Connect a domain

Complete the owner wizard#

Open /setup through Access as the owner.

1. Check the token results. On Paid, also review the sending quota or Sandbox restrictions.
2. Select a zone and inspect the DNS preview. Free is receiving-only. Paid also offers sending-only setup without MX changes.
3. If you enable receiving, confirm any replacement of existing MX records and the resulting change of mail provider.
4. Review SPF, DKIM, and DMARC results. The wizard retains an existing DMARC record and shows a warning.
5. Choose local filters, reputation lookups, and AI separately. Each choice requires an explicit answer.
6. If AI is enabled, choose a provider and fund third-party AI Gateway credits as required.
7. On Paid, send the wizard's test message and inspect its receipt. On Free, follow the incoming-mail test instructions.
8. Finish setup, then create your addresses and member grants in the app.

Receiving configuration targets Worker boxox, enables subaddressing, and, on Paid, subscribes delivery events to cf-email-events. The setup screen probes R2 lifecycle access. Review the installed bucket rules separately. The wizard does not currently apply mail-expiry rules. A returned sending message ID records acceptance. It does not establish delivery.

Setup locks its onboarding mutations after completion. The Domains page adds later domains with the same DNS preview and explicit receiving confirmation, and manages domains and addresses. Choose Domains → Add domain → Connect with Cloudflare to connect another domain. Approve access once. Box Ox encrypts the authorization and renews access automatically. The installer registers a private OAuth client when its credential has OAuth Client Write. An installation agent can register it once if that permission is missing. See Cloudflare connection setup for the client settings and the advanced token fallback. Disconnect removes the saved authorization and attempts to revoke it in Cloudflare. Use Settings → Processing for later processing changes. See the processing guide for API fields and budget behavior.

AI reads email content when enabled. OpenAI or Anthropic receives selected content through your account's AI Gateway. The Cloudflare-only preset runs on Workers AI. It has no embedding model, so search remains keyword-only. Cloudflare processing is not restricted to the United States by this application.

Gateway body logging and caching are disabled, with a zero-data-retention routing preference. That preference does not guarantee provider retention behavior. Check the chosen provider and model terms.

R2 and D1 at-rest encryption relies on Cloudflare. Box Ox does not add application-level mail encryption because the Worker needs readable content for search and processing. Sufficient Cloudflare account access can expose stored mail. Require two-factor sign-in and limit account membership.

Remove the setup token when onboarding is complete:

pnpm exec wrangler secret delete CF_API_TOKEN --config .wrangler/deploy/wrangler.json

Normal sending and receiving use bindings and continue without it. Add a replacement token temporarily when onboarding another domain or enabling AI/changing an enabled provider. Turning AI off, address opt-outs, and local rule changes do not require the token.

With the token removed, a budget change updates the app limit but leaves the old gateway backstop in place. Concurrent requests can pass the app budget check together. The app counter is not a strict billing ceiling. Restore the token and save the budget again to synchronize the gateway limit, then remove it. A daily app budget of zero refuses new AI calls.