Self-Hosted Mail Server Behind CGNAT

Why a mail server behind CGNAT cannot receive email

Carrier-grade NAT (CGNAT) puts many customers behind one shared public IPv4 address. Other mail servers have no address to connect to, so port forwarding and dynamic DNS do not help. Most of these providers also block outbound port 25, so the server cannot deliver mail either.

Check yours: if the WAN address on your router starts with 100.64 through 100.127, or differs from the address a "what is my IP" site shows, you are behind CGNAT.

How Mail Server Tunnel works

1. Your domain's MX records point to Forward Email.
2. The Mail Server Tunnel app runs beside your mail server and keeps one outbound connection open to Forward Email. Outbound connections work behind CGNAT.
3. When mail arrives for your domain, Forward Email hands it to the app over that connection.
4. The app delivers it to your mail server over SMTP or LMTP and returns your server's answer to the sender.

The message is not stored by Forward Email. If the app is not connected, senders get a temporary 421 response, keep the message, and try again, usually for up to 5 days. Mail is deferred, not lost.

It works with Postfix, Dovecot, Stalwart, Mailcow, Mail-in-a-Box, Exchange, and the self-hosted Forward Email stack. Spam, SPF, DKIM, and DMARC checks run at Forward Email before the message reaches you, and the results are added to its headers.

Требования

• A domain on a paid Forward Email plan, added under My Account → Domains
• A mail server on your network
• A computer on the same network that stays on (Linux, macOS, or Windows). It can be the mail server itself.

Настраивать

1. Verify your domain and point its MX records to Forward Email

Add your domain under My Account → Domains and add the TXT verification record shown there to your DNS. It looks like this, with a value that is unique to your account:

forward-email-site-verification=XXXXXXXXXX

The TXT verification record is required. It proves that the domain is yours. Mail is only handed to the tunnel of the account whose verification record is in the domain's DNS, so nobody else can receive your mail by adding your domain name to their own account.

Then set these two MX records with priority 10 and remove any others:

mx1.forwardemail.net
mx2.forwardemail.net

2. Download the app

Download the file for your system from the latest release:

• Linux: mail-server-tunnel-linux-x64 или mail-server-tunnel-linux-arm64
• macOS (Apple Silicon): mail-server-tunnel-darwin-arm64
• Windows: mail-server-tunnel-win-x64.exe

On Linux and macOS, make it executable:

chmod +x mail-server-tunnel-*

3. Run the setup

Double-click the file to open the app in your browser, or run the setup in a terminal:

./mail-server-tunnel-linux-x64 setup

The setup asks for four things:

1. Your API token from My Account → Security
2. Which domains deliver to your mail server
3. Where your mail server listens (default 127.0.0.1:25)
4. Whether to start at boot and keep running

It turns on Mail Server Tunnel under each domain's Advanced Settings, checks your MX records, tests the connection to your mail server, and installs a background service (systemd, launchd, Task Scheduler, or cron).

4. Check that it works

mail-server-tunnel status
mail-server-tunnel doctor

Then send a message to an address at your domain from another email account. It should arrive in your mail server within seconds.

Which addresses go to your mail server

Every address at the domain that has no mailbox or forwarding at Forward Email goes through the tunnel. Your mail server decides whether the address exists. Mailboxes and forwarding you create at Forward Email keep working as before, so one domain can use both.

To deliver one address both ways, add your domain's own name as one of its forwarding recipients. Mail for that address then goes to its other recipients and to your mail server. A catch-all that forwards elsewhere receives every address, so add your domain's name to it as well if your server should get that mail.

The tunnel only carries mail for the domain that its DNS verification record belongs to. A domain of the same name on another account receives none of it. Mail Server Tunnel cannot be combined with a custom SMTP port.

Sending mail

Most CGNAT providers block outbound port 25, so relay outgoing mail through Forward Email on port 587 or 465. Enable outbound SMTP for your domain, create a password for a mailbox, then configure your server. For Postfix:

# /etc/postfix/main.cf
relayhost = [smtp.forwardemail.net]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt

# /etc/postfix/sasl_passwd
[smtp.forwardemail.net]:587 you@example.com:PASSWORD

sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
sudo systemctl reload postfix

Reading mail from outside your network

Mail clients outside your network cannot reach an IMAP server behind CGNAT. There are two options:

• Use your mail clients on your own network, or over a private VPN such as Tailscale or WireGuard.
• Turn on remote mailbox access in the app (imap.enabled). The app then runs IMAP commands against your local IMAP server on request from the Forward Email API. It is off by default, only ever connects to the IMAP host in its own settings, and the mailbox password is passed through for one command and not stored.

Alerts when something is wrong

• The app shows a desktop notification when the connection drops for more than a minute, when it returns, and when your mail server stops answering.
• Forward Email emails the domain's admins when the tunnel has been offline, or your mail server unreachable, for 10 minutes. It sends a reminder each day and a notice when it is back.
• Set notify.webhookUrl or notify.command to send the same events to your own monitoring.

Настройки

Every timeout, port, target, and notification can be changed in the config file, with --set key=value, or with an environment variable. Each domain can deliver to a different server. See the full list of settings.

The app updates itself from GitHub releases. It only installs a release whose checksums are signed by Forward Email.

Поиск неисправностей

Turning it off

Run mail-server-tunnel disable and mail-server-tunnel uninstall, or turn off Mail Server Tunnel under Advanced Settings. Addresses without a mailbox or forwarding then bounce as before.