Google Workspace security guide

Stop external auto-forwarding and alert on forwarding rules in Google Workspace

A practical, step-by-step guide for Australian businesses. Disable user-controlled automatic forwarding, create controlled exceptions and configure alerts that catch suspicious Gmail configuration changes.

Talk to a specialist — complimentary 15-min chat

Recommended method: disable user-controlled automatic forwarding and alert on Gmail setting changes

Automatic external forwarding allows messages received by a Google Workspace mailbox to be sent to an outside address. Attackers often enable forwarding after compromising an account so they can silently receive confidential email. The recommended configuration is to disable user-controlled automatic forwarding across the organisation and monitor for forwarding or Gmail routing changes.

Before you begin

You will need:

A Google Workspace Super Administrator account, or a delegated administrator with the required Gmail and reporting privileges.
A separate administrator account rather than your everyday email account.
A list of legitimate forwarding arrangements, routing rules and third-party systems.
Access to a monitored internal security or IT mailbox.

Google Admin console settings may vary depending on your Workspace edition and administrator privileges.

Review existing forwarding arrangements

Disabling forwarding can interrupt legitimate business processes, so review the current configuration first.

Check user-level forwarding

Google does not provide a simple universal Admin console list showing every user’s personal Gmail forwarding configuration in every Workspace edition. For important mailboxes:

Sign in to the user’s Gmail account using an approved administrative or delegated-access process.
Select Settings — the gear icon.
Select See all settings.
Open Forwarding and POP/IMAP.
Review the Forwarding section.
Record any external forwarding address and whether forwarding is enabled.
Open Filters and Blocked Addresses.
Review filters for actions such as Forward it to, Delete it, Skip the Inbox or Mark as read.
Investigate unexpected or unexplained rules before removing them.

Important

Do not access a user’s mailbox without appropriate authorisation. Follow applicable privacy, employment and recordkeeping requirements.

Check administrator-created forwarding

Sign in to the Google Admin console.
Go to Apps → Google Workspace → Gmail.
Review the following sections: Routing, Default routing, Compliance, Hosts and End User Access.
Under Routing, review Email forwarding using recipient address map.
Check for rules that change the message recipient, add additional recipients, route messages to an external server or forward messages to an external domain.
Document every approved external destination, its business purpose, owner and review date.

Google documents administrator-controlled forwarding and address maps in its Gmail forwarding guidance.

Disable user-controlled automatic forwarding

Sign in to the Google Admin console.
Go to Apps → Google Workspace → Gmail.
Select End User Access.
On the left, select the top-level organisational unit.
Locate Automatic forwarding.
Select Configure or Edit.
Turn off the option that permits users to automatically forward incoming email to another address.
Select Save or Override.
Confirm that the top-level organisational unit shows automatic forwarding as disabled.
Review each child organisational unit and ensure they inherit the disabled setting unless an approved exception is required.

Depending on the current Admin console wording, the control may appear as “Allow users to automatically forward incoming email to another address”. Google confirms that the Automatic forwarding control is located under Apps → Google Workspace → Gmail → End User Access in its Gmail Admin settings documentation.

Changes can take up to 24 hours to apply, although they usually take effect sooner.

Create controlled exceptions

If a small number of users require forwarding, do not enable it for the whole organisation.

Create a dedicated organisational unit for approved exceptions, such as Approved External Forwarding.
Move only specifically authorised users into that organisational unit.
Go to Apps → Google Workspace → Gmail → End User Access.
Select the exception organisational unit.
Override the inherited Automatic forwarding setting.
Allow automatic forwarding only for this organisational unit.
Record the user’s name, external destination, business justification, approving manager, approval date and review or expiry date.
Review the exception regularly and remove the user from the exception organisational unit when forwarding is no longer required.

Where possible, use Gmail delegation, Google Groups, aliases or administrator-controlled internal routing instead of forwarding company email to an external or personal account.

Enable alerts for Gmail configuration changes

Google provides a system-defined rule that can alert administrators when Gmail settings are changed.

Sign in to the Google Admin console.
Go to Rules. Depending on the menu layout, this may appear under Security → Rules.
Select Add a filter.
Select Type.
Select System defined.
Select Apply.
Locate Email settings changed.
Open the rule and select Edit rule.
Select Next: View conditions and review the system-defined conditions.
Select Next: Add actions.
Enable Send to Alert Center and set the severity to High or Medium.
Enable Email notifications and add recipients such as the IT administrator, security administrator, managed service provider or dedicated security-alert mailbox.
Select Next: Review, confirm the recipients and actions, then select Update rule.
Confirm that the rule displays as Active.

Important limitation: “Alert on any mailbox forwarding rule”

The Email settings changed system rule monitors administrator changes to Gmail configuration. It does not necessarily alert when an individual user creates every personal Gmail filter or forwarding rule.

Google Workspace does not provide a universal native alert for every type of user-created forwarding rule across all editions. Organisations requiring detection of every forwarding change should use one or more of the following:

Google Workspace Security Investigation Tool
Activity rules, where supported by the Workspace edition
Google Workspace audit-log export to BigQuery
Google Security Operations or another SIEM
A third-party Google Workspace security-monitoring service
Periodic automated inspection using the Gmail API with approved domain-wide delegation

Availability depends on the Workspace subscription. Do not assume the Email settings changed rule provides complete coverage of user-created rules. Google explains how to activate and configure it in its system-defined rules guidance.

Create an activity rule where supported

If your Workspace edition exposes a suitable forwarding or Gmail-settings event:

Go to Security → Security Center → Investigation tool.
Select the relevant data source, such as User log events, Admin log events or Gmail log events.
Search the available event or action names for terms including forward, forwarding, Gmail settings, routing or recipient address map.
Configure the search to cover all users.
Run the search and confirm that the results contain the information you require.
Select Create activity rule and give it a descriptive name such as Alert – Gmail Forwarding or Routing Change.
Set the severity to High and configure the rule to send an Alert Center alert.
Add email notification recipients, review and create the rule, then confirm that it is active.

If the required forwarding event is not available, an edition upgrade, API-based monitor, SIEM or third-party monitoring service will be required for comprehensive alerting.

Google’s instructions for creating activity rules are available in its activity-rule guidance.

Test the configuration

Use a designated test account and non-sensitive test message.

Sign in to the test user’s Gmail account.
Go to Settings → See all settings.
Open Forwarding and POP/IMAP and confirm that user-controlled forwarding is unavailable or cannot be enabled.
Try creating a Gmail filter that forwards messages and confirm whether the forwarding option is unavailable.
Send a harmless test message and confirm that it is not forwarded externally.
Make an approved temporary administrator-level Gmail configuration change.
Confirm that the Email settings changed alert appears in the Alert Center and reaches the nominated recipients.
Reverse the temporary change and document the test results.

Allow up to 24 hours for new settings and some alert changes to take effect.

Warnings

Disabling forwarding may interrupt legitimate workflows involving personal accounts, ticketing systems, CRMs, archives or other external services.
Review existing requirements before changing the setting.
Disabling user-controlled forwarding does not automatically remove administrator-created routing rules or recipient address maps.
Alerting on administrator Gmail-setting changes does not guarantee detection of every user-created filter.
A suspicious forwarding rule may indicate an account compromise. Removing the rule alone is not sufficient.
If compromise is suspected, reset the password, revoke active sessions, review two-step verification methods and investigate recent sign-ins and mailbox activity.
Do not create broad exceptions for entire departments unless there is a documented business requirement.
Forwarding company email to personal accounts may breach privacy, contractual, insurance or regulatory obligations.
Alert notifications should go to an actively monitored mailbox — not only to an individual administrator who may be unavailable or compromised.

Recommended final configuration

User-controlled automatic forwarding	Disabled
Scope	Top-level organisational unit and all child units
Exceptions	Restricted, documented and regularly reviewed
Email settings changed rule	Active
Alert Center notification	Enabled
Email notifications	Sent to a monitored security mailbox
Admin routing and recipient address maps	Reviewed regularly
Advanced audit or third-party monitoring	Used where every forwarding change must be detected

Google Workspace disclaimer

These instructions provide general Google Workspace security guidance. Available menus, logs, activity rules and alerting features vary by Workspace edition, administrator privileges and changes made by Google.

Disabling forwarding can affect legitimate mail delivery and integrated business systems. Review existing forwarding and routing arrangements, obtain appropriate approval and test changes with a limited group before applying them broadly. Ensure emergency administrative access is available.

If you are unsure about the operational, privacy or security impact, engage a qualified Google Workspace engineer or managed service provider to assess, implement and verify the configuration.