If it helps, you can think of the cloudflare tunnel as analogous to a VPN. You don’t need separate tunnels unless the services involved can’t communicate with each other; if they can route to each other already, they should all be discoverable from the tunnel.

It sounds like 1016 and 1033 are both DNS errors, or other connectivity. Your tunnel was up before; it sounds like restricting to just email night have blocked something it shouldn’t. How did you block it? Cloudflared needs specific ports open, so if you blocked ports, that might be the issue