Mailbox Forwarding Rule

What a mailbox forwarding rule changes in email security

A mailbox forwarding rule silently changes the default path of inbound mail. Instead of ending at the intended mailbox, messages are copied or redirected elsewhere, which means the organisation can lose visibility into business communications, alerts, and sensitive resets.

The security significance is not the forwarding feature itself, but the trust it inherits from email. If the mailbox is used for authentication flows, approvals, payroll, finance, or customer communication, forwarding can move high-value content outside the control boundary without changing the mailbox owner’s apparent access.

Why forwarding rules are dangerous in identity and account compromise scenarios

Mailbox forwarding becomes especially risky when an attacker already has access to the account, or when overbroad automation creates rules that users do not notice. In those cases, forwarding can function as a quiet exfiltration channel for password resets, MFA prompts, invoice mail, and security notifications.

This is why forwarding rules are often treated as an identity security concern as much as a mail hygiene issue. When an account is compromised, the rule can help the attacker keep receiving recovery mail and maintain persistence even after the initial login is detected or blocked.

Mailbox compromise often produces a chain of abuse: the attacker reads sensitive mail, intercepts account recovery messages, and uses that access to expand into other systems. Guidance on OWASP Non-Human Identity Top 10 is useful here because it highlights how overprivilege, secret exposure, and hidden access paths can sustain compromise.

How organisations detect and review mailbox forwarding exposure

Exposure review starts with inventory and policy. Organisations should know which mail systems permit automatic forwarding, which tenants allow external forwarding, and which accounts have rules that send mail to third-party destinations or unmanaged inboxes.

Detection should focus on the actual rule configuration, not just user login activity. A mailbox can appear healthy while forwarding quietly diverts mail outside the business. Security teams should review creation time, destination domain, rule conditions, and whether the rule was added recently after a password reset, helpdesk interaction, or suspicious sign-in.

Where email is part of a broader identity control plane, the same control themes align with NIST SP 800-53 Rev 5 Security and Privacy Controls and NIST Cybersecurity Framework 2.0, especially around access control, auditability, and continuous monitoring.

How to reduce the blast radius of forwarding abuse

The most effective control is to limit forwarding to only approved business cases, then monitor for exceptions. External forwarding should be disabled by default where possible, and automatic rule creation should be constrained so that a compromised mailbox cannot silently redirect mail without review.

Compensating controls matter when forwarding cannot be fully blocked. Those controls include alerting on new forwarding rules, reviewing mail flow to non-corporate destinations, and checking whether recovery mail, security notifications, or high-value workflows depend on a mailbox that could be redirected.

For governance and technical hardening, NIST Privacy Framework can help organisations think about unwanted disclosure paths, while NIST AI Risk Management Framework is only relevant when automation or AI-assisted workflows are part of rule creation or review.

Mail forwarding should also be treated as a post-compromise cleanup item. If a mailbox was accessed by an attacker, review whether rules were added, whether any delegated access was granted, and whether mailbox changes persisted after the primary credentials were reset.

What administrators should validate after a suspected compromise

After suspected abuse, the key question is whether mail has been exfiltrated or recovery paths have been hijacked. A mailbox rule can outlive a password reset, so recovery should include mailbox rule review, session revocation, credential rotation, and confirmation that no alternate delivery destination remains in place.

Where email is an operational dependency, organisations should also verify that the forwarding destination did not become a long-term shadow inbox for sensitive messages. If it did, the issue is not only account security, but also confidentiality, records integrity, and downstream fraud exposure.

For broader adversary behaviour that uses mailbox access as a foothold, the MITRE ATT&CK Enterprise Matrix is a useful reference for mapping credential access, persistence, and post-compromise activity.

Related resources from NHI Mgmt Group

• How can organisations control mailbox forwarding risk in Exchange Online?
• What breaks when mailbox forwarding rules are not monitored as privileged changes?
• How can security teams detect mailbox-rule abuse early?
• How should security teams handle mailbox forwarding during offboarding?