cmail

Self-hosted organisational email on Cloudflare.

Quick start · Documentation · Security & assurance · Roadmap · Contributing · Security

[!IMPORTANT] The button starts a guided import, not a one-click production deployment. cmail is a Cloudflare Pages application plus a separate email Worker in one pnpm monorepo, and Cloudflare's button only supports single-Worker apps. Use it to import the repository, then complete the resource, secret, DNS, routing, and bootstrap steps in Deployment and verification. Forks and private downstream repositories must replace the button's url= value with their own repository — otherwise it always imports Rob142857/cmail.

cmail is open-source email for organisations that want personal and shared mailboxes on a domain they control. It combines a SvelteKit web application with Cloudflare Email Routing, Workers, D1 (Cloudflare's hosted database), and R2 (Cloudflare's object storage). Outbound mail uses Cloudflare Email Service by default, with Postmark as an alternative.

[!IMPORTANT] cmail is pre-1.0 software. Review the code and threat model for your environment, test recovery procedures, and complete the security checklist before handling sensitive or production mail.

#Key features

• Portable by default — domain, organisation, branding, identity providers, safety limits, and deployment resources are configuration, not forks.
• Fail-closed sign-in — Google and Microsoft OpenID Connect, each shown only once fully configured, plus an invitation-scoped email one-time code for invitees hosted elsewhere. A manager invitation detects who hosts the address and offers the right path automatically; new users enrol through that manager-issued invitation, and returning users resolve only by their immutable provider subject or bound email identity. Managers can also restrict sign-in to approved countries, with a manager approval flow for legitimate exceptions.
• Personal and shared mailboxes — read, send-as, and full delegation, plus internal delivery between cmail mailboxes.
• Full mail flow — inbound via Cloudflare Email Routing; external outbound via Cloudflare Email Service or Postmark; To/Cc/Bcc, autosaved drafts, attachments, reply/reply all/forward, message importance, standards-compatible threading, search, bulk actions, and folders.
• Inbound protection — a spam score recorded on every message, quarantine only once a Manager sets an explicit threshold, organisation-wide sender allow/block rules, and warnings on disguised or punycode links.
• Inbox rules — Outlook-style rules per mailbox that file new mail to Archive, Junk or Deleted, mark it read, star it or set its importance, with exceptions, ordering, and "run now" on the Inbox.
• Durable outbound journaling — prevents a message from resending while recovering any missing Sent or internal copy.
• Signatures — personal, with safe rich formatting, optional organisation signatures or disclaimers, and manager-controlled locking.
• Manager tools — users, mailboxes, organisation structure, policy versions, audit records, mail trace, and travel approvals.
• Optional organisation directory — configurable layers, units, roles, and positions.
• Privacy-first public directory — only an explicitly public position's name, title, and work email can ever be exposed.
• Policy acknowledgement — required before mailbox access whenever a policy is published.
• AI agent access over MCP, off by default — a remote Model Context Protocol server with OAuth 2.1 browser sign-in and consent. People choose the scopes and mailboxes an AI app may use; sending is a separate opt-in; every call is re-authorised and audited; Managers have an off-switch. See AI agents and MCP.
• Optional browser notifications — user-enabled, with privacy-minimised new-mail copy only.
• Responsive, installable PWA — works on desktop and mobile browsers.

cmail is an application, not a hosted service: your organisation owns its Cloudflare account, identity-provider configuration, outbound provider, DNS, backups, monitoring, privacy obligations, and provider charges. Check each provider's current terms before deploying.

cmail is not a bulk-marketing or campaign platform — it has no consent, list, RFC 8058 one-click unsubscribe, complaint, or deliverability controls for that use. See Email authentication and sender requirements before enabling external mail flow.

#Repository layout

apps/web/                    SvelteKit web application
apps/email-worker/           Cloudflare Email Routing and private native-outbound Worker
packages/shared/             Shared types, push utilities, and D1 migrations
scripts/setup.mjs            Creates local Wrangler files from templates
scripts/verify-migrations.mjs  Verifies the schema in a fresh temporary D1
docs/                        Setup, deployment, security, and policy guidance
landing/                     Optional static project landing page

#Quick start

Prerequisites:

• Node.js 24 LTS recommended (minimum 22.17), and the pinned pnpm 12.15.0
• A Cloudflare account with a domain on Cloudflare DNS
• A Google OAuth client, a Microsoft Entra application, or both
• Cloudflare Email Service (recommended) or Postmark, if you need external outbound mail

git clone https://github.com/Rob142857/cmail.git
cd cmail
corepack enable
pnpm install --frozen-lockfile
pnpm run setup

pnpm run setup copies the committed Wrangler templates into local wrangler.toml files and creates .dev.vars files with a fresh development-only key. Replace every placeholder with your own values — local Wrangler files and .dev.vars can hold tenant data or secrets and must never be committed.

Follow Getting started for the rest: creating D1 and R2 storage, configuring OAuth and mail flow, and bootstrapping the first manager locally.

#Deploy to production

Follow Deployment and verification for the full sequence — provisioning Cloudflare resources, identity providers, outbound mail, deployment, inbound routing, and bootstrapping the first manager. Use the Configuration reference for every setting along the way.

#Standards and assurance

cmail maps to ISO 27001, ISO 20000-1, ISO 27701, and related standards, and to ITIL service-management practices. See the ISO and ITIL alignment map for the detail, and Security, privacy, and assurance for the control matrix, limitations, and a deployment evidence checklist. None of this is a certification or legal opinion — your organisation still owns compliance for its own deployment.

#Documentation and contributing

• Full documentation index: docs/README.md
• To contribute, read CONTRIBUTING.md before submitting a change
• Report vulnerabilities through the private process in SECURITY.md
• For help, see SUPPORT.md

#License

cmail is available under the MIT License. If it helps your organisation, consider contributing fixes, documentation, testing, or support back to the community.