How to Automate Email with Forward Email (and Save $100+/yr vs. Google Workspace)

Trent Tompkins June 7, 2026

If you run a handful of domains and mostly want info@, support@, and hello@ to quietly land in your real inbox, Google Workspace bills you like you're a 50-person company — and the one thing you'd most want to script, DKIM, it won't let you touch through its API.

Forward Email flips both problems: flat pricing and a REST API that automates everything — DKIM included. Here's how I moved 27 addresses across 11 domains off Workspace in an afternoon, with code you can reuse.

The math: why per-seat pricing is a trap

When I pulled my actual Workspace inventory, here's what I found: 27 email addresses, every single one forwarding to one mailbox. info@, support@, trent@, billing@… all just aliases dumping into a single inbox.

That's the trap. Google Workspace charges per mailbox, not per address — so even a forwarding-heavy setup like mine costs a full seat (or more):

That's $100+/yr saved, and Forward Email's flat rate doesn't budge whether you have 3 domains or 30.

The real unlock: DKIM you can actually script

Here's the dirty secret of email automation. Setting up a domain means publishing a fistful of DNS records — MX, SPF, DMARC, a verification token, and DKIM. The first four are easy to automate. DKIM is where everyone gets stuck, because the key is generated by your provider.

Google Workspace has a sprawling Admin SDK… that does not expose DKIM. I verified it by hitting the API directly:

AttributeError: 'Resource' object has no attribute 'dkimSettings'

There's no endpoint. You generate the DKIM key by hand, in the console, one domain at a time, forever. For anyone managing more than a couple of domains, that's death by a thousand clicks.

The walkthrough

0. Get an API key

Grab a token from My Security in your Forward Email dashboard. Every request uses HTTP Basic auth with the token as the username and a blank password:

curl https://api.forwardemail.net/v1/account -u YOUR_API_TOKEN:

(Note the trailing colon — that's the empty password.)

1. Create a domain

curl -X POST https://api.forwardemail.net/v1/domains \
  -u YOUR_API_TOKEN: \
  -d domain=example.com \
  -d plan=enhanced_protection

2. Pull the DNS records — including DKIM (the magic step)

GET the domain and read smtp_dns_records plus verification_record:

curl https://api.forwardemail.net/v1/domains/example.com -u YOUR_API_TOKEN:

{
  "verification_record": "MhCkDq7u8z",
  "smtp_dns_records": {
    "dkim":        { "name": "fe-be568c8a41._domainkey", "value": "v=DKIM1; k=rsa; p=MIGf..." },
    "return_path": { "name": "fe-bounces",               "value": "forwardemail.net" },
    "dmarc":       { "name": "_dmarc",                    "value": "v=DMARC1; p=reject; ..." }
  }
}

There it is — your live DKIM record, ready to publish, straight from an API call. No console, no manual key generation.

3. Publish to your DNS

The full record set for a Forward Email domain:

If your registrar has an API (mine is NameSilo), this whole table gets published in a loop — DKIM and all.

4. Create your aliases (forwarders)

curl -X POST https://api.forwardemail.net/v1/domains/example.com/aliases \
  -u YOUR_API_TOKEN: \
  -d name=info \
  -d recipients=you@gmail.com

Want a catch-all instead? Use name=*. One alias, every address on the domain forwarded.

5. Verify

curl https://api.forwardemail.net/v1/domains/example.com/verify-records -u YOUR_API_TOKEN:

A reusable hook

Wrap it once and you never click through a DNS setup again. The core is tiny:

import requests

API = "https://api.forwardemail.net"
KEY = "YOUR_API_TOKEN"

def call(method, path, **data):
    r = requests.request(method, API + path, auth=(KEY, ""), data=data or None)
    return r.json()

def dns_records(domain):
    """The full record set this domain needs - DKIM pulled live from the API."""
    d   = call("GET", f"/v1/domains/{domain}")
    sdr = d.get("smtp_dns_records", {})
    recs = [
        ("MX",  "@", "mx1.forwardemail.net"),
        ("MX",  "@", "mx2.forwardemail.net"),
        ("TXT", "@", "v=spf1 include:spf.forwardemail.net -all"),
        ("TXT", "@", f"forward-email-site-verification={d['verification_record']}"),
    ]
    for role in ("dkim", "return_path", "dmarc"):
        rec = sdr.get(role)
        if rec:
            kind = "CNAME" if role == "return_path" else "TXT"
            recs.append((kind, rec["name"], rec["value"]))
    return recs

Pipe dns_records() into your registrar's API and a new domain goes from zero to fully-authenticated, DKIM-signed email in one command.

Migrating off Workspace without downtime

Two rules:

1. Inventory first — don't migrate blind. Pull every address that exists before you touch anything. Google's Admin SDK lists your users and the emails[] array on each (your aliases live there), plus any Groups you use as forwarders. That's how I found all 27 addresses — and confirmed they all hit one mailbox.

2. Keep Workspace running until Forward Email verifies. Set up the FE domain, publish DNS, create the aliases, then flip the MX. Because the new records propagate before you cut over, you get zero lost mail.

The payoff

• Flat $36/yr instead of $150+/yr — and it never scales up with more domains.
• Unlimited domains and aliases, so every project's hello@ is free.
• Fully scriptable — add a domain, publish DNS, create forwarders, all from code.
• DKIM included — the exact thing Google's API refuses to automate becomes a single field in a JSON response.

The whole point of owning your domains is owning your email. Forward Email's API is the first one I've used where owning it actually means automating it — and paying a flat rate to do so.

Total migration time: an afternoon. Total recurring savings: $100+/yr. Manual DKIM clicks going forward: zero.