# Invitations are not a mail relay

Invitation emails carry a fixed subject and attributed, link-free user text; only verified owners and admins may send, with daily caps and a rate limit; Reply-To and one product name for every email.

Organization invitations could be used as an open relay: any signed-in account could create an Organization and make the app mail any address, with the Organization name as the subject. The subject is now a constant built from the product name, and the inviter's and Organization's names appear in the body as attributed plain text (`Name (verified address) invited you to join the organization "…"`), HTML-escaped, length-capped and with link-shaped tokens defanged so no client auto-links them. Every template applies the same treatment to names, and the security notice prints a readable UTC timestamp ([Email](/docs/features/email#user-controlled-text), [commit e951425](https://github.com/CarlosZiegler/template-cloudflare/commit/e9514250)).

Sending now requires a verified inviter email even when `AUTH_SKIP_EMAIL_VERIFICATION` is `true`, and is limited to 20 invitations per inviter and 50 per Organization per rolling day, 50 pending invitations per Organization, and 10 `invite-member` requests per 10 minutes per client IP. The default owner, admin and member roles are written down in the plugin configuration. Refusals are typed codes translated in en, de and fr ([Authentication and Organizations](/docs/features/auth#invitations), [commit 88e8671](https://github.com/CarlosZiegler/template-cloudflare/commit/88e86714)). The web invite dialog and the mobile invite group show the verify-your-email state with a button that sends the verification email ([commit b9e63fd](https://github.com/CarlosZiegler/template-cloudflare/commit/b9e63fd1)).

`EMAIL_REPLY_TO` sets a Reply-To on every message through the Worker binding, Cloudflare REST and Resend, and the product name every email prints comes from `EMAIL_FROM`'s display name; the hard-coded fallback is gone. The email guide documents the SPF, DKIM and DMARC records the sending domain needs for either provider ([commit 8f90bc5](https://github.com/CarlosZiegler/template-cloudflare/commit/8f90bc5d)).