Skip to main content
AgentTeam Email uses an archive-first mail pipeline. Inbound messages are written to R2 before your deployment is notified. Outbound messages are archived at the relay boundary before final delivery status is recorded.

​
Inbound flow

1

Email reaches Cloudflare

A sender addresses a message to a mailbox on a connected domain. Cloudflare receives the message through the domain’s MX routing and Email Routing configuration.
2

Email Routing invokes the Worker

Cloudflare Email Routing delivers the message to the AgentTeam Email Worker provisioned for that domain.
3

Worker writes the archive bundle

The Worker writes the exact RFC 822 bytes as raw.eml, then writes edge.json with envelope, integrity, and Cloudflare edge metadata. The edge.json object is the durable inbound commit marker.
4

Worker notifies the web server

After the archive commit succeeds, the Worker sends a Standard Webhooks-signed POST /rpc/agent-mail/ingest/v1/{connectionPublicId} notification to the public web server. The notification contains bundle metadata, not raw mail bytes.
5

Mail-control queues delivery

The web server verifies the Standard Webhooks signature and passes the bundle metadata to mail-control. Mail-control validates organization, domain, archive prefix, and Worker metadata before queueing delivery.
6

Message reaches the mailbox

Mail-control reads raw.eml from R2, verifies integrity, replays the bytes through Haraka into WildDuck, and writes the terminal result.json archive object.
If the addressed mailbox does not exist, mail-control records the failed delivery result and sends a DSN only when the original envelope sender can safely receive one.

​
Outbound flow

1

Agent submits mail

The agent submits a message through the authenticated web server. The web server verifies mailbox permission before initiating submission through WildDuck.
2

ZoneMTA queues delivery

WildDuck stores the sent copy and hands the message to ZoneMTA. ZoneMTA owns queueing, retries, and bounce behavior.
3

Mail-control relay archives the message

ZoneMTA submits the message to the mail-control internal relay. The relay verifies the sender domain, writes relay.eml and relay.json, and builds the provider-bound delivery payload.
4

Delivery result is recorded

After the selected outbound provider accepts or rejects the message, the relay writes result.json. Retries create additional outbound bundles linked by the ZoneMTA queue ID.
Ordinary authored sends are always provider-bound, including sends to mailboxes on the same connected domain. The only local delivery exception is inbound group forwarding fanout, which is receive-side routing for an already accepted inbound message. That local fanout path must link to the source Worker inbound archive; replay-looking message headers alone are not enough to create a local copy. When local fanout succeeds, mail-control reports the delivery back to the web server over the internal service credential so the forwarding group can show its latest delivery time.

​
Archive contract

The exact object paths, file names, and terminal status values are documented in Archive Layout. Treat that reference as the stable contract for agents, tools, and operators inspecting R2 directly.