Email Forwarding

What Email Forwarding Does

Email forwarding is a routing rule, not a mailbox by itself. It moves incoming mail from one address to another destination mailbox, which is why aliases can work without creating separate inboxes. The same convenience can also hide where messages actually land, so the forwarding path matters as much as the visible address.

In practice, forwarding can be set up at the mailbox level, the account level, or through mail infrastructure such as filters and transport rules. Those layers are operationally different, but the security outcome is similar: a message delivered to the public address may be stored, read, or processed somewhere else entirely. That is why forwarding should be treated as part of the mail trust boundary, not just a user preference.

Why Forwarding Paths Matter for Security

Forwarding changes who can see messages, where retention applies, and which logs contain the record of delivery. If a mailbox is compromised, an attacker may create or alter forwarding so that messages quietly flow to an outside address while the victim still receives mail normally. That makes forwarding a common persistence and exfiltration mechanism in account compromise cases.

Forwarding also affects incident response. If investigators only inspect the visible inbox, they may miss messages that were redirected elsewhere, especially when the forwarding rule sits in a mailbox the user does not actively monitor. In organisations that rely on email for approvals, password resets, or customer contact, that can turn a small configuration change into a broader trust problem.

T1114 Email Collection Defensive Guide is useful here because it covers mailbox access and forwarding-rule abuse as a defender concern, including the need to detect suspicious mail routing changes.

Common Abuse Patterns and Failure Modes

The most important failure mode is hidden or unauthorized forwarding. Attackers use it to collect resets, invoices, internal discussion, or security notifications without needing to stay visibly active in the inbox. Forwarding can also be paired with inbox rules that move or delete copies of messages, making the compromise harder to notice.

Another failure mode is overbroad legitimate forwarding. People sometimes forward mail to personal accounts, shared mailboxes, or downstream services for convenience, but that can bypass corporate retention, monitoring, or data-loss controls. In regulated or high-trust environments, the result may be accidental data exposure rather than an obvious intrusion.

Microsoft 365 Unified Audit Log Guide for Detection supports this operational view because forwarding-rule activity is only useful if it is observable in audit data and review workflows.

How Organisations Should Think About Control and Detection

Forwarding is best managed as a control point, not a convenience feature. Organisations need visibility into who can create forwarding, what destinations are allowed, and whether external forwarding is permitted at all. The practical question is not whether mail can be redirected, but whether the organisation can account for every path a message may take.

Detection should focus on changes, not just mail volume. A newly added forwarding rule, a changed destination, or a mailbox that suddenly stops receiving expected mail can all indicate abuse. Mail trace, mailbox audit data, and identity event logs become much more valuable when they are correlated with account recovery, sign-in, and rule-change activity.

Email Gateway and Message Trace Detection Guide fits this need because message tracing is one of the clearest ways to confirm where mail actually went after delivery.

Practitioner Guidance

Why practitioners should care: Email forwarding is often treated as an administrative convenience, but it directly affects confidentiality, retention, and incident response. If forwarding is not governed, it can quietly create a second mailbox path that defenders do not monitor as closely as the primary inbox.

What to watch for: Pay attention to forwarding that appears without a clear business need, especially when it points outside the organisation or changes alongside password resets, sign-in anomalies, or new inbox rules. Those are common signs that mail is being rerouted for concealment or collection.

Practitioner takeaway: The safest assumption is that forwarding changes the security boundary, so it should be reviewed with the same seriousness as mailbox access or delegation changes.

Related resources from NHI Mgmt Group

• What are the signs that email forwarding rules or exposed databases are being misused in practice?
• When should organisations treat external email auto-forwarding as an unacceptable risk rather than a convenience feature?
• What breaks when email auto-forwarding is not inspected before delivery into CRMs and ticketing tools?
• What should organisations do when forwarding rules move email into operational systems?