Mail forwarding rule is an email setting that automatically sends incoming messages to another mailbox or address. In identity and access management, it can redirect messages containing passwords, password reset links, MFA prompts or other sensitive account data, so administrators often review and restrict these rules as part of mailbox security and privileged access monitoring.
What a mail forwarding rule does in practice
A mail forwarding rule automatically copies or reroutes incoming email to another mailbox or address. In everyday administration, that means a simple mailbox setting can become a hidden path for sensitive messages to leave the intended account boundary.
The term matters because the rule is not just a convenience feature. It can change who sees password resets, MFA prompts, account alerts and business messages, so security teams treat forwarding as part of mailbox control rather than a benign personal preference.
Why forwarding rules become a security control point
Forwarding is attractive because it is quiet, persistent and easy to overlook. If an attacker gains mailbox access, they may add a rule to continue receiving mail after the initial login, which helps them monitor recovery messages, hide notifications or keep access alive even after a password change.
This is why forwarding is often reviewed alongside account recovery settings, session revocation and mailbox audit signals. A rule can be created quickly, but its impact can last until someone notices the extra delivery path and removes it.
Administrators often pair review of forwarding rules with mailbox hardening measures such as checking hidden rules, restricting automatic forwarding and validating whether any external destination is business-approved. The goal is to reduce the chance that email meant for one identity is silently redirected elsewhere.
How organisations detect and verify forwarding exposure
Exposure checks usually start with an inventory question: which mailboxes are allowed to forward, to whom, and under what policy? That review should include user mailboxes, shared mailboxes and administrative accounts, because the risk profile is higher when the mailbox receives reset links or approval prompts.
Detection should also look for signs that forwarding was added after suspicious login activity, that it points to an unfamiliar domain, or that it appears alongside new inbox rules, OAuth consent abuse or unusual mail access. Mailbox audit logs and message-trace tooling help establish whether the rule was created as part of normal administration or as part of compromise.
For organisations using Microsoft 365, this is the kind of problem that benefits from audit visibility and Exchange hardening; Microsoft 365 unified audit log detection and Exchange Online hardening with the CISA SCuBA baseline both support the review of forwarding-related events and policy controls. Where a rule is suspected in an incident, T1114 Email Collection helps place forwarding in the wider mailbox-collection pattern.
What forwarding rules can expose if they are abused
Because email is often a recovery channel, a forwarding rule can expose password resets, one-time codes, invoice traffic and internal approvals. That makes it especially dangerous in accounts tied to finance, executives, IT administration or any mailbox that can change access elsewhere.
If an attacker keeps receiving messages after the user believes the account is fixed, the compromise can survive basic remediation. The practical consequence is continued visibility into business communications, delayed detection and a higher chance of follow-on fraud.
Business Email Compromise Response Playbook is useful here because forwarding abuse is often part of the same incident pattern as mailbox takeover, payment diversion and recovery-link theft. Hacked account recovery guidance is also relevant when the rule is a symptom of a broader account compromise rather than an isolated mailbox setting.
How to treat forwarding rules during remediation
When a suspicious forwarding rule is found, the administrative response should treat it as evidence of possible mailbox compromise, not just an unwanted setting. The rule should be removed, the mailbox session reviewed, and the recovery path checked for password reset and MFA abuse.
After cleanup, teams should confirm whether the mailbox still contains any hidden rules, delegated access, suspicious app permissions or external connectors that could recreate the same exposure. In many incidents, forwarding is only one of several persistence mechanisms.
Securing Your Email Account Guide provides the broader mailbox-hardening context, while Email Gateway and Message Trace Detection Guide supports the log review needed to confirm what was sent, where it went and whether the rule was used maliciously.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Forwarding-rule abuse is found by reviewing mailbox and audit activity. |
| IA-5 — Authenticator Management | Forwarding abuse often targets password reset and authentication messages. | |
| AC-6 — Least Privilege | Limiting mailbox and admin access reduces who can create forwarding rules. | |
| Recommendation — Review mailbox audit events to spot new forwarding rules and suspicious changes. Protect and rotate authenticators when forwarding may have exposed reset traffic. Restrict mailbox-setting privileges to the smallest set of authorized users. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Forwarding-rule review is part of controlling mailbox access and privileges. |
| Recommendation — Enforce mailbox access controls and monitor for unauthorized forwarding changes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Forwarding rules affect account control, review, and misuse detection. |
| Recommendation — Monitor account settings for unexpected forwarding and remove unauthorized rules. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org