Email auto-forwarding is a mailbox rule that sends incoming messages to another address without manual action. In security, it can expose sensitive data by moving mail outside approved control. Attackers often abuse forwarding rules in compromised accounts to persist access, intercept alerts, and hide evidence of malicious activity.
What Email Auto-Forwarding Means in Security
Email auto-forwarding is a mailbox-level rule that silently redirects new messages to another destination. In everyday administration it can support continuity or routing, but in security it changes where sensitive mail is visible, stored, and monitored, which is why forwarding rules are treated as a control and exposure issue rather than a convenience feature.
The core security concern is that forwarding can move confidential mail outside approved boundaries without the sender or recipient noticing. That matters because message content often contains authentication links, password resets, customer data, incident details, internal approvals, or other information that should remain under organisational oversight.
Why Auto-Forwarding Becomes a Security Problem
Auto-forwarding is risky when it bypasses normal review and monitoring paths. Once a rule is added, messages can be copied to an external account, a shadow mailbox, or a compromised inbox, creating a quiet exfiltration channel that is hard to spot if mail flow monitoring is weak.
Attackers value forwarding rules because they can preserve visibility after account takeover. They do not need to stay logged in continuously if they can make the mailbox keep sending them everything they want to see, including password reset traffic, security alerts, and internal conversations.
Forwarding also weakens the trust boundary around email. A message may remain inside the corporate mailbox system for only a moment before being replicated elsewhere, so retention controls, legal holds, access reviews, and DLP expectations can all be undermined if forwarding is not governed.
Common Abuse and Failure Patterns
Malicious forwarding usually appears after a credential compromise or phishing success, but it can also arise from over-permissive self-service settings, legacy mail rules, or delegated mailbox access that was never re-reviewed. The rule itself is often benign; the risk comes from who can create it, where it sends mail, and whether anyone notices.
Forwarding rules can hide attacker activity in plain sight. Because the mailbox still functions normally for the real owner, many users keep working while the attacker quietly receives copies of messages that reveal internal processes, reset tokens, or investigative activity.
Another failure mode is policy drift. Organisations may allow forwarding for valid business reasons, then fail to enforce destination restrictions, exception approvals, or periodic review. Over time, that creates a durable path for data leakage and account persistence.
How Organisations Reduce Exposure
Limit who can create forwarding rules, restrict forwarding to approved destinations, and review mail flow settings as part of account governance. If forwarding is needed for business reasons, make it explicit, time bound, and visible to administrators and security monitoring.
Investigate mailbox rules whenever an account shows signs of compromise, impossible travel, unusual login patterns, or unexpected changes in message delivery. Forwarding is often one of the first persistence mechanisms an intruder establishes, so it should be checked early in triage.
Strong email security programs treat forwarding as both a confidentiality issue and a detection issue. That means pairing rule monitoring with alerting on anomalous inbox configuration changes, reviewing forwarding destinations, and confirming that high-value mail cannot be silently rerouted outside policy. For broader control mapping, NIST SP 800-53 Rev 5 Security and Privacy Controls is the clearest baseline for access control, auditing, and configuration management. The same operational concern also aligns with OWASP Non-Human Identity Top 10 when forwarding is used to expose machine-generated alerts, notifications, or service mail outside approved control.
Detection and Response After Forwarding Is Found
When suspicious forwarding is discovered, the first question is whether the rule was created by a legitimate user, a delegated admin, or an attacker. That distinction determines whether the event is a policy violation, an account abuse issue, or evidence of broader compromise.
Response should include reviewing mailbox rules, login history, consented application access, and recent password resets or MFA changes, because forwarding often appears alongside other persistence or collection techniques. If the mailbox carried sensitive information, treat the exposure as data-loss review rather than only an account hygiene problem.
After removal of the rule, assess whether copies of mail already left the environment and whether any downstream accounts, sessions, or recovery channels were exposed through forwarded messages. If the mailbox contained security alerts or reset links, the compromise may extend beyond the mailbox itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Mailbox forwarding depends on who can create and keep forwarding rules. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Forwarding abuse is often detected through mailbox rule and login review. | |
| CM-6 — Configuration Settings | Forwarding is a mail configuration control that can be restricted and standardised. | |
| Recommendation — Review mailbox rule privileges and remove unnecessary forwarding capability from ordinary user accounts. Monitor mailbox configuration changes and investigate new forwarding rules as suspicious events. Baseline mail-forwarding settings and block unsanctioned external destinations by default. | ||
| MITRE ATT&CK | T1114.003 — Email Collection: Email Forwarding Rule | Email auto-forwarding is a known adversary collection and persistence technique. |
| Recommendation — Map suspicious rules to T1114.003 and hunt for mailbox persistence and message exfiltration. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Forwarded mail can expose secrets, reset links, and other identity material outside control. |
| Recommendation — Reduce exposure of secrets by preventing mail rules from sending sensitive messages to unapproved mailboxes. | ||
Related resources from NHI Mgmt Group
- When should organisations treat external email auto-forwarding as an unacceptable risk rather than a convenience feature?
- What breaks when email auto-forwarding is not inspected before delivery into CRMs and ticketing tools?
- What breaks when applications auto-link accounts on email alone?
- What are the signs that email forwarding rules or exposed databases are being misused in practice?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org