Open source · MIT licensed

Organisational email, under your control.

Personal and shared mailboxes, Exchange-style delegation, and accountable administration — built for small organisations and for teams spread across places and reporting lines. It runs in your own Cloudflare account, on your own domain.

Deploy your own Security & assurance View the source

MIT licensed source Your domain, your data Documented mail standards

Product tour

A familiar mail experience, with the operating controls visible

These are real cmail surfaces populated with fictional demonstration data. Personal mail, shared work, and administration stay connected without sharing passwords or hiding who can do what.

cmail shared Community Enquiries inbox showing mailbox navigation, unread messages, importance, attachments, search, and bulk actions — **Personal and shared mailboxes in one workspace** Move between your own mailbox and delegated team addresses; unread counts, folders, search, importance, attachments, and shared operational state remain visible.

cmail management overview showing account, mailbox, message, deployment readiness, and directory privacy summaries — **Management overview** Identity, mail flow, readiness, policy, directory privacy, and operational activity in an Entra-inspired management workspace.

cmail shared mailbox administration showing named delegates and Read, Send as, and Full access permissions — **Shared mailbox delegation** Create functional addresses and grant each person Read, Send as, or Full access—with no shared sign-in.

cmail signature settings showing a personal signature layered above a locked organisation signature — **Personal and organisation signatures** People can maintain their own signature unless a manager configures and locks it. The optional organisation signature is appended beneath it.

cmail policy management showing a current organisation IT policy and acknowledgement progress — **Versioned IT policy acknowledgement** Publish the current organisation policy, require acknowledgement before mail access, and retain the acceptance record.

Capabilities

A focused mail workspace

Everything a small organisation actually needs to run shared addresses accountably — and nothing that only exists to fill a comparison table.

Personal and shared mailboxes with Inbox, Sent, Drafts, Archive, Junk, and Deleted folders.
Read, Send as, and Full access delegation using each person’s own identity.
Versioned organisation IT policy acknowledgement enforced before protected mail and management access.
Personal signatures configurable by the user or a manager, with optional manager locking.
Optional organisation signature or disclaimer managed centrally and appended beneath the personal signature.
Compose, reply, reply-all, and forward with autosaved drafts, attachments, rich quoted-message rendering, and importance.
Google and Microsoft sign-in shown only when that provider is configured—including supported Outlook, Hotmail, and Live accounts.
Inbound and outbound delivery through Cloudflare Email Routing and Cloudflare Email Service, with Postmark as an alternative.
Mail trace and audit views for delivery investigation and recorded administrative activity.
SPF, DKIM, DMARC, MTA-STS, and TLS reporting guidance with a published standards gap register.
Organisation layers, units, roles, and positions with internal-by-default directory privacy controls.
Installable PWA with optional new-mail push notifications on supported devices.

Exchange-style delegation

Shared mailboxes with Read, Send as, and Full access. Every permission check stays on the server.

Google and Microsoft sign-in

Use either identity provider, or both. No separate password database to hold, rotate, or leak.

Inbound and outbound flow

Receive through Cloudflare Email Routing; send through the native Cloudflare Email Service or Postmark.

Unified mail trace

Delivery diagnostics and administrative audit folded into one investigation pane, the way an admin actually works.

Policy and signature controls

Gate protected access on the current policy, layer personal and organisation signatures, and let managers lock centrally configured personal details.

Inbound protection

Spam scoring, disguised-link and look-alike-domain detection, and a first-contact notice on unfamiliar senders.

Shared mailboxes

A team address without a shared password

Every delegate signs in with their own invited Google or Microsoft identity. Managers create functional addresses, control delivery state, and grant each person the least access they need — and it is visible afterwards who did what.

Read state, folders, stars, and Sent history are shared operational state, while unfinished drafts stay private to their author. cmail uses familiar Exchange-style terminology in an independent, Cloudflare-native implementation; it is not a Microsoft Exchange server.

ReadOpen messages and manage read or unread state.

Send asEverything in Read, plus composing and replying from the shared address.

Full accessAdds shared folder moves, stars, archive, trash, and restore.

Security & assurance

Standards-focused, and honest about the gaps

The deployment guide walks SPF, DKIM, DMARC, MTA-STS, and TLS reporting. Where a capability depends on something upstream that does not yet exist, the documentation says so rather than implying coverage.

Authenticated domains, deliberately configured

Deployment guidance covers SPF, provider-managed DKIM, and staged DMARC enforcement. cmail records trusted boundary results for investigation; the receiving provider remains responsible for applying its authentication policy.

Link and sender warnings

Anchor text that names one domain but points at another is flagged, as are look-alike internationalised hostnames. Following one shows the real destination first.

Nothing silently deleted

Quarantine files a message into Junk and records why. Retention is destructive, so it stays switched off until an operator deliberately enables it.

A public gap register

Review the security and assurance summary, including current limitations and the upstream gap register.

Architecture

Cloudflare-native, with responsibilities kept apart

The web application and the inbound Worker share D1 and R2, while interactive and mail-routing duties stay in separate runtimes.

Inbound

Email Routing invokes the Worker. It validates the recipient, enforces quota and rate guardrails atomically, parses the message, and stores metadata and content.

Email Routing → Worker → D1 + R2

Interactive and outbound

Cloudflare Pages runs the SvelteKit application. Signed-in users read and compose; external delivery goes out through the configured provider.

Browser → Pages → D1 + R2 → provider

Deploy

Bring your own domain and providers

Clone the repository, create D1 and R2, register your OAuth callbacks, store secrets in Cloudflare, and verify mail flow before routing real traffic.

cmail is pre-1.0 software. Work through the deployment and security checklists, define your backups, and test with controlled accounts before production use.

Read the full deployment and verification guide

# clone, configure, and validate
git clone https://github.com/Rob142857/cmail.git
cd cmail
pnpm install
pnpm setup
pnpm validate