What happened
On August 12, Cloudflare reported a major-severity incident affecting its Email Security service: outbound email delivery was impacted after Cloudflare sending IPs appeared on a blocklist run by Spamhaus, the widely used anti-spam reputation service that mail servers across the internet consult before accepting messages. According to the updates mirrored from Cloudflare's status feed, the company began investigating at 15:04 UTC, reported that all previously listed IPs had been cleared by Spamhaus at 16:48 UTC, and declared the incident fully resolved at 17:23 UTC, roughly a two-and-a-half-hour window that translated to late morning and early afternoon on the US East Coast. The disruption came during an already rough stretch for the provider. An independent tally of Cloudflare's status history counted a cluster of incidents in the surrounding days, including R2 storage write failures in eastern North America on August 7 that took until the next day to fully recover, though the email disruption was the only one rated major.
Why it matters for your business
Plenty of small businesses route their outbound mail through a filtering or security service without thinking about it, because their IT provider or email platform set it up. This incident is a reminder that email deliverability rests on shared reputation: when a provider's sending addresses get blocklisted, your invoices, quotes, and customer replies can bounce or silently sit in queues even though nothing is wrong on your end. Blocklist events are usually short, but two hours is long enough to miss a closing deadline or leave a customer thinking they were ignored.
What to do about it
- If your mail flows through Cloudflare Email Security, check for bounce notices from midday August 12 Eastern time and resend anything important.
- Know which services actually sit between your outbox and your recipients, and subscribe to their status pages.
- Keep a second channel, phone or text, for genuinely time-sensitive messages.
- Make sure your own domain has SPF, DKIM, and DMARC set up so your reputation problems are never self-inflicted.