Email Security
Email SecuritySettingsAllow Policies
resource cloudflare_email_security_allow_policy
required
Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.
The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
Type of pattern matching.
- EMAIL: matches a full email address (e.g.
user@example.com) - DOMAIN: matches a domain name (e.g.
example.com) - IP: matches a plain IPv4 or IPv6 address (e.g.
1.2.3.4or2606:4700:4700::1111) or CIDR block (e.g.1.2.3.0/24or2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
cloudflare_email_security_allow_policy
resource "cloudflare_email_security_allow_policy" "example_email_security_allow_policy" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
is_acceptable_sender = false
is_exempt_recipient = false
is_regex = false
is_trusted_sender = true
pattern = "test@example.com"
pattern_type = "EMAIL"
verify_sender = true
comments = "Trust all messages send from test@example.com"
is_recipient = false
is_sender = true
is_spoof = false
}
data cloudflare_email_security_allow_policy
computed
Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.
Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.
Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.
The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
Type of pattern matching.
- EMAIL: matches a full email address (e.g.
user@example.com) - DOMAIN: matches a domain name (e.g.
example.com) - IP: matches a plain IPv4 or IPv6 address (e.g.
1.2.3.4or2606:4700:4700::1111) or CIDR block (e.g.1.2.3.0/24or2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
cloudflare_email_security_allow_policy
data "cloudflare_email_security_allow_policy" "example_email_security_allow_policy" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_email_security_allow_policies
optional
Filter to show only policies where messages from the sender are exempted from Spam, Spoof, and Bulk dispositions (not Malicious or Suspicious).
Filter to show only policies where messages to the recipient bypass all detections.
cloudflare_email_security_allow_policies
data "cloudflare_email_security_allow_policies" "example_email_security_allow_policies" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
direction = "asc"
is_acceptable_sender = true
is_exempt_recipient = true
is_trusted_sender = true
order = "pattern"
pattern = "pattern"
pattern_type = "EMAIL"
search = "search"
verify_sender = true
}
Email SecuritySettingsBlock Senders
resource cloudflare_email_security_block_sender
required
The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
Type of pattern matching.
- EMAIL: matches a full email address (e.g.
user@example.com) - DOMAIN: matches a domain name (e.g.
example.com) - IP: matches a plain IPv4 or IPv6 address (e.g.
1.2.3.4or2606:4700:4700::1111) or CIDR block (e.g.1.2.3.0/24or2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
cloudflare_email_security_block_sender
resource "cloudflare_email_security_block_sender" "example_email_security_block_sender" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
is_regex = false
pattern = "test@example.com"
pattern_type = "EMAIL"
comments = "Block sender with email test@example.com"
}
data cloudflare_email_security_block_sender
computed
The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
Type of pattern matching.
- EMAIL: matches a full email address (e.g.
user@example.com) - DOMAIN: matches a domain name (e.g.
example.com) - IP: matches a plain IPv4 or IPv6 address (e.g.
1.2.3.4or2606:4700:4700::1111) or CIDR block (e.g.1.2.3.0/24or2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. - UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
cloudflare_email_security_block_sender
data "cloudflare_email_security_block_sender" "example_email_security_block_sender" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
pattern_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_email_security_block_senders
optional
cloudflare_email_security_block_senders
data "cloudflare_email_security_block_senders" "example_email_security_block_senders" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
direction = "asc"
order = "pattern"
pattern = "pattern"
pattern_type = "EMAIL"
search = "search"
}
Email SecuritySettingsDomains
resource cloudflare_email_security_domain
required
optional
Identifier of the CASB integration that authorizes this domain. The integration also enables API scanning, post-delivery actions, and directory sync.
The mail transport hostname for MX/Inline delivery — the MX record Cloudflare delivers email to (e.g. mx.example.com).
cloudflare_email_security_domain
resource "cloudflare_email_security_domain" "example_email_security_domain" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
allowed_delivery_modes = ["DIRECT"]
domain = "domain"
drop_dispositions = ["MALICIOUS"]
ip_restrictions = ["192.0.2.0/24", "2001:db8::/32"]
regions = ["GLOBAL"]
folder = "AllItems"
integration_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
lookback_hops = 1
require_tls_inbound = true
require_tls_outbound = true
transport = "transport"
}
data cloudflare_email_security_domain
computed
cloudflare_email_security_domain
data "cloudflare_email_security_domain" "example_email_security_domain" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
domain_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_email_security_domains
optional
cloudflare_email_security_domains
data "cloudflare_email_security_domains" "example_email_security_domains" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
active_delivery_mode = "DIRECT"
allowed_delivery_mode = "DIRECT"
direction = "asc"
domain = ["string"]
integration_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
order = "domain"
search = "search"
status = "PENDING"
}
Email SecuritySettingsImpersonation Registry
resource cloudflare_email_security_impersonation_registry
required
cloudflare_email_security_impersonation_registry
resource "cloudflare_email_security_impersonation_registry" "example_email_security_impersonation_registry" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
email = "john.doe@example.com"
is_email_regex = false
name = "John Doe"
comments = "comments"
directory_id = 0
directory_node_id = 0
external_directory_node_id = "external_directory_node_id"
provenance = "A1S_INTERNAL"
}
data cloudflare_email_security_impersonation_registry
cloudflare_email_security_impersonation_registry
data "cloudflare_email_security_impersonation_registry" "example_email_security_impersonation_registry" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
impersonation_registry_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_email_security_impersonation_registries
optional
cloudflare_email_security_impersonation_registries
data "cloudflare_email_security_impersonation_registries" "example_email_security_impersonation_registries" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
direction = "asc"
order = "name"
provenance = "A1S_INTERNAL"
search = "search"
}
Email SecuritySettingsTrusted Domains
resource cloudflare_email_security_trusted_domains
required
cloudflare_email_security_trusted_domains
resource "cloudflare_email_security_trusted_domains" "example_email_security_trusted_domains" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
is_recent = true
is_regex = false
is_similarity = false
pattern = "example.com"
comments = "Trusted partner domain"
}
data cloudflare_email_security_trusted_domains
computed
cloudflare_email_security_trusted_domains
data "cloudflare_email_security_trusted_domains" "example_email_security_trusted_domains" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
trusted_domain_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_email_security_trusted_domains_list
optional
Filter to show only recently registered domains that are trusted to prevent triggering Suspicious or Malicious dispositions.
cloudflare_email_security_trusted_domains_list
data "cloudflare_email_security_trusted_domains_list" "example_email_security_trusted_domains_list" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
direction = "asc"
is_recent = true
is_similarity = true
order = "pattern"
pattern = "pattern"
search = "search"
}