3 ms·

Easily creating and routing email addresses with Cloudflare Email Routing

39 points by jgrahamc 5y ago

tiernano 5y ago
This will be interesting for parked domains... less messing with third parties for MX records, etc...
i2shar 5y ago
This is great! It would be nice to have the rules implemented as an interception layer on top of the MX records, so the "catch-all" parts could be redirected to an upstream mail server.
ChrisArchitect 5y ago
ok, great, into Email now. What is this tho? Forwarding address creator? Blog post is detailed but could give a clearer overview. If I have a domain on CF already, using CF's DNS etc..... what does this do, simply ensure that the SMTP process bounces around on the CF server until being handed over to the server listed in my MX record?
edechamps 5y ago
> Cloudflare Email Routing service acts as an intelligent router at the transport layer, handling and modifying the SMTP envelope to deliver the message at its final destination but preserving the original headers and keeping the body intact. This approach ensures that things like SPF, DKIM, and other security or anti-spam protocols don't break and the recipient stays protected. My understanding is that this is not technically feasible in some scenarios. Especially the one where the sender has SPF and DMARC, but not DKIM. In that case you can't keep the envelope sender address (SMTP MAIL FROM) as is when forwarding because that would fail SPF at the recipient. But if you rewrite the envelope sender address, then that will fail DMARC at the recipient (due to the SPF Authenticated Identifier being out of alignment with the header From, see RFC 7489). So no matter what you do, the message will fail validation at the recipient. I guess you could change the From header to bring it back into alignment, and that would work because DKIM is not being used, but now the recipient end user will see an incorrect sender address… If you managed to solve this problem then I'd be really curious to know how!
- kureikain 5y ago
  Yes, I was confused as well because without rewriting SMTP MAIL FROM(or Return Path or Envelop) then SPF will definetely fail. However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Also, if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain.
  - edechamps 5y ago
    > However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Yes. The problem is that some senders use SPF+DMARC, but not DKIM. It is fundamentally impossible to forward emails from these senders in a way that will look valid to the recipient. > if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain The problem with ARC is that just adding the header does nothing on its own; the recipient must also trust the forwarder to provide legitimate authentication results. ARC does not provide any mechanism for that trust to be extended automatically. So unless GMail makes a manual, conscious, explicit business decision to trust Cloudflare, an ARC header added by Cloudflare won't have any effect on GMail recipients.
neshanthan 5y ago
It’s exciting!! It will be interesting to see if this product can be further expanded into Cloudflare Workers so that you can process inbound emails in workers for custom logic / storage and maybe also handle outbound email delivery from workers
musikele 5y ago
Probably worth citing a competitor: Firefox Relay https://relay.firefox.com/ https://relay.firefox.com/ , that has also an handy extension to do the same thing. I personally created the same behaviour with zoho, basically I created a catchall rule and when I register to internet services I write google.com@mydomain.com, netflix.com@mydomain.com, etc.

39 points by jgrahamc 5y ago

This will be interesting for parked domains... less messing with third parties for MX records, etc...

This is great! It would be nice to have the rules implemented as an interception layer on top of the MX records, so the "catch-all" parts could be redirected to an upstream mail server.

ChrisArchitect 5y ago

ok, great, into Email now. What is this tho? Forwarding address creator? Blog post is detailed but could give a clearer overview. If I have a domain on CF already, using CF's DNS etc..... what does this do, simply ensure that the SMTP process bounces around on the CF server until being handed over to the server listed in my MX record?

edechamps 5y ago

> Cloudflare Email Routing service acts as an intelligent router at the transport layer, handling and modifying the SMTP envelope to deliver the message at its final destination but preserving the original headers and keeping the body intact. This approach ensures that things like SPF, DKIM, and other security or anti-spam protocols don't break and the recipient stays protected. My understanding is that this is not technically feasible in some scenarios. Especially the one where the sender has SPF and DMARC, but not DKIM. In that case you can't keep the envelope sender address (SMTP MAIL FROM) as is when forwarding because that would fail SPF at the recipient. But if you rewrite the envelope sender address, then that will fail DMARC at the recipient (due to the SPF Authenticated Identifier being out of alignment with the header From, see RFC 7489). So no matter what you do, the message will fail validation at the recipient. I guess you could change the From header to bring it back into alignment, and that would work because DKIM is not being used, but now the recipient end user will see an incorrect sender address… If you managed to solve this problem then I'd be really curious to know how!

kureikain 5y ago
Yes, I was confused as well because without rewriting SMTP MAIL FROM(or Return Path or Envelop) then SPF will definetely fail. However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Also, if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain.
- edechamps 5y ago
  > However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Yes. The problem is that some senders use SPF+DMARC, but not DKIM. It is fundamentally impossible to forward emails from these senders in a way that will look valid to the recipient. > if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain The problem with ARC is that just adding the header does nothing on its own; the recipient must also trust the forwarder to provide legitimate authentication results. ARC does not provide any mechanism for that trust to be extended automatically. So unless GMail makes a manual, conscious, explicit business decision to trust Cloudflare, an ARC header added by Cloudflare won't have any effect on GMail recipients.

neshanthan 5y ago

It’s exciting!! It will be interesting to see if this product can be further expanded into Cloudflare Workers so that you can process inbound emails in workers for custom logic / storage and maybe also handle outbound email delivery from workers

musikele 5y ago

Probably worth citing a competitor: Firefox Relay https://relay.firefox.com/ https://relay.firefox.com/ , that has also an handy extension to do the same thing. I personally created the same behaviour with zoho, basically I created a catchall rule and when I register to internet services I write google.com@mydomain.com, netflix.com@mydomain.com, etc.