An external email forwarding rule is a mailbox rule that automatically sends incoming messages to an address outside the organisation. It is usually created in an email client or server-side rules engine, and can be used for convenience or for covert message exfiltration if an attacker gains mailbox access or rule-editing privileges.
What an external email forwarding rule does
An external email forwarding rule is a mailbox-side automation that copies or redirects incoming messages to an outside address. In ordinary use it saves time, but in a security incident it can become a quiet exfiltration path because mail continues to flow while the user may not notice the destination change.
The key security property is not the rule itself, but the fact that it can move messages out of organisational control after mailbox access has already been obtained. That makes forwarding rules especially relevant in account takeover, business email compromise, and insider abuse scenarios.
Why external forwarding is security-sensitive
Forwarding rules are sensitive because they can be created from inside a legitimate mailbox session and can blend into normal user activity. Once enabled, they may expose sensitive correspondence, reset links, invoices, legal notices, or conversation threads to an external recipient without triggering obvious delivery failures.
In Microsoft 365 environments, external forwarding often sits alongside other mailbox abuse patterns such as hidden inbox rules, app consent abuse, or mailbox audit blind spots. A defence-in-depth view is useful here: the rule is a symptom of mailbox control, but the underlying problem is the authority to edit mail flow or mailbox rules.
For a practical defensive baseline, Exchange Online Security Guide is useful because it ties forwarding, mailbox auditing, and RBAC scoping together in one operational model.
How organisations detect exposure and misuse
Exposure checks usually start with three questions: which mailboxes allow external forwarding, which users or applications can change inbox rules, and whether the tenant or mail gateway blocks auto-forwarding at the policy level. Organisations should also look for mailboxes that have unusually quiet but persistent rule changes, especially after phishing, token theft, or helpdesk-driven password resets.
Detection is strongest when mailbox-rule telemetry is combined with audit logs, message trace, and investigation of access patterns such as rule creation, remote inbox access, or mail reads that precede forwarding. A forwarding rule by itself does not prove compromise, but it becomes much more suspicious when paired with new sign-ins, consent grants, or unusual outbound routing.
Microsoft 365 Unified Audit Log Guide for Detection helps practitioners connect inbox-rule events with mailbox activity, while Email Gateway and Message Trace Detection Guide shows how message trace and email logs support that investigation.
Containment and recovery after suspicious forwarding is found
When a forwarding rule is discovered, the first priority is to remove the rule and verify whether the mailbox, token, or session that created it is still trusted. If compromise is suspected, the response should include session revocation, credential reset where appropriate, review of mailbox delegates and application access, and a check for additional rules that hide, delete, or auto-archive messages.
Recovery does not end with deleting the rule. Organisations should review recent sent items, accessed messages, connected apps, inbox filters, and any externally forwarded correspondence that may already have left the environment. If the mailbox supported finance, HR, legal, or executive workflows, the downstream risk can extend into fraud, privacy, or impersonation.
Business Email Compromise Response Playbook is relevant because forwarding rules often appear inside a broader compromised-mailbox response, not as an isolated configuration issue.
Risk and Threat Considerations
External forwarding rules matter because they can turn a legitimate mailbox into a covert export channel. The main risk is silent loss of confidentiality, but the same mechanism can also support persistence, surveillance, and follow-on fraud if an attacker keeps receiving mail after initial compromise.
Failure mechanism: An attacker who gains mailbox access or rule-editing privileges creates a rule that forwards selected or all messages to an external address, often while leaving the inbox otherwise usable.
Impact: Sensitive content may be exfiltrated over time, including credentials reset flows, financial correspondence, personal data, and internal business context that can be reused for impersonation or lateral fraud.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1114 — Email Collection | External forwarding is a common email collection and exfiltration technique. |
| Recommendation — Map forwarding-rule abuse to T1114 and hunt for mailbox collection and exfiltration activity. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Forwarding-rule abuse is found through audit and mailbox activity review. |
| AC-6 — Least Privilege | Forwarding-rule abuse is enabled by excessive mailbox or admin privileges. | |
| IA-5 — Authenticator Management | Compromised credentials commonly precede malicious mailbox rule creation. | |
| Recommendation — Review audit records for rule creation, mailbox access, and suspicious forwarding changes. Limit rule-editing and mailbox-management privileges to the smallest necessary set. Rotate exposed credentials and invalidate sessions after suspicious forwarding is discovered. | ||
| CIS Controls v8 | 5 — Account Management | Mailbox rule abuse is governed through account and access lifecycle control. |
| Recommendation — Restrict, review, and disable unnecessary mailbox and admin access paths. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Mailbox and email service access must be strongly authenticated to prevent rule abuse. |
| Recommendation — Strengthen authentication on email services so attackers cannot create forwarding rules after takeover. | ||
Practitioner Guidance
Governance implication: Treat external forwarding as a controlled exception, not a default mailbox feature. The practical question is who can create or approve it, how it is monitored, and whether the organisation blocks or scopes automatic forwarding in higher-risk mailboxes.
What to watch for: A newly created forwarding rule, especially one that appears after a sign-in anomaly, consent grant, or password reset, deserves immediate review. Long-lived rules are particularly risky because they can continue leaking mail after the original compromise event is forgotten.
Securing Your Email Account Guide and Hacked Social Media or Email Account Recovery Guide are useful for the recovery side of this topic, especially when the forwarding rule is part of a broader account takeover.
Related resources from NHI Mgmt Group
- Guide: T1114 Email Collection Defensive Guide
- Email Forwarding
- When should organisations treat external email auto-forwarding as an unacceptable risk rather than a convenience feature?
- What mitigations reduce the risk of email forwarding rule abuse?
- How do you block automatic email forwarding to external domains in Exchange Online?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org