From domain to inbox in 8 steps.

• A domain you own, at any registrar.
• A free Cloudflare account.
• The inbox that should receive the mail (any provider).
• A second mailbox to send a test from.
• macOS or Linux (x86_64 or arm64), with curl for the installer or Homebrew (and git only if you install from a clone).

Already use this domain for a website or email? Note its DNS records now. You will copy them into Cloudflare in step 4.

Done when: you can log in to your registrar, Cloudflare and both mailboxes.

1. Run the one-line installer. It downloads the cmail binary for your system, checks its SHA-256 checksum and installs it in ~/.local/bin. No sudo needed.
2. If it says ~/.local/bin is not on your PATH, run the export PATH line it prints.
3. Create your private config file and choose your addresses (default: hello).

curl -fsSL https://raw.githubusercontent.com/luongnv89/cmail/main/install.sh | bash
export PATH="$HOME/.local/bin:$PATH"
cmail --version
cmail config init
cmail config set ADDRESSES hello,contact

Add the export PATH line to your shell profile to keep it. Config lives in ~/.config/cmail/.env (mode 600); cmail config path prints it.

Use Homebrew? brew install luongnv89/tap/cmail installs cmail and its shell completions instead.

Prefer to review the code first? Clone it and build that checkout (needs Rust and cargo): git clone https://github.com/luongnv89/cmail, cd cmail, then bash install.sh --local (or cargo install --path .).

Done when: cmail --version prints cmail 0.4.0.

1. Open My Profile → API Tokens → Create Token → Custom token → Get started.
2. Give the token any name you will recognise, for example cmail yourdomain.com.
3. Add the four permissions shown on the right.
4. Account Resources: Include → the account that owns your domain.
   Zone Resources: Include → Specific zone → your domain.
5. Create the token and copy it. You paste it in the next step.

Domain not on Cloudflare yet? Add it first (step 4) and keep this token. Only if you want cmail setup to add the domain for you, set Zone to Edit and Zone Resources to All zones from an account → your account. Never choose All accounts or All zones.

cmail never edits other DNS records, so the token needs no DNS permission: Cloudflare adds the Email Routing records itself.

Never paste the token into chat, a web page or a screenshot. cmail asks for it with hidden input.

Done when: the token is created with all four permissions and copied somewhere private.

Only needed if your domain is not on Cloudflare yet. Already listed as Active under Domains in Cloudflare? Tick this step and go on: cmail setup will say zone already active on Cloudflare.

1. Open the Cloudflare dashboard → Domains → Add a domain. Enter your domain and choose the Free plan.

   Prefer the terminal? Cloudflare’s own CLI, cf (beta, needs Node.js 22 or newer), can add the domain instead. Copy your Account ID (not Zone ID) from the dashboard, then run npm install -g cf, cf auth login, cf zones create --account-id <account ID> --name yourdomain.com and, when it is done, cf auth logout (cf’s sign-in can do far more than cmail’s token). Either way, cmail’s token can stay at Zone: Read (step 3). The cf route may not copy your existing DNS records, so check them carefully in the next item.

2. Check the DNS records Cloudflare found. Add any you still need (website, MX, TXT).
3. Follow Cloudflare’s instructions to switch nameservers at your current registrar: turn off DNSSEC (remove DS records) first, then replace all nameservers with the two Cloudflare shows. Save.

Propagation can take up to 24–48 hours. You do not have to wait here: in step 5, cmail setup checks every 20 seconds for up to 20 minutes, and you can rerun it any time.

Done when: your domain is listed in Cloudflare and your registrar uses Cloudflare’s two nameservers (Cloudflare may still show Pending for a while).

cmail setup

Answer two questions, then paste your token:

1. Receiving inbox, e.g. [email protected]
2. Your domain, e.g. example.com

cmail then finds your domain on Cloudflare (or adds it, if it is not there yet and your token has Zone: Edit; see step 3), waits until it is active, enables Email Routing and adds a forwarding rule per address. It stops only when it needs you: nameservers still switching (step 4) or the verification email (step 6).

Done when: setup is running past the token step. Keep the terminal open.

1. Open your receiving inbox. Check Spam too.
2. Open the email from Cloudflare and click Verify email address.
3. Go back to the terminal. cmail notices within 15 seconds and finishes.

No email? In Cloudflare → Email Routing → Destination addresses, resend it. Then rerun cmail setup.

Done when: the terminal shows Receiving is set up.

1. From a different mailbox, email hello@your-domain.
2. Check it arrives in your receiving inbox (and Spam).
3. Repeat for each address. cmail list shows them all.

Sending from the receiving inbox itself can be silently dropped by some providers, so it is not proof.

Done when: a test message arrives for every address.

Sending is optional. Skip this if you only need to receive. It needs a Gmail account.

Google has announced it will remove third-party “Send as” starting January 2027. Check Google’s help first.

cmail send-as

1. Create a Google App Password (needs 2-Step Verification).
2. Gmail → Settings → Accounts and Import → Send mail as → Add another email address.
3. Enter the SMTP settings on the right. Confirm with the code Gmail emails to your new address.

App Passwords may be unavailable on work/school accounts or with Advanced Protection. Don’t disable security to work around it.

Done when: a message sent “from” your address reaches another mailbox, or you skipped this step.