An email forwarding audit should review both the mailbox's main forwarding setting and every rule or filter that can redirect selected messages. For each route, confirm the destination, business purpose, owner, scope, copy behavior, and approval. Remove stale or unexplained forwarding, secure the mailbox if a route was not authorized, and test the remaining rules with harmless messages.
Inspect every forwarding path
Review the forwarding page, inbox rules, filters, aliases, shared-mailbox settings, delegates, help-desk routing, and any automation that sends copies of incoming mail. Record the source mailbox, destination, matching conditions, actions, whether processing stops after the rule, and whether the original message remains in the mailbox.
Do not rely on the visible forwarding banner alone. A mailbox-wide setting can be off while a filter or inbox rule still forwards a subset of messages. Review all enabled and disabled rules because an old rule can be reactivated later.
Understand the platform behavior
Google's Gmail forwarding guidance explains that mailbox-wide forwarding sends new mail other than spam to a verified destination, while filters can forward only matching messages. Gmail also shows notices after forwarding is enabled and advises changing the password and disabling forwarding if the user did not create it.
Microsoft's Outlook forwarding guidance documents a mailbox forwarding setting and rule-based forwarding or redirection. It also distinguishes keeping a copy in the original mailbox as an available setting.
Translate each platform option into a data flow. Forwarding sends another copy or route to a separate mailbox. Redirect behavior can preserve the original sender differently. Keeping no copy can make the source mailbox look quiet even while messages continue elsewhere.
Validate each destination
Confirm that the destination address is controlled by the organization or is an approved partner. Check spelling, domain, mailbox ownership, account status, and multi-factor authentication. Flag personal addresses, former vendors, temporary project accounts, and destinations that no one can access.
For conditional rules, inspect the full criteria. A rule intended for invoices can accidentally match password resets, employee records, customer messages, or attachments. Use a narrow test set to confirm both messages that should forward and messages that should not.
Respond to unexplained forwarding
If no one can explain a rule or the user denies creating it, preserve the evidence, disable the route, change the account password, review recent sign-ins and recovery methods, revoke unknown sessions, and follow the organization's incident process. Google's guidance specifically treats an unexpected forwarding notice as a possible account-access problem.
Do not send real confidential mail as a test. Use owner-controlled accounts and harmless subject lines. Check the destination inbox, spam folder, source mailbox, message headers, and timing. Confirm whether the rule created a copy, moved the source, or stopped later rules.
Record and repeat the review
- Inventory mailbox forwarding, filters, inbox rules, delegates, and automated routes.
- Assign an owner and purpose to every destination.
- Verify matching conditions and copy or deletion behavior.
- Remove obsolete, personal, or unexplained destinations.
- Test positive and negative examples with non-sensitive messages.
- Record the reviewer, changes, evidence, and next review date.
- Repeat after staff changes, mailbox migrations, or a security alert.
The goal is a forwarding map that the team can explain from source to destination. A rule can be technically valid and still be inappropriate if its owner left, its scope expanded, or its destination is no longer protected.
Sources
- Automatically forward Gmail messages to another account — Gmail Help
- Turn automatic forwarding on or off in Outlook — Microsoft Support