Email like a gentleman.
GentleMail is webmail you deploy to your own Cloudflare account. One deployment receives and sends for every domain you own, keeps your mail in your own D1 and R2, and tells your agents the moment something arrives.
If you run more than one thing online, per-seat mail charges you again and again. GentleMail charges you once.
Every product needs support@, billing@ and a sender for its notifications. Connect each product's domain to the same GentleMail and answer all of them from one place.
Side projects, a few websites, a company and a personal domain. Stop setting up and paying for mail once per domain: one deployment covers all of them.
Give each client mailboxes on their own domain, and add their staff as users who only see their own mailboxes. Your team keeps one sidebar for every client.
Include professional email in what you sell, without a per-seat bill eating your margin. Your customers' domains just need to be in your Cloudflare account.
Hosted mail charges you for every person, every month. GentleMail runs on Cloudflare's Workers Paid plan, a flat $5 a month for your whole account. Add people, mailboxes and domains, and the price stays the same.
Before taxes, with GentleMail's sending inside the included 3,000 emails a month.
| GentleMail | Per-seat hosted mail | |
|---|---|---|
| Monthly price | $5 flat, the Workers Paid plan | Per person, every month |
| Mailboxes | Unlimited, on every domain | Tied to paid seats |
| People who sign in | Unlimited | One paid seat each |
| A new teammate | Free | Another seat, every month |
| Domains | All of them, from one deployment | Added to the plan, still billed per person |
| Where your mail lives | Your Cloudflare account | The provider's servers |
| API and webhooks | Built in, scoped keys and signed events | Through a separate developer platform |
Rival prices are per person per month on annual billing, US list prices checked in November 2026. Some of them include aliases or shared mailboxes, so compare by the number of people who sign in. GentleMail's cost is Cloudflare's Workers Paid plan: $5 a month per account, with 3,000 sent emails included (then $0.35 per 1,000), unlimited incoming mail, and 10 GB of R2 storage free (then $0.015 per GB).
Most developer email tools start with sending. But the moment you send, people answer: replies, questions, invoices, bounces. Those answers need somewhere to land. With GentleMail, every address you send from is also an inbox your team reads and a webhook your code listens to.
The moment mail arrives, your code knows. Here's what teams do with that, each in a few lines of code you run wherever you like.
Contractors and suppliers send their invoices to invoices@ at the end of the month. Your code gets each one with its PDF, reads the amount and queues the payment for approval. Nobody copies numbers by hand.
A customer writes to support@. Your team gets a message in Slack straight away, with the sender, the subject and the first lines, instead of the email waiting until someone opens the inbox.
You run everything alone and can't keep checking five inboxes. Every new message across your products arrives on Telegram as a short summary, and you open GentleMail only when one needs you.
Someone on your team is away. A small automation answers people who write to them once, says when they're back and who to contact, and leaves the original in their inbox for later.
Building several products? Don't set up mail once per domain. Connect them all to the same GentleMail and create support@, sales@ and you@ on each one, as many as you need. Your team switches between them from one sidebar, and your agents hear about every message.
There's no mail server to run and no API key to hand to anyone. Cloudflare receives the mail, a Worker in your account files it, and it stays in your account the whole way.
Email Routing checks SPF, DKIM and DMARC, and refuses known bad senders before anything reaches you.
The catch-all hands each message to GentleMail. Unknown or turned-off addresses are refused on the spot.
The message and its conversation go to D1. The original .eml and its attachments go to R2. Both live in your account.
Your team finds it in the inbox, and every webhook listening on that mailbox gets a signed event straight away.
Point a webhook at invoices@ and your invoice agent hears about each new message right away, with the sender, the text and a link to every attachment. It downloads the PDF with its own key, does the work, and answers in the same thread through the API.
Keys only reach the mailboxes and permissions you choose. Every event is signed, so your agent can prove it came from your GentleMail, and spam never reaches it.
POST https://agents.yourco.com/mail
X-GentleMail-Event: message.received
X-GentleMail-Signature: v1=5f2c…
{
"id": "6f1c2e4a-…",
"event": "message.received",
"data": {
"mailbox": { "address": "invoices@yourco.com" },
"from": { "name": "Acme Billing", "address": "billing@acme.com" },
"subject": "Invoice INV-2041",
"text": "Please find the November invoice attached.",
"attachments": [{ "filename": "invoice-2041.pdf", "url": "…" }]
}
}curl https://mail.yourco.com/api/v1/send \
-H "Authorization: Bearer $GENTLEMAIL_KEY" \
-H "Content-Type: application/json" \
-d '{ "from": "invoices@yourco.com",
"reply_to_message_id": "…",
"text": "Thanks, invoice INV-2041 is booked." }'Anyone can send you HTML. GentleMail treats every message as untrusted, and each of these three layers would stop a script on its own.
Scripts, event handlers, javascript: links, frames, forms and meta redirects are removed with Cloudflare's HTML parser.
A content security policy forbids scripts, form posts and remote loads. Tracking pixels stay blocked until you choose to show images.
Each message renders in a sandboxed frame with scripts disabled, and the same sandbox applies if its address is opened directly.
Sessions live in HttpOnly cookies that no script can read. Risky attachments such as HTML and SVG are always downloaded, never opened in the page. Cloudflare refuses mail that fails authentication, senders you mark as spam go straight to spam next time, and spam is deleted after 30 days.
Sending APIs give your code an outbox. Mail servers give your team an inbox, and a server to babysit. GentleMail gives you both, on infrastructure you already trust.
| GentleMailWebmail and an email API, in your Cloudflare account | Sending APIsSuch as Resend | Self-hosted mail serversSuch as mailcow | |
|---|---|---|---|
| Inbox for people | A real inbox your team signs in to, with shared mailboxes | Built for programs, not a mailbox your team reads and answers from | Yes, plus IMAP for phone and desktop apps |
| Incoming mail for programs | Webhooks carry the sender, the text and links to each attachment | Webhooks carry metadata; the body is a second API call | Through plugins and scripts you set up |
| Sending | From any of your mailboxes, and the copy lands in Sent | Yes, that's their core | Yes, from your own IP, so its reputation is on you |
| Server to run | None. It runs on Cloudflare Workers | None, it's hosted | A server you keep patched, with port 25 open |
| Price | $5 a month flat, 3,000 sent emails included | Priced by volume. Received emails count toward the quota | Free software, plus the server |
Resend: per its pricing page in November 2026, the free plan includes 3,000 emails a month (100 a day, 3 domains) and Pro starts at $20 a month for 50,000. Its receiving webhooks include metadata only. mailcow is a mature open-source mail server: if you need IMAP, calendars today, or full control of your own server, it's a good choice.
GentleMail is open source. It fits a lot of teams as it is, but your product is yours: if it needs a mailbox for every customer, forwarding to their real inbox, or new mail pushed straight to Telegram, you don't wait for us. You fork it and add it.
It's a plain TypeScript app on Cloudflare Workers, built with RedwoodSDK. Mail comes in through one file and goes out through another, so most changes are a few dozen lines, deployed to your own account.
Create, rename and delete addresses from your own app, one per customer or per account.
src/app/api.tsAccept anything@in.yourapp.com and route each message to the right customer by its address.
src/lib/inbound.tsRelay mail to each customer's own address, sent from your mailbox with their sender as the reply-to.
src/lib/outbound.tsPush new mail straight to a chat or a queue from GentleMail itself, with no webhook server in between.
src/lib/webhooks.tsAdd the checks your traffic needs: allow lists, keywords, a model that scores each message.
src/lib/spam.tsSet APP_NAME, change the colours and the fonts, and it's your product on your domain.
src/app/styles.cssEverything above works today. This is what's coming next.
Invitations you can accept from the message, and a shared calendar per mailbox.
Content-based scoring on top of Cloudflare's checks and your block lists.
Block a sender once for a whole domain, or for every mailbox you run.
Out-of-office and acknowledgement replies, per mailbox, with a schedule.
Address suggestions while you type, built from the people you write to.
Add GentleMail to your home screen and get a notification when mail arrives.
No. GentleMail is code you deploy to your own account. It talks to Cloudflare through the bindings of your own Worker, so there's no token to hand over and no third party in the middle.
As many as you want. GentleMail doesn't count seats or mailboxes. Your bill is Cloudflare's Workers Paid plan, plus usage beyond what it includes.
Incoming mail is unlimited. The first 3,000 sent emails each month are included, then it's $0.35 per 1,000. Attachments beyond 10 GB cost $0.015 per GB a month. A team of ten sending 5,000 emails a month pays about $5.70.
Yes, that's what it's built for. Connect every domain to the same GentleMail, give each product its own mailboxes, and switch between them from one sidebar.
Yes. Turn a mailbox off and its mail is refused. Mark a message as spam and its sender is blocked for that mailbox: their next messages go to spam and never reach your webhooks. In Cloudflare, an Email Routing rule can also drop mail for an address before it ever reaches GentleMail.
Both. Your team reads and answers mail in the web app, with folders, search, conversations and pages of 50. Your programs use the API and webhooks on the same mailboxes.
Yes, that's the point of it being open source. The deploy button already gives you your own copy in your GitHub account: add what you need (a mailboxes API, forwarding, a Telegram delivery, your own spam rules) and push, and it deploys.
Cloudflare refuses mail that fails SPF and DKIM, fails the sender's DMARC policy, or comes from blocklisted servers. In GentleMail, marking a sender as spam blocks it for that mailbox, and marking it as not spam trusts it. Content-based filtering is next on the roadmap.
On per-seat mail, each person you add costs about $84 a year. On GentleMail, they cost nothing, and neither does the next mailbox or the next domain. Deploy it once, in about fifteen minutes.