Operate the mail environment safely

The Management centre

Overview shows required configuration, optional capabilities, recent activity, and directory visibility. Treat red or action-needed checks as deployment blockers. Settings explains the effective config and Cloudflare secret state without revealing secret values.

Onboard a person

1. Create the person with their exact Google or Microsoft sign-in email.
2. Use Standard unless management access is needed, and add their personal mailbox.
3. Select Send invitation now, or send it later. The single-use link expires after 72 hours.
4. Grant shared mailbox access separately, using the least access that meets the role.
5. They sign in via the invitation with the matching account, accept any published policy, and verify their mailbox and From addresses.

A pending account has no sign-in identity until its invitation succeeds; email alone never authorises first sign-in. Resending rotates the token immediately, so only the newest link works. An identity already enrolled to another account is rejected, not reassigned. Paused blocks sign-in and revokes sessions but keeps data; Offboarded is the durable end state.

Create and delegate a shared mailbox

1. Open Mailboxes and create a shared mailbox with a functional local part, such as support or accounts.
2. Confirm the address and display name before routing external mail to it.
3. Open Mailbox delegation and grant Read, Send as, or Full access.
4. Have each delegate verify the mailbox appears and unavailable actions match their access level.
5. Send a controlled inbound, internal, reply, and external test before announcing the address.

Disabling a mailbox removes it from user navigation and stops sending and new inbound delivery. Stored data is retained. Remove obsolete delegate access before repurposing an address.

Diagnose mail safely

Mail trace shows direction, envelope metadata, status, provider response, and authentication results. Audit log shows administrative changes. Keep ticket notes free of message bodies, OAuth data, push endpoints, and credentials.

• Confirm the mailbox is active and correctly assigned.
• Check inbound routing and recipient status for missing received mail.
• Check the outbound provider, verified sender domain, and trace status for failed sends.
• See the source repository's operations and security checklists for backups, rotation, and incidents.

Support and escalation

Trained L1 people handle first reports: check approved runbooks, Mail trace, and Audit log, communicate with the user, and follow the organisation's incident and privacy processes. Keep case notes free of message bodies, attachments, credentials, and session values.

Escalate a real, reproducible cmail product defect to RME Solutions Technology through the organisation's agreed channel, with the deployed version, safe steps, expected and observed result, impact, and time window. Work outside that — design, configuration, provider or DNS changes — is separately scoped or quoted.

Prepare evidence for review

Standards & assurance covers product capabilities, operator-configured controls, provider responsibilities, and known gaps — a shareable summary, not certification of this deployment.

• Record the deployed version, providers, DNS checks, identity-provider MFA settings, and the approved Cloudflare Email Preview setting.
• Keep protected exports or snapshots of Audit log and Mail trace with your organisation's backup and retention evidence.
• Record retention periods, whether retention jobs are enabled, legal-hold decisions, backup owners, and the latest restore-exercise date.
• Have an accountable owner review the evidence after material access, routing, provider, or retention changes.

Publish directory data by exception

The public directory needs two gates: the global directory switch and the position's Public visibility setting. A public position exposes only occupant name, title, and work email — all other account, reporting, role, permission, and personal data stays internal.

1. Build layers, units, and roles without enabling public output.
2. Create positions as Internal and review their work email and title.
3. Mark only approved positions Public.
4. Enable the global directory switch only after reviewing the public preview.

Change access or offboard safely

1. Pause the account to immediately block sign-in and revoke sessions.
2. Transfer operational ownership and review every shared mailbox assignment.
3. Offboarding makes public positions internal; replace published occupant details only after appointing a successor.
4. Preserve mail per policy and legal requirements; do not delete storage ad hoc.
5. Offboard the account once the transition is complete, then review Audit log.
6. Later mail gets the same generic SMTP rejection as any unavailable address; the sender may see a cmail-labelled delivery failure. cmail sends no auto-reply, protecting outbound quota and preventing backscatter.

Review unavailable-recipient patterns in Cloudflare Email Routing and Worker metrics. cmail keeps no per-attempt trace here by design, since this path is attacker-controlled.