Block Automatic Email Forwarding in Google Workspace for Small Business
▶ Watch the short explainer for this tip
Email forwarding can be convenient, but it's also a significant security risk for small and medium businesses. Uncontrolled forwarding can expose sensitive information and make your organisation an easy target for cyber criminals. This tech tip from Neil Frick, CISSP, will walk you through securing your Google Workspace environment by blocking automatic email forwarding to external addresses. This simple change dramatically reduces your exposure to phishing and data breaches, keeping your business compliant and protected.
What is Automatic Email Forwarding in Google Workspace?
Automatic email forwarding in Google Workspace allows users to automatically send a copy of their incoming emails to another email address. This setting can be configured by individual users within their Gmail settings or by administrators at a domain or organisational unit level.
Why Should You Block External Email Forwarding for Security?
You should block automatic email forwarding to external addresses because it's a prime target for business email compromise (BEC) attacks and data exfiltration. If a cyber criminal gains access to just one user account, they can set up a forward to siphon off all incoming communications, including confidential client data, financial details, or login credentials. This is a crucial Google Workspace security setting for small business owners to address.
What Happens If You Don't Block This Setting?
Leaving automatic external email forwarding enabled poses a significant risk to your business. A compromised account could silently forward sensitive emails to an attacker, leading to a notifiable data breach (NDB) under Australian privacy laws, financial losses from fraudulent transactions, and severe reputational damage. This oversight could cost you thousands in recovery, fines, and lost business, affecting your insurance premiums and overall business continuity.
How to Block Automatic Email Forwarding in Four Steps
Blocking automatic email forwarding to external addresses in your Google Workspace environment is straightforward. Follow these four verified steps in the Google Admin console (admin.google.com): 1. Sign in to admin.google.com and go to Apps > Google Workspace > Gmail > End User Access. 2. Find Automatic forwarding. 3. Untick Allow users to automatically forward incoming email to another address, for the whole domain or per organisational unit. 4. Save, then use Apps > Google Workspace > Gmail > Compliance to add a content compliance rule that quarantines any remaining outbound forwards if you want belt and braces.
How to Verify Your Changes and What to Warn Staff About
To check that the change worked, log into a test account and navigate to Gmail Settings > Forwarding and POP/IMAP; the option to add a forwarding address should no longer be available. Existing forwards set before this change can persist, so audit them in Reporting > Reports > Audit and investigation > Gmail settings changes. Warn staff that they will no longer be able to set up automatic external email forwarding and explain the security reasons behind this change to ensure their understanding and cooperation.
Important Disclaimer for Google Workspace Security Settings
These steps are accurate at the time of publishing, but email platform menus and defaults can change. If you're not confident, please don't change settings yourself, as incorrect modifications can disrupt email service. SecureMyEmail accepts no responsibility for loss or damage caused by changes made without our direct involvement. If you're looking for help securing your Google Workspace, book a complimentary 15-minute chat with Neil to discuss a security audit.
Blocking automatic external email forwarding is a simple yet powerful security measure for any Australian small business using Google Workspace. It significantly reduces the risk of data breaches and business email compromise, protecting your valuable information and reputation. Don't leave this critical vulnerability open.
Disclaimer: These steps are accurate at the time of publishing, but email platform menus and defaults can change. If you're not confident, please don't change settings yourself, as incorrect modifications can disrupt email service. SecureMyEmail accepts no responsibility for loss or damage caused by changes made without our direct involvement.
Frequently asked questions
- What happens if I block automatic email forwarding in Gmail?
- If you block automatic email forwarding, your users will no longer be able to set up automatic forwarding of their emails to external email addresses from their Gmail settings. This significantly reduces the risk of data exfiltration and business email compromise.
- Will blocking forwarding affect internal email forwarding within Google Workspace?
- No, this specific setting targets automatic forwarding to *external* addresses. Internal forwarding, where emails are sent to another address within your Google Workspace domain, is typically handled differently and won't be impacted by this change.
- How can I check for existing email forwards after I make this change?
- You can audit existing email forwards by going to Reporting > Reports > Audit and investigation > Gmail settings changes in the Google Admin console. This will help you identify any forwards that were set up before the block was implemented.
- Is this a critical Google Workspace security setting for Australian small business owners?
- Yes, blocking automatic external email forwarding is considered a critical Google Workspace security setting for any Australian small business. It's a key defence against business email compromise (BEC) and helps prevent sensitive data from leaving your organisation without proper oversight.
Sources
Every reference below was link-checked when this article was published.
- 1.Set Drive users' sharing permissionsGoogle Workspace Admin Help
Want to know where your own tenant stands?
The audit answers these questions with a dated report on your actual settings — a few questions to start, under a minute.
