How do you disable automatic email forwarding in Google Workspace?

Automatic forwarding is a Gmail setting that copies every new message a user receives to another address. It's convenient, and it's also one of the quietest ways company mail leaves your control: an attacker who gets into a mailbox for ten minutes can set it up and keep reading mail after the password is reset. This guide shows the exact Google Workspace setting at the time of writing (November 2026), the options and defaults, how to make exceptions, the other ways mail still leaves, and how to audit forwarding that already exists.

How do you turn off automatic forwarding in the Admin console?

To turn off automatic forwarding for everyone, clear Allow users to automatically forward incoming email under Apps > Google Workspace > Gmail > End User Access and save. Google's admin help page gives these steps:

1. Sign in to the Google Admin console with an account that has the Gmail Settings administrator privilege.
2. Go to Menu > Apps > Google Workspace > Gmail > End User Access.
3. To change the setting for part of the organization, select an organizational unit on the left. Otherwise leave the top-level unit selected.
4. Click Automatic forwarding.
5. Clear Allow users to automatically forward incoming email to block forwarding, or keep it checked and choose internal email addresses only.
6. Click Save. For a child organizational unit, Google labels this Override; Inherit puts it back to the parent's value.

Google says that when the setting is off, "the forwarding option isn't available in Gmail settings." The page doesn't say how long the change takes or what happens to forwarding a user already configured, so test it (see the checklist below) rather than assuming.

What are the automatic forwarding options and the default?

Google Workspace gives you three effective choices, and the default allows forwarding to any address. The table shows each one:

Google defines internal as "your primary or secondary domains, including subdomains." A forwarding address that's a partner's or an employee's personal account counts as external.

Users who are allowed to forward can only set one forwarding address, and Google notes that spam isn't included in forwarded mail.

Why should you restrict auto-forwarding?

You should restrict auto-forwarding because it's a common way attackers and departing staff copy mail out of a company without anyone noticing. MITRE ATT&CK tracks it as Email Forwarding Rule (T1114.003) and notes forwarding can let attackers keep reading a victim's mail "even after compromised credentials are reset."

Three common situations:

• Account takeover. After a phishing sign-in, the attacker adds a forwarding address so they keep seeing invoices and payment conversations. It's step one of many business email compromise frauds.
• Departing employees. A user who forwards everything to a personal address keeps receiving customer mail after they leave. Our offboarding guide covers the exit checklist.
• Regulated data. Health, financial and legal information sent to a consumer mailbox is outside your retention, audit and eDiscovery controls.

Forwarding also causes deliverability problems: forwarded mail often fails SPF at the destination, as explained in email forwarding, SPF, DMARC and ARC.

How do you allow forwarding for only some users?

To allow forwarding for only some users, put them in their own organizational unit (OU) and override the setting for that unit. Google's page lets you select an organizational unit, change the setting and click Override; Inherit restores the parent's value.

1. In Directory > Organizational units, create a unit such as Forwarding-approved.
2. Move only the approved users into it.
3. On End User Access > Automatic forwarding, set the top-level unit to Off.
4. Select Forwarding-approved, check the box, choose any email address or internal email addresses only, and click Override.
5. Record who approved each exception and review the unit every quarter.

If the need is "send copies of this mailbox to one fixed address", an admin-controlled route is usually better than a user setting. A Gmail routing rule can add a recipient for one user or group, and users can't change it. See Gmail routing rules in Google Workspace.

Which other ways can mail still leave a mailbox?

Turning off automatic forwarding blocks only the user's own forwarding setting. Mail can still leave through these paths, each with its own control:

Google says that when you turn POP or IMAP off, users "can't get their email with POP or IMAP email clients, even if they previously could" (Google). Only do that once you know who still uses a desktop mail client.

To catch manual forwarding of sensitive content, a content compliance rule can quarantine or reject outbound mail that matches, for example, bank details or a predefined detector.

How do you find forwarding that already exists?

Find existing forwarding by searching the audit log for forwarding events and reading each mailbox's settings through the Gmail API. Do this before and after you change the setting.

1. Search User log events. In Reporting > Audit and investigation > User log events, filter on the out-of-domain email forwarding event. Google's login event reference lists it as email_forwarding_out_of_domain, with the message "{actor} has enabled out of domain email forwarding to {email_forwarding_destination_address}." You can also turn this search into a reporting rule so you get an email the next time it happens.

2. Read every user's setting with the Gmail API. The users.settings.getAutoForwarding method returns whether forwarding is on, the address and what happens to Gmail's copy. A response for a forwarding user looks like this (example values):

{
  "enabled": true,
  "emailAddress": "someone@personal-example.com",
  "disposition": "archive"
}

users.settings.forwardingAddresses.list shows every address a user has registered, and users.settings.filters.list shows filters, including any that forward matching mail. Reading other users' settings needs a service account with domain-wide authority. The Gmail API forwarding guide notes a forwarding address must be verified by its owner before it can be used, unless it's in the sender's domain, one of its subdomains or a domain alias in the same Google Workspace account.

3. Check Email Log Search. Google's page recommends Email Log Search "to check messages forwarded by people in your organization". Our Email Log Search guide shows how to filter by sender and date.

Any forwarding to an address nobody can explain should be treated as a possible account compromise. Follow Google Workspace compromised account recovery, not just a settings change.

How do you test that forwarding is really blocked?

Test the block with a user in the affected unit, because the help page doesn't say how quickly the change applies or whether existing forwarding stops. Use this checklist:

1. Sign in as a test user in the unit and open Settings > See all settings > Forwarding and POP/IMAP. The forwarding option should be gone.
2. For a user who forwarded before the change, send them a test message from outside, then look it up in Email Log Search to see whether a forwarded copy left.
3. If a copy still leaves, clear the user's forwarding address (or have them select Disable forwarding) and check their filters for a Forward it to action.
4. Repeat the User log events search a week later to confirm no new out-of-domain forwarding events.

How does this compare with Microsoft 365?

Google Workspace and Microsoft 365 both let admins block external auto-forwarding, but the defaults and controls differ. In Microsoft 365, the control is Automatic forwarding rules in the outbound anti-spam policy, and blocked forwarding bounces with 550 5.7.520. Our guide to malicious inbox rules and auto-forwarding covers both platforms side by side, and the Microsoft 365 outbound spam policy guide explains the Microsoft setting in full.

Next steps

1. Run the User log events search for out-of-domain forwarding today and investigate every result.
2. Set Automatic forwarding to Off, or to internal only, at the top-level unit, then add an override unit for approved exceptions.
3. Review routing rules, delegation and POP/IMAP access, which this setting doesn't cover.
4. Stop the phishing that leads to forwarding rules in the first place. iBlockSpam filters phishing, spoofing and malware at the MX before mail reaches Gmail; see our Google Workspace page.

Browse our other setup guides.