Cloudflare/email Routing

@webframp/cloudflare/email-routingv2026.10.21.1· Apache-2.0· 10d agoBEHAVIORS

01README

Cloudflare Email Routing — rules, addresses, catch-all, DNS setup

02Release Notes

2026.10.21.1

Changed: The README and the apiToken description now lead with a vault. Store the token with swamp vault put cloudflare API_TOKEN and set apiToken to ${{ vault.get("cloudflare", "API_TOKEN") }}. The CLOUDFLARE_API_TOKEN environment variable still works as a fallback, but swamp does not redact it, so it is no longer recommended. The missing-token error now says the same.

Fixed: Create methods whose response carries no id wrote every result to one instance named created, so each call overwrote the previous one. They now name the instance by the response's id or tag when present, else by the path parameter that scopes the call, else by a hash of the request arguments (secret arguments left out). Affected: create_sending_subdomain and create_email_sending_subdomains_preview_sending_subdomain.

Upgrade note: Results earlier versions wrote to the created instance stay there; new runs write under the new names.

03Behaviors1

@webframp/cloudflare/email-routingv2026.10.21.1cloudflare/email_routing.ts

Global Arguments

Argument	Type	Required	Description
apiToken?	string	no	Cloudflare API token. Wire it with ${{ vault.get("cloudflare", "API_TOKEN") }}; never pass the literal token. The CLOUDFLARE_API_TOKEN environment variable is read as a fallback, but it is not redacted and is not recommended.
zoneId	string	yes	Cloudflare zone ID

fn get_dmarc_reports_status()

Get DMARC Report Status

fn update_configure_dmarc_reports(enabled?: boolean, skip_wizard?: boolean)

Configure DMARC Reports

Argument	Type	Required	Description
enabled?	boolean	no	Enable or disable DMARC reports for this zone
skip_wizard?	boolean	no	Skip the DMARC setup wizard

fn get_inspect_spf()

Inspect SPF Record

fn get_email_routing_settings()

Get Email Routing settings

fn update_email_routing_settings_replace_email_routing_settings(enabled?: union, skip_wizard?: union, support_subaddress?: union)

Update Email Routing settings

Argument	Type	Required	Description
enabled?	union	no	State of your zone Email Routing settings. No-op on this endpoint - use `POST...
skip_wizard?	union	no	Flag to check if the user skipped the configuration wizard.
support_subaddress?	union	no	Whether subaddressing (plus-addressing) is honored when matching incoming mai...

fn update_email_routing_settings(enabled?: union, skip_wizard?: union, support_subaddress?: union)

Update Email Routing settings

Argument	Type	Required	Description
enabled?	union	no	State of your zone Email Routing settings. No-op on this endpoint - use `POST...
skip_wizard?	union	no	Flag to check if the user skipped the configuration wizard.
support_subaddress?	union	no	Whether subaddressing (plus-addressing) is honored when matching incoming mai...

fn get_email_routing_settings_email_routing_dns_settings(subdomain?: string)

Email Routing - DNS settings

Argument	Type	Required	Description
subdomain?	string	no

fn create_email_routing_settings_enable_email_routing_dns(name?: unknown)

Enable Email Routing

Argument	Type	Required	Description
name?	unknown	no

fn update_email_routing_settings_unlock_email_routing_dns(name?: unknown)

Unlock Email Routing

Argument	Type	Required	Description
name?	unknown	no

fn delete_email_routing_settings_disable_email_routing_dns(name?: unknown)

Disable Email Routing

Argument	Type	Required	Description
name?	unknown	no

fn list_routing_rules(page?: number, per_page?: number, enabled?: boolean)

List routing rules

Argument	Type	Required
page?	number	no
per_page?	number	no
enabled?	boolean	no

fn create_routing_rule(actions: unknown, enabled?: unknown, matchers: unknown, name?: unknown, owner_worker_tag?: unknown, priority?: unknown, source?: unknown)

Create routing rule

Argument	Type	Required
actions	unknown	yes
enabled?	unknown	no
matchers	unknown	yes
name?	unknown	no
owner_worker_tag?	unknown	no
priority?	unknown	no
source?	unknown	no

fn get_catch_all_rule()

Get catch-all rule

fn update_catch_all_rule(actions: unknown, enabled?: unknown, matchers: unknown, name?: unknown, owner_worker_tag?: unknown, source?: unknown)

Update catch-all rule

Argument	Type	Required
actions	unknown	yes
enabled?	unknown	no
matchers	unknown	yes
name?	unknown	no
owner_worker_tag?	unknown	no
source?	unknown	no

fn get_routing_rule(rule_identifier: string)

Get routing rule

Argument	Type	Required	Description
rule_identifier	string	yes

fn update_routing_rule(rule_identifier: string, actions: unknown, enabled?: unknown, matchers: unknown, name?: unknown, owner_worker_tag?: unknown, priority?: unknown, source?: unknown)

Update routing rule

Argument	Type	Required
rule_identifier	string	yes
actions	unknown	yes
enabled?	unknown	no
matchers	unknown	yes
name?	unknown	no
owner_worker_tag?	unknown	no
priority?	unknown	no
source?	unknown	no

fn delete_routing_rule(rule_identifier: string)

Delete routing rule

Argument	Type	Required	Description
rule_identifier	string	yes

fn get_publiclistsuppressionzonerouting(page?: number, per_page?: number, order?: enum, direction?: enum)

List zone email suppressions

Argument	Type	Required
page?	number	no
per_page?	number	no
order?	enum	no
direction?	enum	no

fn create_post_publicnewsuppressionzonerouting(email: string, expires_at?: string)

Create zone email suppression

Argument	Type	Required	Description
email	string	yes
expires_at?	string	no

fn get_publicgetsuppressionzonerouting(suppression_id: string)

Get zone email suppression

Argument	Type	Required	Description
suppression_id	string	yes

fn delete_publicdeletesuppressionzonerouting(suppression_id: string)

Delete zone email suppression

Argument	Type	Required	Description
suppression_id	string	yes

fn list_sending_subdomains()

List sending subdomains

fn create_sending_subdomain(name: string)

Create a sending subdomain

Argument	Type	Required	Description
name	string	yes	The subdomain name. Must be within the zone.

fn create_email_sending_subdomains_preview_sending_subdomain(name: string)

Preview sending subdomain DNS

Argument	Type	Required	Description
name	string	yes	The subdomain name. Must be within the zone.

fn get_sending_subdomain(subdomain_id: string)

Get a sending subdomain

Argument	Type	Required	Description
subdomain_id	string	yes

fn update_sending_subdomain(subdomain_id: string, preview_enabled: boolean)

Update a sending subdomain

Argument	Type	Required	Description
subdomain_id	string	yes
preview_enabled	boolean	yes	Whether sent messages from this subdomain can be previewed in the activity log.

fn delete_sending_subdomain(subdomain_id: string)

Delete a sending subdomain

Argument	Type	Required	Description
subdomain_id	string	yes

fn get_sending_subdomain_dns(subdomain_id: string)

Get sending subdomain DNS records

Argument	Type	Required	Description
subdomain_id	string	yes

fn email_sending_subdomains_fix_sending_subdomain_dns(subdomain_id: string)

Fix sending subdomain DNS records

Argument	Type	Required	Description
subdomain_id	string	yes

fn get_sending_subdomain_dns_status(subdomain_id: string)

Get sending subdomain DNS status

Argument	Type	Required	Description
subdomain_id	string	yes

fn get_publiclistsuppressionzonesending(page?: number, per_page?: number, order?: enum, direction?: enum)

List zone email suppressions

Argument	Type	Required
page?	number	no
per_page?	number	no
order?	enum	no
direction?	enum	no

fn create_post_publicnewsuppressionzonesending(email: string, expires_at?: string)

Create zone email suppression

Argument	Type	Required	Description
email	string	yes
expires_at?	string	no

fn get_publicgetsuppressionzonesending(suppression_id: string)

Get zone email suppression

Argument	Type	Required	Description
suppression_id	string	yes

fn delete_publicdeletesuppressionzonesending(suppression_id: string)

Delete zone email suppression

Argument	Type	Required	Description
suppression_id	string	yes

Resources

dmarc_reports_status(infinite)— Get DMARC Report Status

configure_dmarc_reports(infinite)— Configure DMARC Reports

inspect_spf(infinite)— Inspect SPF Record

email_routing_settings(infinite)— Get Email Routing settings

email_routing_settings_replace_email_routing_settings(infinite)— Update Email Routing settings

email_routing_settings_email_routing_dns_settings(infinite)— Email Routing - DNS settings

email_routing_settings_enable_email_routing_dns(infinite)— Enable Email Routing

email_routing_settings_unlock_email_routing_dns(infinite)— Unlock Email Routing

routing_rules(infinite)— List routing rules

routing_rule(infinite)— Create routing rule

catch_all_rule(infinite)— Get catch-all rule

get_publiclistsuppressionzonerouting(infinite)— List zone email suppressions

post_publicnewsuppressionzonerouting(infinite)— Create zone email suppression

publicgetsuppressionzonerouting(infinite)— Get zone email suppression

sending_subdomains(infinite)— List sending subdomains

sending_subdomain(infinite)— Create a sending subdomain

email_sending_subdomains_preview_sending_subdomain(infinite)— Preview sending subdomain DNS

get_sending_subdomain_dns(infinite)— Get sending subdomain DNS records

email_sending_subdomains_fix_sending_subdomain_dns(infinite)— Fix sending subdomain DNS records

sending_subdomain_dns_status(infinite)— Get sending subdomain DNS status

get_publiclistsuppressionzonesending(infinite)— List zone email suppressions

post_publicnewsuppressionzonesending(infinite)— Create zone email suppression

publicgetsuppressionzonesending(infinite)— Get zone email suppression

04Previous Versions12

2026.10.14.1Apache-2.0(was none)Oct 14, 2026

2026.10.14.1

Fixed: Methods that write a singleton resource failed on current swamp with Data name 'latest' is reserved for internal use.

Changed: Singleton get and action methods now write their data under catch_all_rule-current, dmarc_reports_status-current, email_routing_settings-current, email_routing_settings_email_routing_dns_settings-current, email_sending_subdomains_fix_sending_subdomain_dns-current, inspect_spf-current instead of latest. Anything that read data.latest("<model>", "latest") or queried name == "latest" must use the new name.

Upgrade note: Data previously stored under latest is not migrated; re-run the method to populate the new name. No attribute schemas changed.

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

2026.09.18.1Sep 20, 2026

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.17.2Sep 17, 2026

2026.09.17.2

No changes to this extension's methods. Regenerated to refresh the shared _lib/api.ts helper library after PR #427 review fixes to cfApiPaginatedCursor (used by r2, kv, durable-objects, and workers-ai, but emitted into every extension's api.ts since it's part of the shared template).

2026.09.15.1Sep 15, 2026

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.08.28.2

Hardened codegen: instance names sanitized against path traversal; 429 rate-limit retry with Retry-After; string schema patterns emit regex validation; output schemas passthrough unknown fields; apiToken now optional and vault-wireable with CLOUDFLARE_API_TOKEN env fallback.

2026.08.28.2Aug 28, 2026

2026.08.28.2

updated labels

2026.08.28.1Aug 28, 2026

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2Aug 27, 2026

2026.08.26.2

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.25.1Aug 26, 2026

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

updated labels

2026.08.24.1Aug 24, 2026

2026.08.24.1

Added: Output metadata attributes for observability.

durationMs: Method execution duration in milliseconds.
collectedBy: Extension name that produced the data.
fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.21.1Aug 22, 2026

2026.08.21.1

Changed: Error messages for API failures and invalid input are now specific instead of generic.

Every method that calls the Cloudflare API now wraps failures with the operation attempted and the zone/identifier involved (e.g. rule_identifier, suppression_id, subdomain_id), instead of surfacing the raw SDK error with no context.
Methods that take a rule_identifier, suppression_id, or subdomain_id now reject an empty value up front with a clear validation error.
create_post_publicnewsuppressionzonerouting and create_post_publicnewsuppressionzonesending now validate that email is a well-formed email address before calling the API.
create_sending_subdomain and create_email_sending_subdomains_preview_sending_subdomain now reject an empty name.

Upgrade note: No behavioral change for valid requests. Callers passing an empty identifier, a malformed email address, or an empty subdomain name will now get an immediate, descriptive validation error instead of a Cloudflare API failure.

2026.07.27.1Jul 27, 2026

2026.07.27.1

Fixed: Regenerated from scripts/cloudflare-codegen after two generator bugs were repaired (webframp/swamp-extensions#284).

Methods referencing an undeclared path parameter did not compile. The generator derived a method's arguments schema and execute signature from the OpenAPI parameters list, but built the request URL from the path template. Where the Cloudflare spec omits a declaration for a {placeholder} — which it does in several places — the result was a method with arguments: z.object({}) and an unused _args parameter whose body still interpolated args.<name>. Those methods failed type checking and were uncallable even if they had compiled, because the argument was never declared. Path-template placeholders are now unioned into the declared parameters, so the schema, the signature, and the body agree.
Generated tests could request a URL the mock server did not serve. Test arguments merged the request-body fixture over the path-parameter values, so a body property sharing a name with a path parameter (commonly id) substituted its own example value into the URL. The request then missed the mock and failed with Cloudflare API error: Not found. Path parameters now take precedence, matching what the generated model already does by excluding path-parameter names from the request body.

Upgrade note: No API surface change and no method was added or removed. If this extension type-checked and tested cleanly before, its behavior is unchanged and only the version moved. Extensions that previously failed deno check or deno task test now pass.

2026.07.19.1Jul 19, 2026