- Home
- Email Forwarding Services
- Haltman mail-forwarding-core
Haltman mail-forwarding-core
What it is
Haltman mail-forwarding-core is an open-source stack for forwarding mail to external destinations, and it serves as the reference implementation for Haltman.io’s free public forwarding service. It does not store messages or deliver them to a local mailbox. Users choose a handle, domain, and destination, then confirm the forwarding rule by email. An API manages alias rules, with API keys available for programmatic management; a Firefox extension is also available. The stack combines Postfix, Dovecot, PostSRSd, MariaDB, DNS configuration, and optional OpenDKIM. Its reference setup includes recipient allowlisting, sender anti-spoofing, and rate limits. The project says it does not log message content or persist plaintext tokens in its database. Self-hosting requires Debian 13 or compatible, root or sudo access, a public IP with port 25 open, and DNS control for each forwarded domain. The service is free, with unlimited forwarding rules, users, addresses, domains, and emails. It does not support replying from an alias, and strict DMARC policies can still affect delivery.
For and against
For
- Free plan allows unlimited forwarding rules and addresses.
- API keys support programmatic alias management.
- Reference setup includes anti-spoofing and rate limits.
- Firefox add-on stores its API key encrypted locally.
Against
- No message storage or local mailbox delivery.
- Replies from aliases are not supported.
- Self-hosting requires an open port 25 and DNS control.
- DMARC policies and shared reputation can affect deliverability.
The verdict
Haltman mail-forwarding-core provides a free forwarding-only stack with API management and abuse controls. Its self-hosting requirements and lack of reply-from-alias support are important limits for prospective users.
Who it suits
It suits people seeking mail forwarding for research, education, or legitimate privacy use, including those comfortable managing a self-hosted mail stack. Those who need stored messages or reliable reply-from-alias functionality should note that these are not provided.
Plans and prices
Free
Unlimited forwarding rules, users, addresses, domains, and emails · forwarding only
Read 8 Oct 2026 · haltman.io
On the record
- Abuse controls
- The reference configuration uses recipient allowlisting, sender anti-spoofing, and connection, message, and recipient rate limits.github.com · read 7 Oct 2026
- API
- A NestJS API manages alias rules, and API keys can be used for programmatic management.haltman.io · read 8 Oct 2026
- Audience
- The maker describes the service as intended for research, education, and legitimate privacy use.haltman.io · read 7 Oct 2026
- Browser extension
- A Firefox add-on is available; the maker says it stores the API key locally with AES-GCM encryption and PBKDF2 key derivation.haltman.io · read 8 Oct 2026
- Components
- The core combines Postfix, Dovecot, PostSRSd, MariaDB, DNS configuration, and optional OpenDKIM.github.com · read 7 Oct 2026
- Confirmation tokens
- The maker says alias confirmation tokens are six digits, stored as SHA-256 hashes, and expire after 10 minutes.haltman.io · read 8 Oct 2026
- Core components
- The stack uses Postfix, Dovecot, PostSRSd, MariaDB, DNS, and optional OpenDKIM.github.com · read 8 Oct 2026
- Data handling
- The core says it stores no mailboxes, logs no message content, and does not persist plaintext tokens in the database.github.com · read 8 Oct 2026
- Deliverability caveat
- The maker says strict DMARC rejection policies can still cause forwarding issues and shared domain reputation can affect deliverability.haltman.io · read 8 Oct 2026
- DKIM
- OpenDKIM signing is optional; the reference configuration fails closed if the signing service is enabled but unavailable.github.com · read 7 Oct 2026
- Forwarding flow
- Users choose a handle, domain, and destination, then confirm the forwarding rule by email.haltman.io · read 8 Oct 2026
- Intended use
- The maker describes the service as intended for research, education, and legitimate privacy use.haltman.io · read 8 Oct 2026
- License
- The core is released under the Unlicense, which the repository describes as public domain.github.com · read 8 Oct 2026
- Limits
- The service does not provide reply-from-alias, message storage, PGP, or a mobile app for the service.haltman.io · read 8 Oct 2026
- Mail authentication
- Authenticated submission requires TLS and Dovecot SASL, while PostSRSd rewrites forwarded senders.github.com · read 7 Oct 2026
- Mail handling
- The stack forwards mail to external destinations and does not store messages or provide local mailbox delivery.github.com · read 7 Oct 2026
- Notable limit
- The maker states that forwarding does not support replying from an alias, and replies can expose the real address.haltman.io · read 7 Oct 2026
- Purpose
- The core is an open-source mail-forwarding stack used by Haltman.io for its public forwarding service.github.com · read 8 Oct 2026
