Haltman mail-forwarding-core

Overview

Haltman mail-forwarding-core is an open-source stack behind Haltman.io’s public email forwarding service. It is best for people who want no-cost, API-managed aliases or the freedom to host the forwarding infrastructure themselves. Its narrow focus is also its main trade-off: this routes mail onward rather than providing a mailbox or a safe way to reply under an alias.

Key features

For public forwarding, users select a handle and domain, enter a destination address, and confirm the rule by email. Custom domains and API access suit people managing aliases programmatically, but there is no catch-all forwarding. The service forwards to external destinations and does not store messages or deliver them to a local mailbox, so it is not a replacement for email hosting.

The self-hosted reference stack brings together Postfix, Dovecot, PostSRSd, MariaDB and DNS configuration, with optional OpenDKIM signing. Its NestJS API manages alias rules, and API keys allow programmatic administration. A Firefox add-on offers another way to work with the API; its maker says the key is encrypted locally using AES-GCM, with PBKDF2 key derivation. That is useful for Firefox users, but the service has no mobile app.

Security controls include recipient allowlisting, sender anti-spoofing, rate limits on connections, messages and recipients, and TLS-required authenticated submission using Dovecot SASL. PostSRSd rewrites forwarded senders, while inbound SRS-formatted senders are rejected. Confirmation tokens are six digits, stored as SHA-256 hashes, and expire after 10 minutes. The project says it does not log message content or store plaintext tokens in its database. Optional OpenDKIM signing fails closed if signing is enabled but the service is unavailable.

These measures do not eliminate forwarding’s deliverability risks: strict DMARC rejection policies can still cause failures, and shared domain reputation can affect delivery. Replies cannot be sent from an alias, so a response may expose the user’s real address. PGP is also absent.

Pricing

The free plan’s uncapped rules and addresses make it a strong fit for broad forwarding needs without a subscription. There is no payment, trial, or paid tier described; the important limitation is that unlimited forwarding does not add message storage or reply-from-alias. The service supports custom domains and API access, but not catch-all forwarding.

Platforms

The project spans API, browser extension, Linux, self-hosted and web use. The extension is for Firefox. Running the stack yourself requires Debian 13 or a compatible system, root or sudo access, a public IP with port 25 open, and DNS control for each forwarded domain. That is a substantial infrastructure commitment, so self-hosting is best for technically capable operators rather than people seeking a managed mailbox.

Who it's for

Haltman is aimed at research, education and legitimate privacy use. It suits individuals or operators who need forwarding, control over alias rules through an API, and either a free public service or an open-source stack they can deploy. The maker releases the project under the Unlicense, which it describes as public domain, and directs vulnerability reports to [email protected] while welcoming community questions through its Telegram group.

Choose another kind of email product if you need a mailbox, message retention, PGP, mobile access, catch-all aliases, or the ability to reply without revealing your real address.

Pros and cons

Pros

• No-cost scale: The free plan allows unlimited rules, users, addresses, domains and emails, which removes per-alias caps for forwarding use.
• API control: API keys and a NestJS alias-management API suit programmatic workflows.
• Deployable stack: The open-source core and optional DKIM give self-hosters control over a forwarding setup.
• Layered safeguards: TLS, allowlisting, anti-spoofing and rate limits address several common abuse and submission risks.

Cons

• Forwarding only: No message storage or local mailbox delivery means another service is needed for inbox access.
• Alias replies are unsafe: Replies cannot use the alias and can reveal the real address.
• Self-hosting has real prerequisites: A public IP, open port 25, DNS access and compatible Debian make deployment unsuitable for many casual users.
• Delivery is not guaranteed: Strict DMARC policies and shared reputation can still interfere with forwarding.
• No PGP or mobile app: Users needing either must look elsewhere.

Alternatives

Email Forwarding Services is a useful category starting point for comparing forwarding tools. For a broader platform set including Android, iOS, macOS and Windows, consider Forward Email; it also has a free plan and describes its service as built with open-source software, while its Enhanced Protection plan costs $3 a month.

DNSExit Email Forwarding is another free option for domains registered through DNSExit, with a 5 Emails plan at $6.99 a year for readers comparing low-volume paid forwarding. If catch-all aliases matter, EForw offers unlimited catch-all aliases on its free plan for one domain, while Haltman does not support catch-all forwarding.

Readers who prefer a defined daily cap and retained logs can compare the free plans from Forward (one domain, 25 aliases, 500 forwards per day, seven days of logs and one team seat) and ImprovMX (one domain, 25 aliases, 500 forwarded emails per day, seven-day email logs, API access and a 99% uptime guarantee). Their published caps may be a better fit than Haltman’s infrastructure-focused, forwarding-only offer.

InboxMail combines forwarding-related allowances with AI actions, a campaign and agent inboxes on its free plan, so it may suit readers looking for more than simple alias forwarding. KaiMail offers a free custom-domain mailbox with a 300-email monthly cap and one-day log retention, making it the more relevant comparison for someone who wants a mailbox rather than forwarding alone. Mailcast has a free plan for one domain and up to 25 aliases, but does not allow sending from the domain; choose it only if that cap and restriction fit your needs.

Verdict

Haltman mail-forwarding-core is a good choice for privacy-minded users who need free, uncapped forwarding or want an open-source stack with API-managed aliases and configurable controls. Its strongest case is forwarding without per-address or email quotas. Look elsewhere if you need stored mail, alias replies, PGP, mobile access, or dependable delivery across strict DMARC environments.