Skip to content
Cloudflare API
Start here
API Reference

Email Security

Email SecuritySettingsAllow Policies

resource cloudflare_email_security_allow_policy

required Expand Collapse
account_id: String

Identifier.

is_acceptable_sender: Bool

Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.

is_exempt_recipient: Bool

Bypasses all detections for messages to this recipient.

is_regex: Bool
is_trusted_sender: Bool

Bypasses all detections and link following for messages from this sender.

pattern: String

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. The API also rejects a pattern that equals a domain onboarded to the account, ignoring case.

pattern_type: String

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
verify_sender: Bool

Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.

optional Expand Collapse
comments?: String
expires_at?: Time

Timestamp at which the policy expires. After this time, Email Security ignores the policy. The value must lie in the future. Send null to clear the expiration.

Deprecatedis_recipient?: Bool

Use is_exempt_recipient instead.

Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.

Deprecatedis_sender?: Bool

Use is_trusted_sender instead.

Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.

Deprecatedis_spoof?: Bool

Use is_acceptable_sender instead.

Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.

computed Expand Collapse
id: String

Allow policy identifier.

created_at: Time
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time

cloudflare_email_security_allow_policy

resource "cloudflare_email_security_allow_policy" "example_email_security_allow_policy" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  is_acceptable_sender = false
  is_exempt_recipient = false
  is_regex = false
  is_trusted_sender = true
  pattern = "test@example.com"
  pattern_type = "EMAIL"
  verify_sender = true
  comments = "Trust all messages send from test@example.com"
  expires_at = "2027-01-01T00:00:00Z"
  is_recipient = false
  is_sender = true
  is_spoof = false
}

data cloudflare_email_security_allow_policy

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
policy_id?: String

Allow policy identifier.

filter?: Attributes
direction?: String

The sorting direction.

expired?: Bool

Filter to return only expired policies (true) or only policies that still apply (false). Omit to return both.

is_acceptable_sender?: Bool

Filter to show only policies where messages from the sender are exempted from Spam, Spoof, and Bulk dispositions (not Malicious or Suspicious).

is_exempt_recipient?: Bool

Filter to show only policies where messages to the recipient bypass all detections.

is_trusted_sender?: Bool

Filter to show only policies where messages from the sender bypass all detections and link following.

order?: String

Field to sort by.

pattern?: String

Filter by exact pattern value.

pattern_type?: String

Filter by pattern type.

verify_sender?: Bool

Filter to show only policies that enforce DMARC, SPF, or DKIM authentication.

computed Expand Collapse
id: String

Allow policy identifier.

comments: String
created_at: Time
expires_at: Time

Timestamp at which the policy expires. After this time, Email Security ignores the policy. The value must lie in the future. Send null to clear the expiration.

is_acceptable_sender: Bool

Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.

is_exempt_recipient: Bool

Bypasses all detections for messages to this recipient.

Deprecatedis_recipient: Bool

Use is_exempt_recipient instead.

Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.

is_regex: Bool
Deprecatedis_sender: Bool

Use is_trusted_sender instead.

Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.

Deprecatedis_spoof: Bool

Use is_acceptable_sender instead.

Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.

is_trusted_sender: Bool

Bypasses all detections and link following for messages from this sender.

Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
pattern: String

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. The API also rejects a pattern that equals a domain onboarded to the account, ignoring case.

pattern_type: String

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
verify_sender: Bool

Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.

cloudflare_email_security_allow_policy

data "cloudflare_email_security_allow_policy" "example_email_security_allow_policy" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}

data cloudflare_email_security_allow_policies

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
direction?: String

The sorting direction.

expired?: Bool

Filter to return only expired policies (true) or only policies that still apply (false). Omit to return both.

is_acceptable_sender?: Bool

Filter to show only policies where messages from the sender are exempted from Spam, Spoof, and Bulk dispositions (not Malicious or Suspicious).

is_exempt_recipient?: Bool

Filter to show only policies where messages to the recipient bypass all detections.

is_trusted_sender?: Bool

Filter to show only policies where messages from the sender bypass all detections and link following.

order?: String

Field to sort by.

pattern?: String

Filter by exact pattern value.

pattern_type?: String

Filter by pattern type.

verify_sender?: Bool

Filter to show only policies that enforce DMARC, SPF, or DKIM authentication.

max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String

Allow policy identifier.

created_at: Time
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

comments: String
expires_at: Time

Timestamp at which the policy expires. After this time, Email Security ignores the policy. The value must lie in the future. Send null to clear the expiration.

is_acceptable_sender: Bool

Exempts messages from this sender from Spam, Spoof and Bulk dispositions only; Malicious and Suspicious dispositions still apply.

is_exempt_recipient: Bool

Bypasses all detections for messages to this recipient.

Deprecatedis_recipient: Bool

Use is_exempt_recipient instead.

Deprecated as of July 1, 2025. Use is_exempt_recipient instead. End of life: July 1, 2026.

is_regex: Bool
Deprecatedis_sender: Bool

Use is_trusted_sender instead.

Deprecated as of July 1, 2025. Use is_trusted_sender instead. End of life: July 1, 2026.

Deprecatedis_spoof: Bool

Use is_acceptable_sender instead.

Deprecated as of July 1, 2025. Use is_acceptable_sender instead. End of life: July 1, 2026.

is_trusted_sender: Bool

Bypasses all detections and link following for messages from this sender.

modified_at: Time
pattern: String

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents. The API also rejects a pattern that equals a domain onboarded to the account, ignoring case.

pattern_type: String

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
verify_sender: Bool

Enforce DMARC, SPF or DKIM authentication. When on, Email Security only honors policies that pass authentication.

cloudflare_email_security_allow_policies

data "cloudflare_email_security_allow_policies" "example_email_security_allow_policies" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  direction = "asc"
  expired = true
  is_acceptable_sender = true
  is_exempt_recipient = true
  is_trusted_sender = true
  order = "pattern"
  pattern = "pattern"
  pattern_type = "EMAIL"
  search = "search"
  verify_sender = true
}

Email SecuritySettingsBlock Senders

resource cloudflare_email_security_block_sender

required Expand Collapse
account_id: String

Identifier.

is_regex: Bool

Whether pattern is a regular expression instead of a literal value.

pattern: String

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

pattern_type: String

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.
optional Expand Collapse
comments?: String
expires_at?: Time

Timestamp at which the pattern expires. After this time, Email Security ignores the pattern. The value must lie in the future. Send null to clear the expiration.

computed Expand Collapse
id: String

Blocked sender pattern identifier.

created_at: Time
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time

cloudflare_email_security_block_sender

resource "cloudflare_email_security_block_sender" "example_email_security_block_sender" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  is_regex = false
  pattern = "test@example.com"
  pattern_type = "EMAIL"
  comments = "Block sender with email test@example.com"
  expires_at = "2027-01-01T00:00:00Z"
}

data cloudflare_email_security_block_sender

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
pattern_id?: String

Blocked sender pattern identifier.

filter?: Attributes
direction?: String

The sorting direction.

expired?: Bool

Filter to return only expired patterns (true) or only patterns that still apply (false). Omit to return both.

order?: String

Field to sort by.

pattern?: String

Filter by pattern value.

pattern_type?: String

Filter by pattern type.

computed Expand Collapse
id: String

Blocked sender pattern identifier.

comments: String
created_at: Time
expires_at: Time

Timestamp at which the pattern expires. After this time, Email Security ignores the pattern. The value must lie in the future. Send null to clear the expiration.

is_regex: Bool

Whether pattern is a regular expression instead of a literal value.

Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
pattern: String

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

pattern_type: String

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.

cloudflare_email_security_block_sender

data "cloudflare_email_security_block_sender" "example_email_security_block_sender" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  pattern_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}

data cloudflare_email_security_block_senders

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
direction?: String

The sorting direction.

expired?: Bool

Filter to return only expired patterns (true) or only patterns that still apply (false). Omit to return both.

order?: String

Field to sort by.

pattern?: String

Filter by pattern value.

pattern_type?: String

Filter by pattern type.

max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String

Blocked sender pattern identifier.

comments: String
created_at: Time
expires_at: Time

Timestamp at which the pattern expires. After this time, Email Security ignores the pattern. The value must lie in the future. Send null to clear the expiration.

is_regex: Bool

Whether pattern is a regular expression instead of a literal value.

Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
pattern: String

The pattern value to match. The format depends on pattern_type: a valid email address for EMAIL (e.g. user@example.com), a valid domain name for DOMAIN (e.g. example.com), or a plain IPv4 or IPv6 address or CIDR block for IP (e.g. 1.2.3.4, 1.2.3.0/24, 2606:4700:4700::1111, or 2606:4700:4700::/48); the API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.

pattern_type: String

Type of pattern matching.

  • EMAIL: matches a full email address (e.g. user@example.com)
  • DOMAIN: matches a domain name (e.g. example.com)
  • IP: matches a plain IPv4 or IPv6 address (e.g. 1.2.3.4 or 2606:4700:4700::1111) or CIDR block (e.g. 1.2.3.0/24 or 2606:4700:4700::/48). The API rejects private or unique-local, loopback, link-local, unspecified, and IPv4 broadcast addresses, including their IPv4-mapped IPv6 equivalents.
  • UNKNOWN: deprecated; you cannot use this when creating or updating policies, but it may appear on existing entries.

cloudflare_email_security_block_senders

data "cloudflare_email_security_block_senders" "example_email_security_block_senders" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  direction = "asc"
  expired = true
  order = "pattern"
  pattern = "pattern"
  pattern_type = "EMAIL"
  search = "search"
}

Email SecuritySettingsDomains

resource cloudflare_email_security_domain

required Expand Collapse
account_id: String

Identifier.

domain: String

The email domain to protect.

allowed_delivery_modes: Set[String]

Delivery modes to onboard the domain through.

drop_dispositions: Set[String]

Dispositions to drop instead of delivering, e.g. ["MALICIOUS", "SPAM"].

ip_restrictions: Set[String]

Source IP ranges mail is accepted from. Any other source is rejected.

regions: Set[String]

Regions that process messages for this domain, e.g. ["GLOBAL"] or ["US"].

optional Expand Collapse
integration_id?: String

Identifier of the CASB integration that authorizes this domain. The integration also enables API scanning, post-delivery actions, and directory sync.

transport?: String

The mail transport hostname for MX/Inline delivery — the MX record Cloudflare delivers email to (e.g. mx.example.com).

folder?: String

The mailbox folder to scan, for API-scanning domains.

lookback_hops?: Int64

Number of hops to trace back through received headers when reconstructing the original message (1-20).

require_tls_inbound?: Bool

Require TLS on inbound connections.

require_tls_outbound?: Bool

Require TLS on outbound connections.

computed Expand Collapse
id: String

Domain identifier.

created_at: Time
dmarc_status: String
inbox_provider: String
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
o365_tenant_id: String
spf_status: String
status: String
authorization: Attributes
authorized: Bool
timestamp: Time
status_message: String
emails_processed: Attributes
timestamp: Time
total_emails_processed: Int64
total_emails_processed_previous: Int64

cloudflare_email_security_domain

resource "cloudflare_email_security_domain" "example_email_security_domain" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  allowed_delivery_modes = ["DIRECT"]
  domain = "domain"
  drop_dispositions = ["MALICIOUS"]
  ip_restrictions = ["192.0.2.0/24", "2001:db8::/32"]
  regions = ["GLOBAL"]
  folder = "AllItems"
  integration_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
  lookback_hops = 1
  require_tls_inbound = true
  require_tls_outbound = true
  transport = "transport"
}

data cloudflare_email_security_domain

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
domain_id?: String

Domain identifier.

filter?: Attributes
active_delivery_mode?: String

Currently active delivery mode to filter by.

allowed_delivery_mode?: String

Delivery mode to filter by.

direction?: String

The sorting direction.

domain?: List[String]

Domain names to filter by.

integration_id?: String

Integration ID to filter by.

order?: String

Field to sort by.

status?: String

Filters response to domains with the provided status.

computed Expand Collapse
id: String

Domain identifier.

created_at: Time
dmarc_status: String
domain: String
folder: String

The mailbox folder to scan, for API-scanning domains.

inbox_provider: String
integration_id: String
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

lookback_hops: Int64
modified_at: Time
o365_tenant_id: String
require_tls_inbound: Bool
require_tls_outbound: Bool
spf_status: String
status: String
transport: String
allowed_delivery_modes: Set[String]
drop_dispositions: Set[String]
ip_restrictions: Set[String]
regions: Set[String]
authorization: Attributes
authorized: Bool
timestamp: Time
status_message: String
emails_processed: Attributes
timestamp: Time
total_emails_processed: Int64
total_emails_processed_previous: Int64

cloudflare_email_security_domain

data "cloudflare_email_security_domain" "example_email_security_domain" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  domain_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}

data cloudflare_email_security_domains

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
active_delivery_mode?: String

Currently active delivery mode to filter by.

allowed_delivery_mode?: String

Delivery mode to filter by.

direction?: String

The sorting direction.

integration_id?: String

Integration ID to filter by.

order?: String

Field to sort by.

status?: String

Filters response to domains with the provided status.

domain?: List[String]

Domain names to filter by.

max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String

Domain identifier.

allowed_delivery_modes: Set[String]
authorization: Attributes
authorized: Bool
timestamp: Time
status_message: String
created_at: Time
dmarc_status: String
domain: String
drop_dispositions: Set[String]
emails_processed: Attributes
timestamp: Time
total_emails_processed: Int64
total_emails_processed_previous: Int64
folder: String

The mailbox folder to scan, for API-scanning domains.

inbox_provider: String
integration_id: String
ip_restrictions: Set[String]
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

lookback_hops: Int64
modified_at: Time
o365_tenant_id: String
regions: Set[String]
require_tls_inbound: Bool
require_tls_outbound: Bool
spf_status: String
status: String
transport: String

cloudflare_email_security_domains

data "cloudflare_email_security_domains" "example_email_security_domains" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  active_delivery_mode = "DIRECT"
  allowed_delivery_mode = "DIRECT"
  direction = "asc"
  domain = ["string"]
  integration_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
  order = "domain"
  search = "search"
  status = "PENDING"
}

Email SecuritySettingsImpersonation Registry

resource cloudflare_email_security_impersonation_registry

required Expand Collapse
account_id: String

Identifier.

email: String

Email address (or pattern) of the protected identity.

is_email_regex: Bool

Whether email is a regular expression instead of a literal address.

name: String

Display name of the protected identity.

optional Expand Collapse
comments?: String

Optional note describing the entry.

directory_id?: Int64

Identifier of the directory the entry was synced from, when directory-synced.

directory_node_id?: Int64

Identifier of the directory node the entry was synced from, when directory-synced.

Deprecatedexternal_directory_node_id?: String

This field is deprecated.

Deprecated. External identifier of the directory node.

provenance?: String

Source the entry was created from.

computed Expand Collapse
id: String

Impersonation registry entry identifier.

created_at: Time
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time

cloudflare_email_security_impersonation_registry

resource "cloudflare_email_security_impersonation_registry" "example_email_security_impersonation_registry" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  email = "john.doe@example.com"
  is_email_regex = false
  name = "John Doe"
  comments = "comments"
  directory_id = 0
  directory_node_id = 0
  external_directory_node_id = "external_directory_node_id"
  provenance = "A1S_INTERNAL"
}

data cloudflare_email_security_impersonation_registry

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
impersonation_registry_id?: String

Impersonation registry entry identifier.

filter?: Attributes
direction?: String

The sorting direction.

order?: String

Field to sort by.

provenance?: String
computed Expand Collapse
id: String

Impersonation registry entry identifier.

comments: String

Optional note describing the entry.

created_at: Time
directory_id: Int64

Identifier of the directory the entry was synced from, when directory-synced.

directory_node_id: Int64

Identifier of the directory node the entry was synced from, when directory-synced.

email: String

Email address (or pattern) of the protected identity.

Deprecatedexternal_directory_node_id: String

This field is deprecated.

Deprecated. External identifier of the directory node.

is_email_regex: Bool

Whether email is a regular expression instead of a literal address.

Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
name: String

Display name of the protected identity.

provenance: String

Source the entry was created from.

cloudflare_email_security_impersonation_registry

data "cloudflare_email_security_impersonation_registry" "example_email_security_impersonation_registry" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  impersonation_registry_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}

data cloudflare_email_security_impersonation_registries

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
direction?: String

The sorting direction.

order?: String

Field to sort by.

provenance?: String
max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String

Impersonation registry entry identifier.

comments: String

Optional note describing the entry.

created_at: Time
directory_id: Int64

Identifier of the directory the entry was synced from, when directory-synced.

directory_node_id: Int64

Identifier of the directory node the entry was synced from, when directory-synced.

email: String

Email address (or pattern) of the protected identity.

Deprecatedexternal_directory_node_id: String

This field is deprecated.

Deprecated. External identifier of the directory node.

is_email_regex: Bool

Whether email is a regular expression instead of a literal address.

Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
name: String

Display name of the protected identity.

provenance: String

Source the entry was created from.

cloudflare_email_security_impersonation_registries

data "cloudflare_email_security_impersonation_registries" "example_email_security_impersonation_registries" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  direction = "asc"
  order = "name"
  provenance = "A1S_INTERNAL"
  search = "search"
}

Email SecuritySettingsTrusted Domains

resource cloudflare_email_security_trusted_domains

required Expand Collapse
account_id: String

Identifier.

is_recent: Bool

Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.

is_regex: Bool

Whether pattern is a regular expression instead of a literal domain.

is_similarity: Bool

Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.

pattern: String

The domain pattern to trust, e.g. example.com.

optional Expand Collapse
comments?: String
computed Expand Collapse
id: String

Trusted domain identifier.

created_at: Time
Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time

cloudflare_email_security_trusted_domains

resource "cloudflare_email_security_trusted_domains" "example_email_security_trusted_domains" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  is_recent = true
  is_regex = false
  is_similarity = false
  pattern = "example.com"
  comments = "Trusted partner domain"
}

data cloudflare_email_security_trusted_domains

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
trusted_domain_id?: String

Trusted domain identifier.

filter?: Attributes
direction?: String

The sorting direction.

is_recent?: Bool

Filter to show only recently registered domains that are trusted to prevent triggering Suspicious or Malicious dispositions.

is_similarity?: Bool

Filter to show only proximity domains (partner or approved domains with similar spelling to connected domains) that prevent Spoof dispositions.

order?: String

Field to sort by.

pattern?: String
computed Expand Collapse
id: String

Trusted domain identifier.

comments: String
created_at: Time
is_recent: Bool

Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.

is_regex: Bool

Whether pattern is a regular expression instead of a literal domain.

is_similarity: Bool

Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.

Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
pattern: String

The domain pattern to trust, e.g. example.com.

cloudflare_email_security_trusted_domains

data "cloudflare_email_security_trusted_domains" "example_email_security_trusted_domains" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  trusted_domain_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}

data cloudflare_email_security_trusted_domains_list

required Expand Collapse
account_id: String

Identifier.

optional Expand Collapse
direction?: String

The sorting direction.

is_recent?: Bool

Filter to show only recently registered domains that are trusted to prevent triggering Suspicious or Malicious dispositions.

is_similarity?: Bool

Filter to show only proximity domains (partner or approved domains with similar spelling to connected domains) that prevent Spoof dispositions.

order?: String

Field to sort by.

pattern?: String
max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String

Trusted domain identifier.

comments: String
created_at: Time
is_recent: Bool

Select to prevent recently registered domains from triggering a Suspicious or Malicious disposition.

is_regex: Bool

Whether pattern is a regular expression instead of a literal domain.

is_similarity: Bool

Select for partner or other approved domains that have similar spelling to your connected domains. Prevents listed domains from triggering a Spoof disposition.

Deprecatedlast_modified: Time

Use modified_at instead.

Deprecated, use modified_at instead. End of life: November 1, 2026.

modified_at: Time
pattern: String

The domain pattern to trust, e.g. example.com.

cloudflare_email_security_trusted_domains_list

data "cloudflare_email_security_trusted_domains_list" "example_email_security_trusted_domains_list" {
  account_id = "023e105f4ecef8ad9ca31a8372d0c353"
  direction = "asc"
  is_recent = true
  is_similarity = true
  order = "pattern"
  pattern = "pattern"
  search = "search"
}