How alumni email forwarding works

What happens when someone emails an alumni address?

A message to jane.doe@alumni.example.edu follows the same path as any other email, with one extra hop:

1. The sender's mail server looks up the MX records for alumni.example.edu and finds mx1.forwardemail.net and mx2.forwardemail.net.
2. Forward Email accepts the connection and checks the sender against its allowlist, denylist, greylisting and rate limits.
3. It reads the alias configuration for jane.doe and finds the destination, for example a Gmail or Outlook.com address.
4. It rewrites the envelope sender with the Sender Rewriting Scheme (SRS) and adds ARC headers, so authentication results survive the forward.
5. It delivers the message to the destination over TLS. The message is processed in memory and is not written to disk.

The Forward Email FAQ describes each SMTP step in detail.

Which DNS records do you need?

You need two MX records on the domain that holds the alumni addresses. On a paid plan you also add one TXT record that proves you own the domain. The verification value comes from your Forward Email dashboard.

Remove any other MX records on that name. Both Forward Email records must exist. DNS changes can take up to 24 to 48 hours to reach every resolver, though they often apply sooner, so lower the TTL a day ahead if you are switching from another provider. Source: How do I get started and set up email forwarding?

If alumni will also send mail from their address, add SPF, DKIM and DMARC records as described in the Forward Email FAQ. Forward Email's SPF value is v=spf1 a include:spf.forwardemail.net -all.

Should alumni use a subdomain?

A subdomain is the simplest choice when staff and current students already receive mail on the main domain through Google Workspace or Microsoft 365. MX records belong to one host name, so alumni.example.edu can point to Forward Email while example.edu keeps its current provider. Nothing changes for staff mail.

If alumni addresses must stay on the main domain, the domain can still have only one set of MX records. In that case your current provider receives all mail and routes addresses it does not recognize to Forward Email. The migration guide covers both options.

On paid plans you can also turn on wildcard subdomain forwarding, which lets every subdomain without its own records inherit the root domain's aliases. It is off by default and set per domain.

How are alumni addresses set up?

Each graduate gets one alias. An alias has a name (the part before the @) and one or more recipients.

• One alias per graduate. jane.doe forwards to jane@example.com. Graduates can have more than one recipient.
• Recipient verification. With recipient verification on, a new destination receives a confirmation link, and mail flows only after the graduate clicks it. This stops typos from sending alumni mail to a stranger.
• Catch-all and patterns. A catch-all alias receives mail for any name that has no alias. Regular expressions can route whole patterns of names.
• Disabling an address. A disabled alias can accept mail quietly (code 250), ask senders to retry later (421) or reject mail permanently (550).
• Labels. Labels such as a class year help you find and update groups of aliases.

Set up alumni forwarding step by step

1. Get an Enterprise agreement

   Contact Forward Email for the Enterprise plan. It covers use by people outside your staff, such as alumni, which the standard terms do not.

2. Add the domain

   Add alumni.example.edu in the Forward Email dashboard and copy the verification value it shows.

3. Publish DNS records

   Add the two MX records and the TXT verification record at your DNS provider, then run the verification check.

4. Create aliases

   Import aliases through the API from your alumni database, or add them in the dashboard for a pilot group.

5. Test and announce

   Send test messages from outside providers, confirm delivery and headers, then tell alumni about their addresses.

How do you create aliases from your alumni database?

The Forward Email API creates an alias with one request. Authenticate with your API token as the Basic Auth user name and an empty password.

curl -X POST https://api.forwardemail.net/v1/domains/alumni.example.edu/aliases \
  -u "$API_TOKEN:" \
  -H "Content-Type: application/json" \
  -d '{"name": "jane.doe", "recipients": ["jane@example.com"], "labels": ["class-of-2025"], "has_recipient_verification": true}'

The same request from Node.js, for a nightly sync job:

// Create a lifetime alumni address for one graduate
const token = process.env.FORWARD_EMAIL_API_TOKEN;
const response = await fetch('https://api.forwardemail.net/v1/domains/alumni.example.edu/aliases', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: 'Basic ' + Buffer.from(token + ':').toString('base64')
  },
  body: JSON.stringify({
    name: 'jane.doe',
    recipients: ['jane@example.com'],
    labels: ['class-of-2025'],
    has_recipient_verification: true
  })
});
const alias = await response.json();

To change a destination later, send PUT /v1/domains/alumni.example.edu/aliases/:alias_id with new recipients. To retire an address, set is_enabled to false. The API reference lists every field.

Does the free plan work for alumni email?

The free plan forwards mail with only MX and TXT records and no account. It is meant for your own addresses. On the free plan the forwarding rules live in public TXT records, so anyone can look up where each address forwards. Forward Email's standard terms also do not cover a service used by third parties such as alumni. Paid plans keep aliases out of public DNS, and the Enterprise plan adds a terms exception for third parties and onboarding help. See Forward Email's Enterprise details.