Skip to content
Sign inGet started
Help · MoreCloudflare Email Routing not working? What to check
Start here

Cloudflare Email Routing not working? What to check

Mail to your domain isn't arriving, or the forward stopped. Check the Activity log, then MX records, the destination address, SPF, DMARC and the spam folder.

On this page · 9 sections

Start with the Activity log

The Email Routing Activity log lists each message the domain received and what Cloudflare did with it. Expand a message to see its SPF, DKIM and DMARC results. The log covers 30 minutes to 30 days, or a range you pick. [1] Send yourself a test message from another account, then find it:

Not there at all
What it means: The mail never reached Cloudflare.
Where to look: MX records
Forwarded
What it means: Sent on to the destination address. [1]
Where to look: The destination's spam filter
Rejected
What it means: Refused because of SPF, DKIM or DMARC. [1]
Where to look: The sender's authentication
Dropped
What it means: Discarded by a rule or the configuration. [1]
Where to look: Your rules
Delivery failed
What it means: The destination address could not be reached. [1]
Where to look: The destination address
Handled
What it means: A Worker took the message. [1]
Where to look: The Worker's own logs.

Nothing in the log: the MX records

If a message never shows up, the sender's server is delivering it somewhere else. Email Routing needs exclusive control of the domain's root MX records. While another provider's MX records are still there, setup fails with error 2008, Non-Cloudflare MX records exist. [2]

  • Run dig MX example.com +short with your domain, or put it in the email DNS checker. Every answer should end in mx.cloudflare.net. [3]
  • If an old host's records are listed (Google, Microsoft, your registrar), remove them, or follow Cloudflare's guide to moving from another provider. [2]
  • Mail from an account on the old host can still be delivered inside that host and never leave it. Test from a different provider.

The destination address isn't verified

When you add a destination address, Cloudflare emails it a link. Until you open that email and select Verify email address, every rule that points to the address stays disabled. [4]

Check Compute → Email Service → Email Routing → Destination Addresses. A pending address can get the verification email again from there. [4] Look in the destination's spam folder for the first one.

Two SPF records

A domain may have only one TXT record starting with v=spf1. With two, SPF fails with a permerror and Email Routing doesn't work properly. [2] Cloudflare's record for the root domain is v=spf1 include:_spf.mx.cloudflare.net ~all. [2]

  1. Run dig TXT example.com +short | grep spf. More than one line is the problem. [2]
  2. In DNS → Records, delete the wrong one. If you can't tell which, delete every v=spf1 record on that name. [2]
  3. Open Compute → Email Service and enable Email Routing again. Cloudflare adds the correct SPF record back. [2]

Rejected: the sender's authentication

Email Routing checks the mail it receives. A message must pass SPF or carry a valid DKIM signature, and one that fails both is rejected. It also honors the sender's DMARC policy, so a message that fails it is rejected. [3]

  • This is about the sender's domain, not yours. Expand the message in the Activity log to see which check failed. [1]
  • Cloudflare notes that, because of how forwarding works, a restrictive DMARC policy can stop forwarded mail from being delivered. [3]
  • A sender on a block list is refused with an error such as 554 … found on one or more RBLs. [3]

Dropped: your rules

  • Each address needs a rule, or the catch-all. Mail that matches no rule falls through to the catch-all, and a catch-all set to Drop discards it. See Catch-all email on Cloudflare. [4]
  • If two rules have the same pattern, only the first one in the list handles the mail. [4]
  • Messages over 25 MiB are rejected. [5]

Forwarded, but not in your inbox

Forwarded means the destination's server accepted the message, not that it reached the inbox. [1][2] Look in the spam folder first. In the message's headers, Authentication-Results shows how the destination judged it, and X-Spam-Flag: yes means it was marked as spam. [2]

Email Routing rewrites the envelope sender so SPF passes at the destination, leaves the From: header unchanged, and adds DKIM signatures. [3] If every check passes and the mail still lands in spam, Cloudflare says the cause is likely reputation or content, not the setup. [2]

Skipping the forward with Ayoh

Most of the trouble above happens after a forward leaves Cloudflare and reaches another inbox. Ayoh keeps the mail in your own Cloudflare account instead: it points the catch-all at its Worker, so messages show as Handled and arrive in Ayoh, and it publishes the SPF and DKIM records when you connect a domain. Mail to an address you haven't created is refused with 550 No such mailbox, so the sender gets a bounce.

Sources

Read October 30, 2026.

PreviousCatch-all email on Cloudflare: set it up, and when not to