Operator Notes
5 min readWhat is Flowmails?
A Cloudflare-native email routing platform that keeps your inbox and outbox in your own D1, with a REST API on top.
Self-hosted · CFFlowmails
Runtime v0.1
Journal
Operator notes on Cloudflare-native email.
Long-form writing about self-hosted email in D1, Workers-native routing, the REST API, and the parts of the platform that show up in the security review.
Categories
Tags
alternativeamazon-sesapiauditautomationcatch-allcloudflarecloudflare-apicloudflare-email-routingcloudflare-workerscompliancecostcustom-domaincutoverd1data-residencydata-sovereigntydeep-divedeliverabilitydkimdmarcemail-routingemail-servicesemail-webhookhelpdeskhmacinboundleast-privilegelimitationsliteral-matchersmail-servermailgunmigrationmulti-tenantpostfixpostmarkpricingproduct-overviewr2resendrest-apiretryroute-tablesruntimescoped-tokenssecurityself-hostedsendsendgridspfsupportsupport-inboxtcotickettransactional-emailtutorialvendor-lock-inwebhookwebhooks
22 posts
Deep Dive
12 min readCloudflare API token permissions, explained
The exact scopes Flowmails needs, the principle of least privilege, and the audit trail you can show your security reviewer.
Tutorial
6 min readHow to send transactional email from your Cloudflare custom domain
Why most transactional-email providers are overkill for a Cloudflare-native team, and how Cloudflare Email Services + a Worker gets you there in a day.
Deep Dive
7 min readSelf-hosting your email data in Cloudflare D1 (no vendor lock-in)
The architectural case for putting inbox and outbox in your own D1 database, and what that means in practice for compliance, exports, and exit plans.
Deep Dive
8 min readHow Workers-native email routing actually processes your inbound mail
A tour of the runtime: Email Routing, the Worker, the R2 bucket for attachments, and the D1 tables behind a single inbound message.
Tutorial
10 min readCustom Email Routing on Cloudflare: Build Your Own Address Book
Why a catch-all isn't always enough, how Flowmails route tables replace it with explicit literal-matcher rules, and how to switch safely.
Tutorial
8 min readWiring your product into the inbox: REST API and webhooks for email automation
The shape of the Flowmails API, when to use webhooks vs polling, and a worked example of inbound-to-ticket automation in 30 lines.
Deep Dive
10 min readCloudflare Email Routing alternative: the parts that need a layer on top
Cloudflare Email Routing is the world's best front door for inbound mail. It isn't a database, an inbox UI, a REST API, or a send path. Here's what you add — and why the answer is a self-hosted Worker, not another SaaS.
Comparison
9 min readResend vs Flowmails — when hosted API wins and when self-hosted wins
Resend is the fastest possible first-send. Flowmails is the same primitive with your D1, no per-email pricing, and a Cloudflare account under your control. Pick Resend or Flowmails based on which of those you actually want.
Comparison
9 min readSendGrid alternative on Cloudflare — when self-hosted replaces an ESP
SendGrid is a great hosted ESP. If you want data residency, no per-email fees, and a control plane on the same Cloudflare account as your Workers, Flowmails is the switch that keeps the same operational model.
Comparison
10 min readPostmark alternative on Cloudflare — transactional-only, self-hosted
If your team only used Postmark for transactional mail, switching to Flowmails keeps the same shape and removes the per-email fee. Newsletter / broadcast stays on whatever tool you have.
Comparison
10 min readMailgun alternative you can self-host on Cloudflare
Mailgun's hosted breadth (validation, lists, optimisation) is more than most teams need. Switch to Flowmails for the send / receive path; keep Mailgun only if you depend on its proprietary tools.
Comparison
10 min readAmazon SES alternative on Cloudflare, not AWS
SES is excellent at volume. Flowmails is what you ship when you want email on the same Cloudflare account as your Workers, R2, and Pages — no separate AWS relationship, no per-email fees on top.
Deep Dive
13 min readTransactional email pricing on Cloudflare — the full TCO picture
Transactional-email pricing splits into per-email fees (Resend, SendGrid, Mailgun, SES), bundled tiers (Postmark Pro), and flat platform fees (Cloudflare-native stacks like Flowmails). Here's the same-volume comparison.
Tutorial
12 min readSelf-hosted mail server on Cloudflare — skip Postfix, route via Workers
Running your own Postfix / Exim / Dovecot stack is a real ops burden. Cloudflare Email Routing + a Worker gives you a self-hosted email platform without running an MTA — the runtime is the same one as the rest of your stack.
Deep Dive
13 min readCloudflare Workers email cost — Workers + Email Services + D1 + R2
Cloudflare's email path runs through four primitives that each bill separately. Here's how Workers per-request, Email Services per-email, D1 read/write/storage, and R2 storage / operations stack up — and how to keep the bill predictable.
Tutorial
12 min readCloudflare Email Routing REST API send — getting outbound working
Cloudflare Email Routing handles inbound. For sending, you need Email Services + a Worker. Here's the REST API contract for outbound send, how the threading shape works, and how Flowmails wraps it.
Tutorial
8 min readBuild a helpdesk on Cloudflare Email Routing — 30 lines, one Worker
Cloudflare Email Routing + a small Worker + a D1 schema is enough to route inbound mail into a ticket pipeline. Here's the minimum viable ticket system and the schema behind it.
Tutorial
9 min readMigrate from Resend to Flowmails — an 8-step cutover checklist
The Resend → Flowmails migration is mostly swap-the-SDK, but DNS, webhook fan-out, and template portability all have to land in the same PR. Here's the 8-step order that keeps the cutover reversible.
Deep Dive
8 min readMulti-tenant support inbox on Cloudflare — per-tenant routing & metadata
Run support@, billing@, and abuse@ inboxes across tenants on a single Cloudflare Worker. Per-tenant routing, metadata injection, webhooks, and the D1 schema to back it.
Tutorial
10 min readEmail webhook on Cloudflare Workers — HMAC, retries, idempotency
Receive email events in a Cloudflare Worker: HMAC-SHA256 signature verification, retry schedule, idempotency key (SMTP Message-ID), and the failure modes that catch teams out.
Tutorial
10 min readDKIM, SPF, and DMARC on Cloudflare Email Routing — the parts you still need
Cloudflare Email Routing auto-signs DKIM for the zone. You still publish SPF and DMARC yourself. Here's what each record does, the exact strings to use, and how to monitor your alignment.