Understand forwarding
Cloudflare Email Routing receives mail for an address on the domain and forwards it to a verified destination mailbox. It is not a mailbox, outbound SMTP service or message archive. Replies are sent by the destination mailbox unless a separate sending service is configured.
Prepare DNS without splitting delivery
Inventory the current MX and sender-policy records before activation. A domain should not direct ordinary inbound mail unpredictably to two unrelated mail systems. Preserve SPF, DKIM and DMARC records used by outbound senders even though Email Routing handles inbound forwarding.
Verify destinations
Cloudflare sends a verification message before a destination can receive forwarded mail. Complete verification from the destination mailbox, protect that mailbox with strong authentication and remove destinations that no longer belong to an authorised person.
Design routing rules
Use a literal address when one alias should forward or drop mail. Avoid loops where the destination routes back to the source domain. A catch-all can attract spam and mistyped addresses; enable it only with a clear operational purpose and monitored destination.
Test delivery
Send from an unrelated external mail system, confirm arrival, original sender, attachments and reply behaviour, then inspect headers for SPF, DKIM and DMARC results. Test each important alias after changing MX records or destinations.
Recover a failed cutover
Restore the previous MX records and routing only from a recorded inventory. Keep both the old and new destination mailboxes monitored during DNS propagation. Do not repeatedly toggle routing while cached MX answers remain in use.
