Easily creating and routing email addresses with Cloudflare Email Routing | Hacker News Reader

Easily creating and routing email addresses with Cloudflare Email Routing

blog.cloudflare.com

41 pointsjgrahamc8 comments

Probably worth citing a competitor: Firefox Relay https://relay.firefox.com/ , that has also an handy extension to do the same thing.

I personally created the same behaviour with zoho, basically I created a catchall rule and when I register to internet services I write google.com@mydomain.com, netflix.com@mydomain.com, etc.

This will be interesting for parked domains... less messing with third parties for MX records, etc...

> Cloudflare Email Routing service acts as an intelligent router at the transport layer, handling and modifying the SMTP envelope to deliver the message at its final destination but preserving the original headers and keeping the body intact. This approach ensures that things like SPF, DKIM, and other security or anti-spam protocols don't break and the recipient stays protected.

My understanding is that this is not technically feasible in some scenarios. Especially the one where the sender has SPF and DMARC, but not DKIM. In that case you can't keep the envelope sender address (SMTP MAIL FROM) as is when forwarding because that would fail SPF at the recipient. But if you rewrite the envelope sender address, then that will fail DMARC at the recipient (due to the SPF Authenticated Identifier being out of alignment with the header From, see RFC 7489). So no matter what you do, the message will fail validation at the recipient. I guess you could change the From header to bring it back into alignment, and that would work because DKIM is not being used, but now the recipient end user will see an incorrect sender address…

If you managed to solve this problem then I'd be really curious to know how!

Yes, I was confused as well because without rewriting SMTP MAIL FROM(or Return Path or Envelop) then SPF will definetely fail.

However, even if SPF failed, and DKIM is passed, it can still be trust worthy. Also, if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain.

> However, even if SPF failed, and DKIM is passed, it can still be trust worthy.

Yes. The problem is that some senders use SPF+DMARC, but not DKIM. It is fundamentally impossible to forward emails from these senders in a way that will look valid to the recipient.

> if the mail server support ARC(which gmail, for example, does) we can append our ARC so mail provider can look into it to investigate email forwarding chain

The problem with ARC is that just adding the header does nothing on its own; the recipient must also trust the forwarder to provide legitimate authentication results. ARC does not provide any mechanism for that trust to be extended automatically. So unless GMail makes a manual, conscious, explicit business decision to trust Cloudflare, an ARC header added by Cloudflare won't have any effect on GMail recipients.

This is great! It would be nice to have the rules implemented as an interception layer on top of the MX records, so the "catch-all" parts could be redirected to an upstream mail server.

It’s exciting!! It will be interesting to see if this product can be further expanded into Cloudflare Workers so that you can process inbound emails in workers for custom logic / storage and maybe also handle outbound email delivery from workers

ok, great, into Email now. What is this tho? Forwarding address creator? Blog post is detailed but could give a clearer overview.

If I have a domain on CF already, using CF's DNS etc..... what does this do, simply ensure that the SMTP process bounces around on the CF server until being handed over to the server listed in my MX record?

Reply on news.ycombinator.com