Yuva Email Worker for Cloudflare

Support e-mail through Cloudflare.No mail server to run.

Cloudflare® Email Routing receives the mail for your support addresses, and the open-source Yuva Email Worker hands each message to Yuva, signed. It lands in your shared inbox as a conversation your team answers.

Read the setup guide Worker source on GitHub →

What it is

Email Routing in front

Cloudflare Email Routing becomes the MX of your domain and receives the mail. Yuva does not listen for SMTP, so there is no mail server to install or keep patched.

A small open-source Worker

The Yuva Email Worker reads the raw message and the envelope, signs the request and posts it to Yuva. Parsing, threading and spam decisions stay on the server.

Real conversations

Mail to a support address opens or continues a conversation in the inbox, and the team answers from the same panel as chat and app messages.

How a message gets from the customer to your team

1A customer writes to one of your support addresses, for example support@example.com.
2Cloudflare Email Routing receives the message and passes it to the Yuva Email Worker.
3The Worker signs the raw message, both envelope addresses and a timestamp with HMAC-SHA256 under a secret you share with Yuva, and sends them to /ingress/email on your Yuva server.
4Yuva checks the signature and that the timestamp is within 5 minutes before it reads the message. A request with a wrong signature is refused.
5Yuva finds the e-mail channel for the recipient address and threads the message by In-Reply-To and References into the conversation it belongs to. Anything else starts a new conversation. A reply reopens the conversation.
6Your team answers in the panel. The reply is sent through the e-mail channel's own SMTP account, such as Amazon SES, Postmark or your own relay, from the same address and in the same thread. Replies do not go through the Worker.

Refusals reach the sender

When Yuva refuses a message for good, for example an unknown address, a blocked sender or a message that is too large, the Worker rejects it and the sender gets a permanent SMTP error with Yuva's reason.

If Yuva is unreachable

If Yuva answers with a server error, does not answer within 20 seconds or cannot be reached, the Worker can forward the message to an address you choose, as long as you set FALLBACK_FORWARD. That address must be a verified destination in Email Routing. The message then arrives as a plain forward and does not appear in Yuva. Without FALLBACK_FORWARD the delivery fails with an error and the sending server may retry later.

Set it up in a few steps

You need a Yuva server and a Cloudflare account that manages the domain.

1
In Yuva, open Settings → your inbox → Channels → E-mail and add the support address. Set a secret on the server and restart it:
```
YUVA_INGRESS_SECRET=<openssl rand -hex 32>
YUVA_INGRESS_AUTHSERV_ID=mx.cloudflare.net
```

Deploy the Worker to your Cloudflare account, using the same secret:

cd edge
bun install
bunx wrangler login
bunx wrangler secret put INGRESS_SECRET
bunx wrangler deploy --var YUVA_URL:https://support.example.com

3
In the Cloudflare dashboard, open your domain → Email → Email Routing and enable it. Cloudflare adds its MX and SPF records.
4
Under Routing rules, send each support address to the Worker yuva-edge. For a catch-all channel, point the catch-all rule at it.
5
Send a test message and watch the conversation appear in the panel.

Optional: keep mail during an outage by adding a fallback address to the deploy command:

bunx wrangler deploy --var YUVA_URL:https://support.example.com --var FALLBACK_FORWARD:you@example.org

Email Routing becomes the MX of the domain, so use a domain or subdomain that no other mail server handles.

Read the setup guide →

Not tied to Cloudflare

The Worker is one way to call /ingress/email. Any mail server or relay can post the raw message with the same signed headers, and a mail server that delivers to a command can pipe the message into yuva ingest-email. The request format is documented in the Worker's README.

Read the ingress contract →Other ways to bring mail in →

Questions and answers

Do I need to run a mail server?

Not for incoming mail. Yuva does not listen for SMTP; Cloudflare Email Routing receives the mail and the Worker passes it on. Replies need an SMTP account for the e-mail channel, such as Amazon SES, Postmark or your own relay.

What happens when Yuva is down?

With FALLBACK_FORWARD set, the message is forwarded to that address instead. Without it the delivery fails and the sending server may retry. Messages that Yuva refuses on purpose, such as mail to an unknown address, are rejected, not forwarded.

Which domains and addresses can I use?

Any domain you manage in Cloudflare and whose mail no other server handles, because Email Routing becomes its MX. Each e-mail channel has an address, or the catch-all *@example.com for every address of the domain that no channel has exactly. A subaddress such as support+billing@example.com reaches the channel of support@example.com.

How big can a message be?

A message can be up to 25 MiB including attachments, which is the Cloudflare Email Routing limit. Yuva keeps up to 50 attachments per message, each within the server's attachment size limit (25 MiB by default) and allowed types; it leaves out the rest.

Can someone forge mail to my Yuva server?

Yuva refuses any request without a valid HMAC signature or with a timestamp more than 5 minutes off, before it reads the body. Keep the secret to yourself.

Does Yuva use the DMARC result from Cloudflare?

Yes, when you set YUVA_INGRESS_AUTHSERV_ID to mx.cloudflare.net. Yuva then reads the DMARC verdict that Email Routing adds. A new conversation that fails DMARC is marked as spam.

Cloudflare, the Cloudflare logo and Cloudflare Workers are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions. Yuva is an independent open-source project, not affiliated with or endorsed by Cloudflare.