Self-hosted organisational email on Cloudflare.
Quick start · Documentation · Security & assurance · Roadmap · Contributing · Security
Important
The button starts a guided import, not a one-click production deployment.
cmail is a Cloudflare Pages application plus a separate email Worker in one
pnpm monorepo, and Cloudflare's button only supports single-Worker apps. Use
it to import the repository, then complete the resource, secret, DNS,
routing, and bootstrap steps in Deployment and
verification.
Forks and private downstream repositories must replace the button's url=
value with their own repository — otherwise it always imports
Rob142857/cmail.
cmail is open-source email for organisations that want personal and shared mailboxes on a domain they control. It combines a SvelteKit web application with Cloudflare Email Routing, Workers, D1 (Cloudflare's hosted database), and R2 (Cloudflare's object storage). Outbound mail uses Cloudflare Email Service by default, with Postmark as an alternative.
Important
cmail is pre-1.0 software. Review the code and threat model for your environment, test recovery procedures, and complete the security checklist before handling sensitive or production mail.
- Portable by default — domain, organisation, branding, identity providers, safety limits, and deployment resources are configuration, not forks.
- Fail-closed sign-in — Google and Microsoft OpenID Connect, each shown only once fully configured, plus an invitation-scoped email one-time code for invitees hosted elsewhere. A manager invitation detects who hosts the address and offers the right path automatically; new users enrol through that manager-issued invitation, and returning users resolve only by their immutable provider subject or bound email identity. Managers can also restrict sign-in to approved countries, with a manager approval flow for legitimate exceptions.
- Personal and shared mailboxes — read, send-as, and full delegation, plus internal delivery between cmail mailboxes.
- Full mail flow — inbound via Cloudflare Email Routing; external outbound via Cloudflare Email Service or Postmark; To/Cc/Bcc, autosaved drafts, attachments, reply/reply all/forward, message importance, standards-compatible threading, search, bulk actions, and folders.
- Inbound protection — a spam score recorded on every message, quarantine only once a Manager sets an explicit threshold, organisation-wide sender allow/block rules, and warnings on disguised or punycode links.
- Durable outbound journaling — prevents a message from resending while recovering any missing Sent or internal copy.
- Signatures — personal, with safe rich formatting, optional organisation signatures or disclaimers, and manager-controlled locking.
- Manager tools — users, mailboxes, organisation structure, policy versions, audit records, mail trace, and travel approvals.
- Optional organisation directory — configurable layers, units, roles, and positions.
- Privacy-first public directory — only an explicitly public position's name, title, and work email can ever be exposed.
- Policy acknowledgement — required before mailbox access whenever a policy is published.
- Optional browser notifications — user-enabled, with privacy-minimised new-mail copy only.
- Responsive, installable PWA — works on desktop and mobile browsers.
cmail is an application, not a hosted service: your organisation owns its Cloudflare account, identity-provider configuration, outbound provider, DNS, backups, monitoring, privacy obligations, and provider charges. Check each provider's current terms before deploying.
cmail is not a bulk-marketing or campaign platform — it has no consent, list, RFC 8058 one-click unsubscribe, complaint, or deliverability controls for that use. See Email authentication and sender requirements before enabling external mail flow.
apps/web/ SvelteKit web application
apps/email-worker/ Cloudflare Email Routing and private native-outbound Worker
packages/shared/ Shared types, push utilities, and D1 migrations
scripts/setup.mjs Creates local Wrangler files from templates
scripts/verify-migrations.mjs Verifies the schema in a fresh temporary D1
docs/ Setup, deployment, security, and policy guidance
landing/ Optional static project landing page
Prerequisites:
- Node.js 24 LTS recommended (minimum 22.12), and the pinned pnpm 12.5.1
- A Cloudflare account with a domain on Cloudflare DNS
- A Google OAuth client, a Microsoft Entra application, or both
- Cloudflare Email Service (recommended) or Postmark, if you need external outbound mail
git clone https://github.com/Rob142857/cmail.git
cd cmail
corepack enable
pnpm install --frozen-lockfile
pnpm setuppnpm setup copies the committed Wrangler templates into local
wrangler.toml files and creates .dev.vars files with a fresh
development-only key. Replace every placeholder with your own values — local
Wrangler files and .dev.vars can hold tenant data or secrets and must never
be committed.
Follow Getting started for the rest: creating D1 and R2 storage, configuring OAuth and mail flow, and bootstrapping the first manager locally.
Follow Deployment and verification for the full sequence — provisioning Cloudflare resources, identity providers, outbound mail, deployment, inbound routing, and bootstrapping the first manager. Use the Configuration reference for every setting along the way.
cmail maps to ISO 27001, ISO 20000-1, ISO 27701, and related standards, and to ITIL service-management practices. See the ISO and ITIL alignment map for the detail, and Security, privacy, and assurance for the control matrix, limitations, and a deployment evidence checklist. None of this is a certification or legal opinion — your organisation still owns compliance for its own deployment.
- Full documentation index: docs/README.md
- To contribute, read CONTRIBUTING.md before submitting a change
- Report vulnerabilities through the private process in SECURITY.md
- For help, see SUPPORT.md
cmail is available under the MIT License. If it helps your organisation, consider contributing fixes, documentation, testing, or support back to the community.