Exchange-style delegation
Shared mailboxes with Read, Send as, and Full access. Every permission check stays on the server.
Open source · MIT licensed
Enterprise-grade email management, simplified.
Personal and shared mailboxes, Exchange-style delegation, and accountable administration — built for small organisations and for teams spread across places and reporting lines. It runs in your own Cloudflare account, on your own domain.
No proprietary lock-in Your domain, your data Standards-compliant mail
Capabilities
A focused mail workspace
Everything a small organisation actually needs to run shared addresses accountably — and nothing that only exists to fill a comparison table.
Google and Microsoft sign-in
Use either identity provider, or both. No separate password database to hold, rotate, or leak.
Inbound and outbound flow
Receive through Cloudflare Email Routing; send through the native Cloudflare Email Service or Postmark.
Unified mail trace
Delivery diagnostics and administrative audit folded into one investigation pane, the way an admin actually works.
Policy acknowledgement
Publish versioned acceptable-use text and record who accepted which version, before access is granted.
Inbound protection
Spam scoring, disguised-link and look-alike-domain detection, and a first-contact notice on unfamiliar senders.
Shared mailboxes
A team address without a shared password
Every delegate signs in with their own invited Google or Microsoft identity. Managers create functional addresses, control delivery state, and grant each person the least access they need — and it is visible afterwards who did what.
Read state, folders, stars, drafts, and Sent history are shared operational state, so the team sees one consistent mailbox. cmail uses familiar Exchange-style terminology in an independent, Cloudflare-native implementation; it is not a Microsoft Exchange server.
Security and compliance
Standards-compliant, and honest about the gaps
The deployment guide walks SPF, DKIM, DMARC, MTA-STS, and TLS reporting. Where a capability depends on something upstream that does not yet exist, the documentation says so rather than implying coverage.
Authenticated mail, by default
SPF, DKIM, and a DMARC policy you actually enforce. Mail failing authentication is rejected at the boundary, before it reaches a mailbox.
Link and sender warnings
Anchor text that names one domain but points at another is flagged, as are look-alike internationalised hostnames. Following one shows the real destination first.
Nothing silently deleted
Quarantine files a message into Junk and records why. Retention is destructive, so it stays switched off until an operator deliberately enables it.
A published gap register
The standards page lists what is implemented, what is deliberately out of scope, and what is blocked upstream — with the reasoning.
Architecture
Cloudflare-native, with responsibilities kept apart
The web application and the inbound Worker share D1 and R2, while interactive and mail-routing duties stay in separate runtimes.
Inbound
Email Routing invokes the Worker. It validates the recipient, enforces quota and rate guardrails atomically, parses the message, and stores metadata and content.
Email Routing → Worker → D1 + R2
Interactive and outbound
Cloudflare Pages runs the SvelteKit application. Signed-in users read and compose; external delivery goes out through the configured provider.
Browser → Pages → D1 + R2 → provider
Deploy
Bring your own domain and providers
Clone the repository, create D1 and R2, register your OAuth callbacks, store secrets in Cloudflare, and verify mail flow before routing real traffic.
cmail is pre-1.0 software. Work through the deployment and security
checklists, define your backups, and test with controlled accounts before
production use.
# clone, configure, and validate
git clone https://github.com/Rob142857/cmail.git
cd cmail
pnpm install
pnpm setup
pnpm validate