SMTP forwarding rule is a mail flow rule that automatically redirects or copies incoming or outgoing email to another address or destination. In Microsoft 365 and similar mail systems, it can be used for delegation, archiving, or relay, and may expose mailbox content if created without authorisation or review.
What SMTP forwarding rules do
SMTP forwarding rules sit in mail flow because they automatically reroute messages before a user ever notices. That makes them useful for legitimate delegation and archiving, but it also means a hidden rule can quietly copy sensitive mail outside the intended mailbox boundary.
In Microsoft 365 and similar platforms, forwarding may be configured at the mailbox, transport, or client layer, and those layers do not behave the same way. A rule at the server level is especially important because it can persist even if the user changes devices, signs out, or updates local mail settings.
Why forwarding rules are security-sensitive
Forwarding rules become a confidentiality issue when they are created without approval, placed in a location users do not routinely review, or used to mirror mail to an external destination. They can expose invoices, resets, legal notices, and other messages that carry direct business or identity risk.
For defenders, the key question is not whether forwarding exists, but whether it is authorised, visible, and constrained to an expected recipient. Exchange Online Security Guide is useful here because it ties forwarding controls to broader mailbox hardening, including external forwarding restrictions and audit visibility.
How to identify legitimate versus suspicious forwarding
Legitimate forwarding usually has a clear business purpose, such as a shared mailbox, a delegated workflow, or a retention process that is documented and approved. Suspicious forwarding often appears as a quiet change in mailbox behaviour, especially when the destination is external, newly added, or unrelated to the user’s normal work.
Reviewing mail flow rules, mailbox settings, and message tracing together is the practical way to distinguish policy-based forwarding from abuse. T1114 Email Collection Defensive Guide is a strong companion because it explains forwarding-rule abuse as an email collection technique and shows where defenders can look for it.
What makes SMTP forwarding rules dangerous in real incidents
Attackers value forwarding because it is quiet, durable, and often blends into ordinary mailbox administration. Once a rule is in place, the attacker can keep receiving copies of mail even if the victim becomes suspicious, and that can support fraud, reconnaissance, or follow-on account abuse.
Forwarding is also dangerous because it can be combined with mailbox access, malicious inbox rules, or compromised sessions to create a broader collection path. Microsoft 365 Unified Audit Log Guide for Detection helps with this phase because audit events are often the only reliable way to reconstruct when a rule was created or changed.
Risk and Threat Considerations
SMTP forwarding rules are a common way to turn mailbox access into silent message collection. The main risk is not just redirection, but long-lived visibility into sensitive correspondence, password resets, approvals, and business transactions that should never leave the authorised mail path.
Failure mechanism: A rule is added at the mail system layer, then continues copying or redirecting messages outside normal user workflows, often without obvious signs to the mailbox owner.
Impact: Confidential mail can be exfiltrated, fraud can be enabled, and the attacker can maintain access to high-value correspondence even after passwords or sessions are changed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Forwarding rules can expand message access beyond intended need-to-know. |
| AU-6 — Audit Review, Analysis, and Reporting | Forwarding changes are security-relevant events that require review and correlation. | |
| Recommendation — Limit mailbox and mail-flow permissions so only approved admins can create forwarding paths. Review audit events for new or changed forwarding rules and investigate unexpected destinations. | ||
| CIS Controls v8 | 5 — Account Management | Forwarding abuse often follows account compromise or weak mailbox governance. |
| Recommendation — Revoke unauthorized mailbox changes and keep account ownership and delegation tightly managed. | ||
| MITRE ATT&CK | T1114 — Email Collection | Forwarding rules are a documented email-collection method used to gather mailbox content. |
| Recommendation — Map suspicious forwarding behavior to T1114 and hunt for mailbox collection activity. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Mail systems and admin APIs can be abused when mailbox changes are made through stolen access. |
| Recommendation — Protect mailbox-management APIs and administrative sessions against unauthorized rule creation. | ||
Practitioner Guidance
What to watch for: Treat new forwarding rules, destination changes, and mail flow exceptions as review-worthy events, especially when the recipient is external or the change was not requested by the mailbox owner. A forwarding rule should have a named business owner and a documented reason.
Governance implication: The safest operating model is to make forwarding an explicit exception, not a casual convenience. That means policy, audit, and response ownership need to sit with the mail and identity teams together, because the security question is really about who can see and reroute messages.
Related resources from NHI Mgmt Group
- Guide: Network Ports and Protocols Security Guide
- Who is accountable when a departing employee leaves a forwarding rule in place?
- How do security teams know whether a mail forwarding rule is materially risky?
- What mitigations reduce the risk of email forwarding rule abuse?
- External Mail Forwarding Rule
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org