How to Create a Free Professional Email on Your Custom Domain in 10 Minutes with Cloudflare, Resend, Gmail, Namecheap, and Codex or Claude Code

You do not need to pay for a traditional mailbox to receive and reply from a professional address such as [email protected].

With Cloudflare Email Routing, Resend SMTP, and a personal Gmail account, you can build a practical custom-domain email setup with no monthly email-hosting fee. If your domain is registered at Namecheap, Codex or Claude Code can do most of the configuration through command-line tools in about 10 minutes.

There are two important qualifications:

1. The domain itself is not free. You must already own one or buy one first.
2. Ten minutes refers to hands-on configuration. DNS and nameserver propagation may take longer.

This guide covers both approaches: the AI-assisted CLI method and the manual dashboard method.

What we are building

The final email flow looks like this:

Incoming email
sender -> [email protected] -> Cloudflare Email Routing -> Gmail

Outgoing email
Gmail -> Resend SMTP -> recipient

Each service has one job:

Service	Responsibility
Namecheap	Domain registration and nameserver management
Cloudflare	Authoritative DNS and forwarding incoming email to Gmail
Resend	Authenticated SMTP for sending from the custom domain
Gmail	Inbox and email client
Codex or Claude Code	CLI orchestration, DNS configuration, testing, and documentation

This is an email alias and forwarding architecture, not a separate hosted mailbox. Gmail stores the messages, while your public identity remains [email protected].

Is it really free?

For a small personal site, freelancer, or early-stage business, it can be. Cloudflare documents Email Routing to verified destinations as free on every plan, and Resend's current free transactional tier includes 3,000 emails per month with a 100-email daily limit. Gmail provides the inbox through your existing Google account.

You still pay for the domain registration, and the providers can change their free-tier limits. Check current pricing before publishing or following this guide at a later date.

This setup is best for low-volume individual or business email. Use a managed mail platform such as Google Workspace or Microsoft 365 when you need multiple employee mailboxes, centralized administration, compliance controls, shared calendars, or higher support guarantees.

Prerequisites

Before starting, you need:

• A domain you already own at Namecheap, or a domain you are ready to purchase
• A personal Gmail account that will receive the forwarded messages
• A free Cloudflare account
• A free Resend account
• A Mac, Linux, or Windows terminal
• Codex or Claude Code if you want to use the AI method

For the same CLI workflow used in this guide, install:

npm install -g @helgesverre/namecheap-cli

This package is a community command-line wrapper around Namecheap's API, not an official Namecheap product. You will also use Cloudflare's cloudflared CLI, Wrangler for Email Routing, and the official Resend CLI. Resend documents its current installation and authentication options in the Resend CLI reference.

Authenticate each service without pasting secrets into your AI conversation:

namecheap auth login
cloudflared tunnel login
npx wrangler login
resend login

OAuth pages may open in your browser for approval. That is normal. The AI agent can continue after you approve the login without controlling the browser.

Namecheap API access may require enabling it in Profile > Tools and whitelisting your public IPv4 address. See Namecheap's official API introduction.

Method 1: the 10-minute AI and CLI setup

Open Codex or Claude Code in an empty project directory. Replace the values in the prompt below, then paste the entire prompt.

Configure a professional custom-domain email for me.

Inputs:
- Domain: YOURDOMAIN.COM
- Custom email: [email protected]
- Destination Gmail: [email protected]
- Registrar: Namecheap

Use the installed command-line tools and APIs:
- namecheap from @helgesverre/namecheap-cli
- cloudflared
- npx wrangler for Cloudflare Email Routing
- resend
- dig, curl, jq, and the operating system's secure credential store

Rules:
1. Prefer authenticated CLIs and APIs. Do not control a browser tab. It is OK
   for a CLI to open an OAuth page that I approve myself.
2. Never print, paste into chat, log, or commit API keys, OAuth tokens, tunnel
   credentials, or SMTP passwords.
3. Store the final domain-scoped Resend SMTP credential in the system's secure
   credential store. On macOS, use Keychain.
4. Resolve the live Cloudflare account and zone from the domain name. Never
   reuse a guessed or unrelated zone ID.
5. Inventory existing nameservers, MX, SPF, DKIM, and DMARC records before any
   mutation. Show me the exact conflicting records and request confirmation
   before deleting them.
6. Do not purchase a domain, enable a paid plan, or accept new billing terms.
7. Ask me only for required OAuth approvals, destination-address verification,
   Gmail verification, or destructive-record confirmation. Continue with all
   other safe steps autonomously.

Required outcome:
1. Confirm the domain exists in my Namecheap account. If it does not, stop and
   tell me to buy it.
2. Add or locate the domain in Cloudflare and obtain its assigned nameservers.
3. Use `namecheap ns set` to delegate the domain to those Cloudflare
   nameservers. Preserve the website's required DNS records.
4. Enable Cloudflare Email Routing.
5. Add and verify my Gmail address as the destination.
6. Create an explicit rule that forwards [email protected] to my Gmail.
   Leave catch-all disabled.
7. Create YOURDOMAIN.COM as a sending domain in Resend.
8. Add Resend's exact DKIM, SPF, and return-path DNS records in Cloudflare. Keep
   Resend's sending records on the subdomains it provides so they do not
   conflict with Cloudflare's receiving MX records.
9. Remove old email-provider MX or SPF records only after I confirm the exact
   records.
10. Publish one DMARC TXT record at _dmarc.YOURDOMAIN.COM, starting with:
    v=DMARC1; p=none;
11. Trigger Resend verification and wait until the domain is verified.
12. Create a sending-only Resend API key scoped to this domain and store it
    securely. Do not display it.
13. Give me the Gmail "Send mail as" values: address, SMTP host, port, username,
    security type, and a secure command that copies the stored password to my
    clipboard without printing it.
14. Test outbound SMTP and send an inbound message to the custom address.
15. Verify DNS through both 1.1.1.1 and 8.8.8.8, and report the final routing,
    SPF, DKIM, DMARC, and delivery status.
16. Write a credential-free operations summary in Markdown.

The agent should pause briefly when Cloudflare emails a verification link to your destination Gmail address. After you click it, the agent can create the forwarding rule and continue.

It should also stop before deleting old MX records. MX records determine where your incoming mail goes, so deleting the wrong one can interrupt delivery.

Method 2: configure everything manually

The manual process creates the same architecture and is useful for understanding what the AI agent is changing.

1. Move authoritative DNS to Cloudflare

Add your domain to Cloudflare and note the two assigned nameservers. In Namecheap, open the domain, choose Custom DNS, and enter those nameservers.

With the installed Namecheap CLI, the equivalent operation is:

namecheap ns list YOURDOMAIN.COM
namecheap ns set YOURDOMAIN.COM NS1.CLOUDFLARE.COM NS2.CLOUDFLARE.COM

Cloudflare must contain any DNS records your website already needs before the nameserver change finishes propagating.

2. Configure incoming email in Cloudflare

Open Cloudflare > Email > Email Routing and enable Email Routing for the domain. Add your Gmail address as a destination and click the verification link Cloudflare sends to it.

Create a custom routing rule:

[email protected] -> [email protected]

Keep catch-all disabled unless you intentionally want every undefined address at the domain to reach your inbox. Cloudflare describes destination addresses and routing rules in its Email Routing documentation.

If the dashboard reports conflicting MX records, identify the old email provider and remove only its MX records. Do not touch website A, AAAA, CNAME, or Cloudflare Tunnel records.

3. Configure authenticated sending in Resend

Create a Resend account, add your domain, and select a nearby sending region. Resend will generate the DNS records required for the domain. They normally include:

• A DKIM TXT record
• An MX record on a sending or return-path subdomain
• An SPF TXT record on that same subdomain

Copy them exactly into Cloudflare DNS. Do not combine them with Cloudflare's root MX records. Trigger verification in Resend and wait for the domain status to become Verified.

Once the domain is verified, Resend allows sending from addresses at that domain. Create a sending-only API key restricted to the domain rather than a full-access key. Resend's official CLI supports domain verification and scoped API-key creation.

4. Add a safe DMARC policy

Create one TXT record:

Name: _dmarc
Value: v=DMARC1; p=none;

DMARC tells receiving providers how to treat messages that fail authentication. Starting with p=none activates monitoring without rejecting legitimate mail. After all legitimate sending sources consistently pass SPF or DKIM alignment, you can consider moving to p=quarantine and later p=reject.

Google's email sender guidelines recommend authentication for sending domains and require DMARC for high-volume senders.

5. Connect the custom address to Gmail

In Gmail settings, open Accounts and Import > Send mail as > Add another email address. Enter your display name and [email protected], then use:

SMTP server: smtp.resend.com
Port: 465
Username: resend
Password: your domain-scoped Resend API key
Security: SSL

Gmail will send a final verification message to the custom address. Cloudflare forwards it to your Gmail inbox; click the link to confirm ownership. Google's Send mail as documentation describes this verification flow.

Verify the result

Do not stop when dashboards show green checkmarks. Test the real path.

Check public DNS through independent resolvers:

dig +short @1.1.1.1 MX YOURDOMAIN.COM
dig +short @8.8.8.8 MX YOURDOMAIN.COM
dig +short @1.1.1.1 TXT _dmarc.YOURDOMAIN.COM
dig +short @8.8.8.8 TXT _dmarc.YOURDOMAIN.COM

Then run two delivery tests:

1. Send from an unrelated address to [email protected] and confirm it arrives in Gmail.
2. Send from Gmail using [email protected] and confirm the recipient sees the custom domain in the From header.

If either test fails, inspect the exact MX, SPF, DKIM, and DMARC records before changing anything. DNS caches can disagree temporarily, so compare at least two public resolvers.

Common mistakes to avoid

• Calling the entire setup free without qualification. Email hosting can cost $0, but the domain registration still costs money.
• Leaving the old provider's MX records active. Multiple unrelated MX sets can produce unpredictable delivery.
• Publishing two SPF records at the same hostname. A hostname should have one valid SPF policy. Resend's generated sending subdomain avoids conflict with Cloudflare's root forwarding policy.
• Using a full-access SMTP credential. Create a sending-only key scoped to the verified domain.
• Starting DMARC with p=reject. Begin with p=none until every legitimate sender is authenticated and aligned.
• Sharing secrets with an AI agent in chat. Use OAuth, masked terminal prompts, environment variables, or the operating system's credential store.
• Assuming DNS propagation is instant. The configuration may take 10 minutes, but cached nameservers or records can take longer to update.

Final result

You now have a professional address on your own domain, incoming messages in Gmail, and authenticated replies through Resend—without paying a monthly email hosting bill.

The manual method teaches you how the pieces fit together. The AI method turns the same checklist into an auditable infrastructure task: Codex or Claude Code uses the Namecheap, Cloudflare, and Resend CLIs, pauses for sensitive approvals, tests both delivery directions, and leaves behind documentation for the next change.

That combination is the real advantage: not merely a free email alias, but a repeatable and verifiable setup you can recreate for your next domain in about 10 minutes.