SECURITY ATLAS / EVALUATION BRIEF
Cloudflare Email Security
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/cloudflare-email-security/

THE ATLAS TAKE
Cloudflare Email Security is a useful shortlist candidate when buyers want to choose deliberately between post-delivery inspection and an inline mail path. The documentation makes the difference unusually clear: the Microsoft 365 API deployment scans after inbox delivery, while MX deployment inspects before it. Atlas considers that clarity more valuable than a generic prevention claim. For the API configuration covered here, the evaluation should measure exposure and completed auto-move behavior. Gateway link changes and quarantine must not be credited to a deployment that does not include them.

SCOPE
The scored configuration is Microsoft 365 API deployment with auto-moves. Inline link modification and gateway quarantine are outside that scope; API scanning starts after inbox delivery.

WORTH A LOOK WHEN
Microsoft 365 teams adding measurable API-based post-delivery inspection and remediation.

THINK TWICE WHEN
The requirement is guaranteed pre-inbox interception while the team intends to deploy only the API mode.

IMPLEMENTATION
1. Select the deployment explicitly
Write API post-delivery into the pilot scope and identify which existing filtering remains in front of the mailbox.

2. Configure protected identities
Populate the impersonation registry for relevant roles and validate mailbox and domain coverage.

3. Close the action loop
Monitor authorized API access and completed auto-moves; define restoration ownership and integration-failure handling.

OPERATING REALITY
Operators need to maintain tenant authorization, auto-move policies and the impersonation registry. A malicious verdict and a removed message are distinct events. Service health monitoring should surface stale integrations or failed actions, while help-desk staff need a documented way to investigate and reverse an incorrect move.

COMMERCIAL CONSIDERATIONS
Obtain pricing for the required email deployment and protection scope. Do not assume a broader Cloudflare One purchase includes all email functions, retention or support requirements.
- Protected users and email service entitlement
- API versus inline implementation requirements
- Operational integrations and retained investigation evidence

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Time safe synthetic remediation
Acceptance evidence: Capture delivery, disposition and final auto-move timestamps.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Remove the test integration permission
Acceptance evidence: Verify failure visibility and restore the required authorization in the lab.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Test a legitimate impersonation-like message
Acceptance evidence: Review classification, registry scope and restoration evidence.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Does this deployment require a routing change or mailbox read/write permission?
- How is a failed or delayed mailbox action surfaced?
- Which retention and provider recovery rules govern the selected delete action?

EVIDENCE GAPS
- Atlas has not measured detection accuracy or post-delivery exposure duration.
- Confirm action support and limits for the selected tenant and deployment mode.

SOURCES
Deployment comparison (Product information)
https://developers.cloudflare.com/cloudflare-one/email-security/setup/
API deployment limitations (Product information)
https://developers.cloudflare.com/cloudflare-one/email-security/setup/post-delivery-deployment/api/
Configure auto-moves (Product information)
https://developers.cloudflare.com/learning-paths/secure-your-email/enable-auto-moves/configure-auto-moves/

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.