A governed email primitive for internal agents and test systems.

Offer one supported path instead of mailbox improvisation

Without a platform contract, teams solve the same problem with personal Gmail accounts, public disposable inboxes, provider-specific parsers, or secrets pasted into automation. The result is difficult to inventory and harder to revoke. A supported mailbox primitive makes ownership and lifecycle visible.

The contract should stay small: request a scoped identity, receive or send according to policy, retrieve bounded results, subscribe to events, and close the mailbox. Application teams should not need direct D1 access or an operator token to complete ordinary work.

Treat Cloudflare resources as a versioned service

A self-hosted mails0 instance is application infrastructure. Worker code, D1 migrations, R2 object policy, routing rules, secrets, sender configuration, and scheduled cleanup need the same review and release evidence as other platform services.

Production schema can lag source. Run compatibility checks before changing message or mailbox behavior, make migrations forward-aware, and validate the deployed Worker against its bound resources. A successful static deployment does not prove inbound routing or outbound acceptance.

Measure state transitions, not raw mailbox content

The useful operational events are mailbox created, first message received, extraction attempted, extraction succeeded, webhook acknowledged, message sent, provider accepted, mailbox paused, credential rotated, and mailbox expired. Those transitions expose reliability and adoption without copying sensitive bodies into a central telemetry stream.

Use privacy-preserving identifiers for rate limits and aggregate funnels. Keep raw addresses, OTPs, attachment contents, and secrets out of general analytics. When an incident requires message-level evidence, retrieve it through a restricted path with a retention decision.

• Separate product conversion from transport reliability.
• Record webhook retry counts and consumer acknowledgements.
• Alert on capacity and abuse controls before a hard outage.
• Keep an owner and shutdown path for every durable mailbox class.

Make the safe path the shortest path

A platform capability converts when a developer can complete the first real loop without a ticket. Provide a bootstrap command, one end-to-end example, a local or hosted sandbox, and an explicit route to production. Avoid requiring the entire self-hosting stack before a team can evaluate the API shape.

Promotion should follow evidence. A package install is a weak signal. A current message received and a workflow completed is stronger. Repeated use by an owned application justifies durable identity and service-level investment. This funnel also shows where documentation, product behavior, or platform policy blocks teams.

Sources and product scope

Product behavior is verified against the mails0 source and documentation. External comparisons link to official vendor documentation checked on 2026-08-15.

Related implementation paths