many addresses I can have?
200 routing rules per domain, and 200 verified destination addresses per account shared across all your domains. Catch-all covers every possible address with a single rule.
Does it work on a .com.au domain?
Yes. The domain stays registered with your Australian registrar and only its nameservers point to Cloudflare. Cloudflare Registrar does not sell .au domains, but Email Routing does not require you to register with them.
What happens to spam?
It gets forwarded along with everything else, then filtered by whatever your destination inbox uses. Gmail and Outlook are both good at this. Turning on catch-all increases the volume noticeably, because spam aimed at addresses that never existed now has somewhere to go.
The short version
Cloudflare Email Routing gives you free, unlimited addresses on your own domain forwarded to an inbox you already have, and it is a genuinely good answer for a sole trader, a rebrand, or catching a handful of role addresses. It cannot send, so replies come from wherever you forward to, and it does not tell senders when a forward fails. Check your existing MX records before enabling it, take the MX values from your own dashboard rather than a tutorial, and move to real mailboxes at the point where either a second staff member or a customer invoice enters the picture.
General guidance only, current at the review date above. Cloudflare has been actively reorganising this product into Cloudflare Email Service, so check its current documentation before relying on any specific figure here.
Where this comes from
- Cloudflare: Email Routing postmaster, the source of the sending limitation, the non-delivery report behaviour, the DMARC rejection rule, the SPF value and the MX server naming.
- Cloudflare: Email Service limits, the source of the 200 rule, 200 destination and 25 MiB figures, and the one rule to one destination behaviour.
- Cloudflare: route emails, the source of the current dashboard path.