A fresh deployment can send only to verified destinations and receives nothing until mail is routed to it. Connecting your domain closes both gaps: mail to you@acme.dev lands in the app, and campaigns and replies send from an address your domain vouches for. There are three pieces — attach the domain, turn on inbound routing, and verify the sending records — and the app shows each record turning green as DNS propagates.

The account- or DNS-level steps here aren't part of wrangler deploy, so the deploy can't finish them for you. Each one below gives the dashboard click-path and the equivalent command.

1. Attach the domain to the worker

Needed for a real address and for SSO. The domain's zone must be on this Cloudflare account.

Dashboard: Workers & Pages → your worker → Settings → Domains & Routes → Add → Custom Domain → tinbox.<your-domain>.

CLI: add the route to wrangler.jsonc, then redeploy:

"routes": [{ "pattern": "tinbox.&#x3C;your-domain>", "custom_domain": true }]

pnpm wrangler deploy

2. Turn on inbound mail (Email Routing)

Inbound mail reaches the worker's email() handler through a catch-all rule.

Dashboard: your domain → Email → Email Routing → Enable, then add a catch-all rule → action Send to a Worker → select your worker.

CLI: with a CLOUDFLARE_API_TOKEN set, setup enables routing and points the catch-all at the worker for you (wrangler has no Email Routing command, so the CLI calls Cloudflare's API directly):

pnpm tinbox setup

Addresses still have to exist as inbox addresses in the app for mail to be accepted — creating your first inbox is a later checklist item.

3. Add the sending records (SPF, DKIM, DMARC)

Sending needs SPF, DKIM, and DMARC records on your domain. Until they verify, you can send only to verified destinations.

Dashboard: add the records at your DNS provider (or your domain's DNS tab if it's on Cloudflare). Settings → Domains in the app shows the exact expected value for each, with a copy button.

CLI: print the exact records — and publish them automatically when your DNS is on Cloudflare and a token is set:

pnpm tinbox setup

4. Watch verification go live

DNS propagation takes anywhere from a few minutes to an hour. You don't have to guess: Settings → Domains polls and shows a per-record diff — expected value vs. what actually resolves, with a chip per record (missing, mismatched, propagating, ok). When all the records pass, the domain flips to verified without a page reload, and a "create your first inbox" next-step card appears. If a previously-verified record later drifts (say a DKIM record gets deleted), the domain shows a misconfigured warning on the next check.

To check the same live DNS state from the CLI or an agent:

tinbox check-sending-domain --domain acme.dev --json

It re-runs the DNS check now and reports which records are verified (MX / SPF / DKIM / DMARC) and which are still missing, plus whether receiving and sending are each valid. It's read-only — it changes no config, it just checks.

5. Optional — "Continue with Tinbox" SSO

If you want one-click sign-in across your deployments, enable SSO once the domain is attached: Settings → Sign-in → Enable, add the one DNS TXT record it shows to prove the domain, then Re-check — no redeploy. The deploy guide covers the CLI equivalent.

Next steps

Your first campaign — now that you can send from a verified address, build an audience and send a broadcast.
Deploy to your Cloudflare account — the full reference for the manual tail, with dashboard and CLI steps side by side.