Every bot in its lane. Every send accounted for.

The details

Keys

• Least privilege by default. Each key has scopes (read, label, send, approve, admin) and a list of inboxes it can touch. A read-only key can't send, ever, and other inboxes simply answer 404.
• Sending rules live on the key. allow_recipients (exact address, @domain or team), a daily_send_cap, and approval: "outside" for anyone else.
• Shown once, stored hashed. The full key is displayed one time at creation. We keep only a SHA-256 hash and a short prefix so you can recognise it.
• Lockout on guessing. Twenty failed authentication attempts from one IP in ten minutes locks that IP out with 429 and a Retry-After header.
• Rotate and revoke. Webhook secrets rotate in place without changing the webhook; keys are revoked and reissued in one call.

Sending

• Approval gate. With approval: "outside", sends to anyone outside the allowlist wait as pending_approval until a person or an approve-scoped key approves or rejects them. Without it, they're refused with 403.
• Suppression. The provider's suppression list is enforced today. Our own bounce and complaint thresholds are coming soon.
• Phone follows the same rules. SMS and voice (coming soon) will use the same contact rules and approvals as mail. Texts go only to people who opted in, STOP is honored instantly, and carrier verification is handled for you.
• Visible limits. Rate-limit headers on every send show the cap left, so a runaway loop slows itself down, and stops at 429.

Inbound mail is untrusted

Anyone can email a bot, so everything a bot reads from outside is marked untrusted: bots treat it as data, never as instructions. Bot Shield checks every inbound message for prompt injection, hidden text, phishing links and dangerous attachments, and records the SPF, DKIM and DMARC verdicts on mail. Mail can be quarantined until an admin releases it. Chat and tasks are flagged, never blocked. Texts are flagged by default, and an admin can choose to hold them for review. Bots get cleaned text. Bots should still not auto-reply to unverified senders.

Events and webhooks

• Signed. Webhooks are signed with HMAC-SHA256 in the Standard Webhooks format, with a timestamp to stop replays.
• Secrets aren't re-shown. A webhook's signing secret is returned at creation only, not on later reads.
• Nothing silently lost. Every event is written to a durable log before delivery, so you can read it from any cursor even if your endpoint was down. Deliveries retry for about a day.

Domains and mail authentication

Mail your bots send today goes out from bots.emlbot.com or emlbot.com with SPF, DKIM and DMARC passing.

Send and receive from your own domain. EMLbot shows the exact DNS records to copy and verifies them for you. Send-only setup preserves existing Cloudflare Email Routing. You can connect a domain, verify it and make it primary, using the exact DNS records shown in the console. We recommend a subdomain (for example bots.yourco.com) so bot mail never mixes with your company mail.

Where it runs

EMLbot runs on Cloudflare Workers. Message metadata is stored in Cloudflare D1 and raw messages and attachments in Cloudflare R2, all over TLS. Messages and attachments are only served to keys that can read that inbox.

Reporting a problem

If you think you've found a security issue, email info@emlbot.com with "Security report" in the subject. Please don't test against inboxes that aren't yours.