Set-up and user guide
Set up Mail App. Step by step.
Installing Mail App takes about ten minutes. If you're moving a domain you already own to Cloudflare, allow a little extra time for that to take effect. You'll need an email address, and a payment card if you're buying a domain.
1Create a free Cloudflare account
Mail App installs into your own Cloudflare account. Cloudflare's free plan is enough to receive email and try Mail App. Sending to other addresses needs Cloudflare's Workers Paid plan ($5 a month).
- Sign upGo to dash.cloudflare.com/sign-up.
- Enter your detailsType your email address and choose a strong password that you don't use anywhere else.
- Create the accountSelect Create Account.
- Confirm your emailOpen the email from Cloudflare and click the confirmation link.
2Set up your domain
Your domain is the part of your address after the @ (for example yourname.co.uk). It needs to be on your Cloudflare account.
Option A: buy a new domain from Cloudflare
Buying through Cloudflare is the easiest option. Cloudflare sells domains at cost, with no mark-up.
- Open DomainsSign in to Cloudflare and select Domains.
- Find a domainSelect Buy a domain (or Register domains).
- Buy itSearch for the name you want, pick an available ending (such as .co.uk) and pay.
- Wait for confirmationYour domain appears in your dashboard within minutes, and Cloudflare emails to confirm.
Option B: connect a domain you already own
- Add your domainIn Cloudflare, go to Domains › Onboard a domain.
- Choose the Free planEnter your domain (for example yourname.co.uk), select Continue and choose the Free plan.
- Note the nameserversCloudflare shows you two nameservers (for example anna.ns.cloudflare.com). Keep this page open.
- Open your registrarIn a new tab, sign in to the company you bought the domain from and find its DNS or Nameserver settings.
- Turn off DNSSECIf DNSSEC is switched on there, turn it off first.
- Change the nameserversReplace the current nameservers with Cloudflare's two, and save.
- CheckGo back to Cloudflare and select Check nameservers. It usually takes a few minutes, but can take up to 24 hours. Cloudflare emails you when it's ready.
3Install Mail App
There are three ways. All of them install into your own Cloudflare account, and updating later keeps your mail and settings.
The installer (recommended)
The installer does every step for you: storage, the app, its web address, Email Routing, the email records, sign-in protection, passkeys, download links and the API. You need Node.js 20 or later on your computer.
- See what token to makeRun the help command below. It lists the permissions your Cloudflare API token needs.
- Make the tokenIn Cloudflare, open My Profile › API Tokens, choose Create Token, then Create Custom Token and tick the permissions the help listed. The token is only ever sent to Cloudflare.
- Run the installerRun the setup command and paste your token when it asks.
- Answer three questionsPick your domain, choose your web address (mail.yourname.co.uk unless you change it) and type the email address you'll sign in with.
- Wait a minute or twoThe installer sets everything up. If your Cloudflare account can't send yet, it says so: receiving works straight away, and step 4 switches sending on.
- Open your inboxOpen your web address. There's no password: Cloudflare emails a one-time code to the sign-in address you chose, and you can add a passkey later.
npx @mrpwob/mail-app helpnpx @mrpwob/mail-app setup
Deploy to Cloudflare
One click copies Mail App to your GitHub account and deploys it to your Cloudflare account, with its storage. When it asks for DOMAINS, enter your domain. Leave the two Access settings as they are for now. Then:
- Add a web addressOpen Workers & Pages › mail-app › Settings › Domains & Routes and add a custom domain, such as mail.yourname.co.uk.
- Switch on sign-inOn the same page, switch on Cloudflare Access for that address. Copy the POLICY_AUD and TEAM_DOMAIN values it shows into the Worker's Variables and Secrets (as secrets).
- Send mail to the appOpen your domain's Email › Email Routing, switch it on and set the Catch-all to Send to a Worker, mail-app.
- Open itOpen your web address. You're the first admin.
The installer also sets up passkeys, download links and the API, so it's the easier way.
From the code
Clone the repo and deploy it yourself with Wrangler. The README walks you through every step, including Cloudflare Access.
4Turn on sending ($5 a month)
Receiving email is free on Cloudflare's free plan (storage needs a payment card on file). Sending email to other addresses needs Cloudflare's Workers Paid plan ($5 a month), which includes 3,000 emails a month. Cloudflare bills you directly. Cloudflare costs and limits
- Upgrade your planSign in to Cloudflare, open Compute › Workers plans, choose Workers Paid and complete checkout.
- Switch on sending for your domainIn Cloudflare, go to Compute › Email Service › Email Sending. Select Onboard Domain, choose your domain and click Done. Cloudflare sets up your SPF, DKIM and DMARC records for you.
- Check it workedOpen Mail App and go to Setup. Every light should be green.
If you send more than 3,000 emails a month, Cloudflare charges $0.35 for each extra 1,000. See Cloudflare's pricing page.
5Use Mail App as an app
There's nothing to download. Mail App adds itself to your Dock or home screen straight from your browser, opens in its own window and can show new-mail notifications and an unread count on its icon.
- Mac (Safari)Open Mail App in Safari, then choose File › Add to Dock. Open it from the Dock and go to Settings › Account to switch on notifications.
- Mac or Windows (Chrome or Edge)Open Mail App, then click the install button at the right of the address bar (or choose Install in the browser's menu). In Settings › Account you can also choose to open email links in Mail App.
- iPhone and iPadOpen Mail App in Safari, tap Share, then Add to Home Screen. Open it from your home screen and switch on notifications in Settings › Account.
- AndroidOpen Mail App in Chrome, open the menu and choose Add to home screen or Install app.
You'll stay signed in for 30 days at a time. When that runs out, Mail App asks you to sign in again with a code sent to your email.
6Invitations and video calls
You can invite people to any event in your calendar. They don't need Mail App: invitations work in Outlook, Gmail, Apple Mail and most other email apps.
Inviting people
- Add guestsOpen or create an event, type each person's email address under Guests and press Enter. Leave Email guests about this switched on and click Save.
- Their answersGuests answer Yes, Maybe or No in their own email app. Their answer appears next to their name on the event.
- ChangesIf you change the time, place or details, guests are sent the update. Removing a guest or deleting the event sends them a cancellation.
- Repeating eventsWhen you change one date of a repeating event, you're asked whether to change This event or All events. Guests only hear about the date you changed.
Invitations sent to you
An invitation from anyone shows as a card at the top of the email. Choose Yes or Maybe to add it to your calendar, or No to decline. Your answer is emailed back to the person who invited you. If they change or cancel the event later, your calendar is updated.
Video calls
- Teams, Zoom or Google MeetCreate the meeting in Teams, Zoom or Meet as usual, then paste its link into the event's Video call box. The event, and the invitation your guests receive, will show a Join button.
- A free video callClick Add a free video call to add a Jitsi Meet link. Jitsi Meet is a free video call service that runs in a web browser, with no time limit and nothing to install. Free apps for iPhone and Android are also available if your guests prefer.
- Starting a Jitsi callThe first person to join is asked to sign in once with a Google, GitHub or Facebook account to open the meeting. Everyone else simply clicks the link and types their name. If you'd rather your guests never see a sign-in, join a minute or two before the start time.
7Add more domains
Mail App can get email for more than one domain. Add the domain to your Cloudflare account, then run:
npx @mrpwob/mail-app@latest add-domain example.org
It switches on Email Routing for the domain with a catch-all to Mail App, adds its email records, switches on sending and adds it to Mail App's list. Leave out the domain to pick from a list.
To do it by hand instead, switch on Email Routing for the domain with a catch-all to mail-app, then add it on Mail App's Domains page.
8Updating
Admins see a notice in Mail App when a new release is out. Your mail, rules and settings are kept when you update.
- Installed with the installerRun the update command below.
- Installed from the codeRun git pull, then npm install and npm run deploy.
npx @mrpwob/mail-app@latest update
What's new in each version is in the release notes.
9Common questions
Can you read or access my email?
No. Mail App runs only on your own Cloudflare account. Your messages never pass through or sit on my servers, and I have no way into your mailbox.
What will Cloudflare and my domain cost?
Mail App is free and every feature is included, including team access and shared inboxes. Receiving mail is free on Cloudflare. Sending to other addresses needs Cloudflare's $5 a month Workers Paid plan, and extra Cloudflare charges may apply above your plan's limits (Cloudflare costs). A domain usually costs between £5 and £12 a year, depending on its ending (.co.uk, .com and so on).
What happens if you stop working on Mail App?
Your email keeps running. The code, storage and email set-up all live in your own Cloudflare account, and the code is open source, so anyone can carry on with it.
Is the AI assistant switched on?
No. The AI assistant is off until you switch it on in Settings, under AI assistant, one mailbox at a time. It runs on Cloudflare Workers AI inside your own account, and Settings shows exactly what it does and keeps. How it stays private
How is my mailbox kept secure?
Sign-in goes through Cloudflare Access with a passkey or a one-time code sent to your own email address. There's no password to guess or leak.
Can I have more than one email address?
Yes. Add as many mailboxes as you need, and give any mailbox extra addresses (such as hello@yourdomain.co.uk and support@yourdomain.co.uk) under Settings › Addresses. Replies go out from the address the email was sent to. Turn on catch-all and mail sent to a misspelt address on your domain still reaches you instead of bouncing.
Can I share a mailbox with my team?
Yes. Invite people from the People page and they sign in with their own email address. Each person sees only the mailboxes you give them. A shared mailbox, such as sales@yourdomain.co.uk, appears in the sidebar of everyone who shares it, emails are signed with the sender's own name and each reply shows who sent it.
How are attachments handled?
Attachments can be up to 3.5 MB in total on each email. For larger files (up to 95 MB), Mail App makes an encrypted download link instead, with an optional password and a 30-day expiry.
How does Mail App handle spam?
Cloudflare turns away mail that fails sender checks before it arrives. Mail App sends blocked senders and mail that fails DMARC to Spam, and checks mail from people you don't know for misleading links, fake brand names, lookalike and brand-new domains. You can block single senders or whole domains in Settings.
Why isn't my sign-in code arriving?
Cloudflare sends the code, and it only emails addresses that are allowed to sign in. Its page says a code has been sent either way, so check these in your Cloudflare dashboard:
- Zero Trust has a plan. Open Zero Trust. If it says Finish your account setup, select Choose a plan and pick the Free plan. No codes are sent until you do.
- You're typing an allowed address. In Zero Trust, go to Access controls, then Policies, and open the Mail App policy. Use one of the addresses listed there, or add the one you want.
- The address is a real inbox, not a forwarder. Forwarded codes are sometimes dropped on the way. Use the address the forwarder sends to instead.
Codes come from noreply@notify.cloudflare.com and last 10 minutes. Asking for a new code cancels the old one.
Who can get into my mailbox?
Only you and the people you invite. To sign in, each person uses a passkey or a one-time code sent to their own email address and stays signed in for up to 30 days. Only addresses on your People list can pass the sign-in page. Each person can open only the mailboxes you give them. The one exception is download links for large attachments: someone you send one to can open that single file without signing in. Each link is encrypted, expires after 30 days and can have a password.
What happens to my Cloudflare API token?
The installer only uses it while it runs, and only ever sends it to Cloudflare. Nothing is sent to me. You can delete the token in your Cloudflare profile when the installer has finished, and make a new one when you next update.
Where can I get help?
Bugs go in GitHub issues and questions in GitHub Discussions. I answer there, so the next person with the same question finds the answer too.
10Uninstalling and removing your data
Everything is in your own Cloudflare account, so you remove it in your Cloudflare dashboard. It takes about 10 minutes.
Step 1: delete the app
- Find itIn your Cloudflare dashboard, search for Workers & Pages.
- Open the appClick mail-app, then open Settings.
- Delete itScroll to the bottom, click Delete and confirm. This removes the app and its web address.
Step 2: delete the storage
- Find itSearch for R2 Object Storage.
- Open the bucketOpen the bucket named mail-app (it holds settings and attachments).
- Empty itSelect all the files, click Delete and repeat until the bucket is empty.
- Delete itIn the bucket's Settings, click Delete Bucket and confirm.
Step 3: turn off Email Routing
- Find itSearch for Email Routing and select your domain.
- Change the catch-allUnder Routing rules, set Catch-all to Drop, or send it to another address.
Step 4: remove the sign-in protection
- Find itSearch for Zero Trust.
- Delete the appsGo to Access › Applications. Delete Mail App (and Mail App: download links and Mail App: API if they're there).
- Delete the policiesUnder Access › Policies, delete any policies whose names start with Mail App.
// keep exploring
More of Mail App.
Stay in the loop
Subscribe for updates.
Leave your email and I'll tell you when there's a new version of one of my apps, or a new project to try. Nothing else.