Cloudflare Email Routing and DMARC Management: What They Do for Your Business

Cloudflare offers two email tools that small businesses often hear about: Email Routing, which forwards mail sent to addresses on your domain (such as info@ or quotes@) to inboxes you already have, and DMARC Management, which collects the reports that show who is sending email using your domain name. Both are available on all Cloudflare plans, including Free, as long as your domain uses Cloudflare DNS. The important thing to understand up front: Email Routing is forwarding, not a mailbox. It does not store mail, it does not give you an inbox to log in to, and it cannot share a domain with Microsoft 365 or Google Workspace. This guide explains what each tool does, where it fits and where it does not.

Email Routing: what it is

Email Routing receives mail for your domain and passes it on. You create routing rules, each pairing an address on your domain with one action:

• Send to an email: forward the message to a destination address (for example, a Gmail or Outlook mailbox).
• Send to a Worker: hand the message to a Cloudflare Worker, for developers who want to process mail with code.
• Drop: delete matching messages without delivering them.

Cloudflare's documentation lists the practical limits:

Item	Limit
Routing rules per domain	200
Destination addresses per account	200, shared across all domains
Inbound message size	25 MiB; larger messages are rejected
Destinations per rule	One (more requires a Worker)

Destination addresses must be verified: Cloudflare emails a verification link, and every rule pointing to that address stays disabled until someone clicks it.

Catch-all and plus addressing

• Catch-all rule: when enabled, any address at your domain that does not have its own rule is handled by the catch-all, including misspellings such as ifno@ instead of info@. That is convenient, but it also means spam sent to random made-up addresses reaches you. Many businesses leave catch-all off, or set it to Drop, once their real addresses are defined.
• Subaddressing: Email Routing supports "plus" addresses as defined in RFC 5233 (enabled in Email Routing settings). Mail to [email protected] matches the sales@ rule, which is handy for tracking which form or event a message came from.

What Email Routing does not do

• It is not a mailbox. There is no inbox, storage, calendar or webmail. Messages land in whatever mailbox you forward them to.
• It does not send your replies. When you answer a forwarded message from Gmail or Outlook, the reply comes from that mailbox's own address unless you configure that provider separately to send as your domain. Email Routing itself only handles incoming mail.
• It cannot coexist with another mail server on the same domain. Cloudflare's domain configuration docs state that Email Routing requires Cloudflare MX records on the root domain and "cannot use Email Routing with external mail servers." If your MX records point to Microsoft 365 or Google Workspace, enabling Email Routing on that domain would take mail away from them.
• It is not a security filter. Cloudflare does reject inbound mail that fails the sender's DMARC policy, mail that fails both SPF and DKIM, and senders on blocklists, but it does not replace the spam and phishing protection of a full email platform.

On the technical side, Cloudflare rewrites the envelope sender of forwarded messages (Sender Rewriting Scheme), adds DKIM signatures and supports ARC so the receiving mailbox can still evaluate authentication on forwarded mail. The visible From: header is not changed.

Where Email Routing fits for a business

Because it takes over the domain's MX records, Email Routing is best for domains that do not have their own mailboxes:

• Secondary and brand domains. If you own yourbrand.net or a campaign domain alongside your main domain, Email Routing can forward [email protected] to a real mailbox instead of letting that mail bounce.
• A former domain after a rebrand. Keep forwarding mail sent to old addresses while customers update their contacts.
• Very small setups before a full mail platform. A sole proprietor can receive mail at a professional address while deciding on a platform, with the understanding that sending as that address still needs a real provider.

For your main business domain, where staff need mailboxes, shared calendars, retention and security controls, a platform such as Microsoft 365 or Google Workspace remains the right tool. Our business email services page explains how we set those up.

Setting it up

According to Cloudflare's current documentation, the steps are:

1. In the Cloudflare dashboard, go to Compute > Email Service > Email Routing and select Onboard Domain. (Cloudflare has reorganized this menu recently, so labels may differ slightly in your account.)
2. Choose the domain and review the records Cloudflare will add: MX records, an SPF TXT record and a DKIM TXT record on the root domain.
3. Under Destination Addresses, add each mailbox you will forward to and click the verification link it receives.
4. Create a routing rule for each address, then decide what to do with the catch-all.
5. Test from a different account than the destination, since some providers discard messages that appear to come from the recipient's own address.

To move away later, Cloudflare recommends unlocking the routing records and adding the new provider's records before disabling Email Routing, because disabling it removes the MX, SPF and DKIM records it created.

What about sending? Cloudflare Email Sending

In April 2026 Cloudflare announced that Email Sending entered public beta, joining Email Routing under a product now called Cloudflare Email Service. It lets developers send transactional email (password resets, receipts, notifications) from Cloudflare Workers or a REST API. According to Cloudflare's changelog it requires the Workers Paid plan, and the limits page says new accounts start with low daily sending quotas that grow over time.

For most businesses this is a developer tool for applications, not a way to give employees an outbox. It does not provide mailboxes, and it is in beta, so we would not build critical workflows on it without testing.

DMARC Management: seeing who sends as your domain

DMARC is the DNS record that tells receiving mail servers what to do with messages that fail SPF and DKIM checks, and it asks them to send you aggregate reports. Those reports are XML files that are hard to read by hand. We covered the records themselves in why business emails land in spam; DMARC Management is a way to read the reports.

Key facts from Cloudflare's documentation:

• Available on all plans for domains using Cloudflare DNS.
• Works with any mail provider. It only reads reports, so your mailboxes can stay on Microsoft 365, Google Workspace or anywhere else. This is the part most businesses can use on their main domain.
• Apex domains only. It does not support subdomains.
• How it is enabled: go to Email > DMARC Management and select Enable DMARC Management. If you have no DMARC record, Cloudflare offers to add one. If you already have one, it adds an extra rua address so reports are delivered to Cloudflare as well as to any address you already use.
• It takes time. Cloudflare notes it can take up to 24 hours for the first report to arrive.
• It is labelled beta in Cloudflare's documentation.

How to use the reports

1. Let reports collect for a few weeks.
2. Review every sending source listed and its SPF, DKIM and DMARC results.
3. For each legitimate service (your mail platform, CRM, invoicing software, newsletter tool), fix its SPF include or DKIM key until it passes.
4. Investigate sources you do not recognize; they may be forgotten tools or someone spoofing your domain.
5. Only when legitimate mail passes consistently, move your DMARC policy from p=none to p=quarantine, then p=reject.

This last step is what protects your customers from emails that impersonate you, a common starting point for phishing (see our phishing red flags guide).

How it all fits with Microsoft 365 or Google Workspace

Domain	Mailboxes	Email Routing	DMARC Management
Main business domain	Microsoft 365 / Google Workspace	No (MX records belong to your mail platform)	Yes, if DNS is on Cloudflare
Brand, campaign or old domains with no mailboxes	None	Yes, forward to real mailboxes	Yes, and publish a strict DMARC policy if the domain never sends mail

Get it configured correctly

Core Florida IT is an independent IT provider, not a Cloudflare partner. We configure DNS, mail authentication and forwarding for businesses on Microsoft 365 and Google Workspace as part of our managed IT support. If you are not sure who is sending email as your domain, or your messages keep landing in spam, request a free IT assessment for your Miami-Dade or South Florida business.

Sources

• Cloudflare Email Routing overview (Cloudflare Docs)
• Enable Email Routing (Cloudflare Docs)
• Email routing addresses, catch-all and subaddressing (Cloudflare Docs)
• Email Service limits (Cloudflare Docs)
• Email Service domain configuration (Cloudflare Docs)
• Postmaster information (Cloudflare Docs)
• Email Sending is now in public beta (Cloudflare changelog)
• DMARC Management (Cloudflare Docs)
• Enable DMARC Management (Cloudflare Docs)