# How do you disable automatic email forwarding in Google Workspace?

URL: https://iblockspam.com/blog/google-workspace-disable-automatic-email-forwarding
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Setup guides
Author: iBlockSpam Team

> Turn off or limit Gmail auto-forwarding in Google Workspace: the End User Access path, the internal-only option, OU exceptions, other leak paths and audits.

## Short answer

In the Admin console, go to Apps > Google Workspace > Gmail > End User Access, click Automatic forwarding and clear Allow users to automatically forward incoming email, or keep it on and choose internal email addresses only. Save it for the whole organization or override it per organizational unit. The setting is on by default.

Automatic forwarding is a Gmail setting that copies every new message a user receives to another address. It's convenient, and it's also one of the quietest ways company mail leaves your control: an attacker who gets into a mailbox for ten minutes can set it up and keep reading mail after the password is reset. This guide shows the exact Google Workspace setting at the time of writing (November 2026), the options and defaults, how to make exceptions, the other ways mail still leaves, and how to audit forwarding that already exists.

## How do you turn off automatic forwarding in the Admin console?

To turn off automatic forwarding for everyone, clear **Allow users to automatically forward incoming email** under **Apps** > **Google Workspace** > **Gmail** > **End User Access** and save. Google's [admin help page](https://knowledge.workspace.google.com/admin/gmail/let-users-automatically-forward-their-own-gmail-emails) gives these steps:

1. Sign in to the Google Admin console with an account that has the **Gmail Settings** administrator privilege.
2. Go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **End User Access**.
3. To change the setting for part of the organization, select an organizational unit on the left. Otherwise leave the top-level unit selected.
4. Click **Automatic forwarding**.
5. Clear **Allow users to automatically forward incoming email** to block forwarding, or keep it checked and choose **internal email addresses only**.
6. Click **Save**. For a child organizational unit, Google labels this **Override**; **Inherit** puts it back to the parent's value.

Google says that when the setting is off, "the forwarding option isn't available in Gmail settings." The page doesn't say how long the change takes or what happens to forwarding a user already configured, so test it (see the checklist below) rather than assuming.

## What are the automatic forwarding options and the default?

Google Workspace gives you three effective choices, and the default allows forwarding to any address. The table shows each one:

| Setting | What users can do | When to use it |
|---|---|---|
| **Allowed, any email address** (default: "The option is on by default") | Forward all new mail to any address, internal or external | Rarely; only for organizations with no confidential mail |
| **Allowed, internal email addresses only** | Forward only to your primary or secondary domains, including subdomains | Teams that forward to shared or team mailboxes |
| **Off** (checkbox cleared) | No forwarding option in Gmail settings | Most businesses, and any unit handling payments, HR or client data |

Google defines internal as "your primary or secondary domains, including subdomains." A forwarding address that's a partner's or an employee's personal account counts as external.

Users who are allowed to forward can only set one forwarding address, and Google notes that spam isn't included in forwarded mail.

## Why should you restrict auto-forwarding?

You should restrict auto-forwarding because it's a common way attackers and departing staff copy mail out of a company without anyone noticing. MITRE ATT&CK tracks it as [Email Forwarding Rule (T1114.003)](https://attack.mitre.org/techniques/T1114/003/) and notes forwarding can let attackers keep reading a victim's mail "even after compromised credentials are reset."

Three common situations:

- **Account takeover.** After a phishing sign-in, the attacker adds a forwarding address so they keep seeing invoices and payment conversations. It's step one of many [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention) frauds.
- **Departing employees.** A user who forwards everything to a personal address keeps receiving customer mail after they leave. Our [offboarding guide](https://iblockspam.com/blog/employee-offboarding-email-security) covers the exit checklist.
- **Regulated data.** Health, financial and legal information sent to a consumer mailbox is outside your retention, audit and eDiscovery controls.

Forwarding also causes deliverability problems: forwarded mail often fails SPF at the destination, as explained in [email forwarding, SPF, DMARC and ARC](https://iblockspam.com/blog/email-forwarding-breaks-spf-dmarc-arc).

## How do you allow forwarding for only some users?

To allow forwarding for only some users, put them in their own organizational unit (OU) and override the setting for that unit. Google's page lets you select an organizational unit, change the setting and click **Override**; **Inherit** restores the parent's value.

1. In **Directory** > **Organizational units**, create a unit such as `Forwarding-approved`.
2. Move only the approved users into it.
3. On **End User Access** > **Automatic forwarding**, set the top-level unit to Off.
4. Select `Forwarding-approved`, check the box, choose **any email address** or **internal email addresses only**, and click **Override**.
5. Record who approved each exception and review the unit every quarter.

If the need is "send copies of this mailbox to one fixed address", an admin-controlled route is usually better than a user setting. A Gmail routing rule can add a recipient for one user or group, and users can't change it. See [Gmail routing rules in Google Workspace](https://iblockspam.com/blog/gmail-routing-rules-google-workspace).

## Which other ways can mail still leave a mailbox?

Turning off automatic forwarding blocks only the user's own forwarding setting. Mail can still leave through these paths, each with its own control:

| Path | What it does | Where to control it |
|---|---|---|
| Gmail routing rules | An admin rule adds recipients or reroutes mail | **Apps** > **Google Workspace** > **Gmail** > **Routing** (admin only; review after any admin compromise) |
| Mail delegation | Another user reads and sends as the mailbox | **Gmail** > **User settings** > **Mail delegation**. Google says delegates must be "in the same organization" |
| POP and IMAP | A mail client downloads the whole mailbox | **Gmail** > **End User Access** > **POP and IMAP access** |
| Connected apps | An OAuth app reads mail through the Gmail API | **Security** > **Access and data control** > **API controls** |
| Manual forwarding | The user forwards messages one at a time | Not blocked by this setting; use DLP or content compliance rules for sensitive content |

Google says that when you turn POP or IMAP off, users "can't get their email with POP or IMAP email clients, even if they previously could" ([Google](https://knowledge.workspace.google.com/admin/sync/turn-pop-and-imap-on-or-off-for-users)). Only do that once you know who still uses a desktop mail client.

To catch manual forwarding of sensitive content, a [content compliance rule](https://iblockspam.com/blog/google-workspace-content-compliance-rules) can quarantine or reject outbound mail that matches, for example, bank details or a predefined detector.

## How do you find forwarding that already exists?

Find existing forwarding by searching the audit log for forwarding events and reading each mailbox's settings through the Gmail API. Do this before and after you change the setting.

**1. Search User log events.** In **Reporting** > **Audit and investigation** > **User log events**, filter on the out-of-domain email forwarding event. Google's [login event reference](https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login) lists it as `email_forwarding_out_of_domain`, with the message "{actor} has enabled out of domain email forwarding to {email_forwarding_destination_address}." You can also turn this search into a reporting rule so you get an email the next time it happens.

**2. Read every user's setting with the Gmail API.** The [`users.settings.getAutoForwarding`](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings/getAutoForwarding) method returns whether forwarding is on, the address and what happens to Gmail's copy. A response for a forwarding user looks like this (example values):

```json
{
  "enabled": true,
  "emailAddress": "someone@personal-example.com",
  "disposition": "archive"
}
```

`users.settings.forwardingAddresses.list` shows every address a user has registered, and `users.settings.filters.list` shows filters, including any that forward matching mail. Reading other users' settings needs a service account with domain-wide authority. The [Gmail API forwarding guide](https://developers.google.com/workspace/gmail/api/guides/forwarding_settings) notes a forwarding address must be verified by its owner before it can be used, unless it's in the sender's domain, one of its subdomains or a domain alias in the same Google Workspace account.

**3. Check Email Log Search.** Google's page recommends Email Log Search "to check messages forwarded by people in your organization". Our [Email Log Search guide](https://iblockspam.com/blog/google-workspace-email-log-search) shows how to filter by sender and date.

Any forwarding to an address nobody can explain should be treated as a possible account compromise. Follow [Google Workspace compromised account recovery](https://iblockspam.com/blog/google-workspace-compromised-account-recovery), not just a settings change.

## How do you test that forwarding is really blocked?

Test the block with a user in the affected unit, because the help page doesn't say how quickly the change applies or whether existing forwarding stops. Use this checklist:

1. Sign in as a test user in the unit and open **Settings** > **See all settings** > **Forwarding and POP/IMAP**. The forwarding option should be gone.
2. For a user who forwarded before the change, send them a test message from outside, then look it up in Email Log Search to see whether a forwarded copy left.
3. If a copy still leaves, clear the user's forwarding address (or have them select **Disable forwarding**) and check their filters for a **Forward it to** action.
4. Repeat the User log events search a week later to confirm no new out-of-domain forwarding events.

## How does this compare with Microsoft 365?

Google Workspace and Microsoft 365 both let admins block external auto-forwarding, but the defaults and controls differ. In Microsoft 365, the control is **Automatic forwarding rules** in the outbound anti-spam policy, and blocked forwarding bounces with [550 5.7.520](https://iblockspam.com/smtp-errors/550-5-7-520). Our guide to [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) covers both platforms side by side, and the [Microsoft 365 outbound spam policy guide](https://iblockspam.com/blog/microsoft-365-outbound-spam-policy) explains the Microsoft setting in full.

| | Google Workspace | Microsoft 365 |
|---|---|---|
| Setting | Gmail > End User Access > Automatic forwarding | Outbound spam policy > Automatic forwarding rules |
| Default | On, to any address | Automatic - System-controlled |
| Internal-only option | Yes | Internal forwarding isn't affected by the setting |
| Per-group exceptions | Organizational unit override | Custom outbound policy for chosen users |

## Next steps

1. Run the User log events search for out-of-domain forwarding today and investigate every result.
2. Set Automatic forwarding to Off, or to internal only, at the top-level unit, then add an override unit for approved exceptions.
3. Review routing rules, delegation and POP/IMAP access, which this setting doesn't cover.
4. Stop the phishing that leads to forwarding rules in the first place. iBlockSpam filters phishing, spoofing and malware at the MX before mail reaches Gmail; see our [Google Workspace page](https://iblockspam.com/platforms/google-workspace).

Browse our other [setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Is automatic forwarding on by default in Google Workspace?

Yes. Google's admin help says the Allow users to automatically forward incoming email option is on by default, so any user can forward new mail to any address unless you change it. You change it under Apps, Google Workspace, Gmail, End User Access, for the whole organization or one organizational unit at a time.

### What does internal email addresses only mean for Gmail forwarding?

It keeps automatic forwarding available but only to addresses in your organization. Google defines internal as your primary or secondary domains, including subdomains. It's a good middle ground when staff legitimately forward to a shared or team mailbox but should never send company mail to a personal Gmail or another outside account.

### Can I allow one user to forward to an outside address and block everyone else?

Yes. Put that user in their own organizational unit, then select that unit on the End User Access page and click Override to allow forwarding to any address. Everyone else inherits the blocked setting. Alternatively, keep users blocked and have an admin create a Gmail routing rule that copies the mail where it needs to go.

### Does blocking auto-forwarding stop admin routing rules from forwarding mail?

No. The End User Access setting controls the forwarding option in users' own Gmail settings. Gmail routing rules that add recipients or change the route are admin settings under Apps, Google Workspace, Gmail, and keep working. Review them separately, especially after an admin account compromise, because an attacker with admin rights can add one.

### How do I find out who already forwards mail outside my domain?

Search User log events for out of domain email forwarding events, which record who enabled forwarding and the destination address. For the current state of every mailbox, call the Gmail API settings.getAutoForwarding method for each user through a service account with domain-wide authority, and use Email Log Search to see forwarded messages.

## Sources

- [Google Workspace Admin Help: Let users automatically forward their own Gmail emails](https://knowledge.workspace.google.com/admin/gmail/let-users-automatically-forward-their-own-gmail-emails)
- [Google Workspace Admin Help: Turn POP & IMAP on or off for users](https://knowledge.workspace.google.com/admin/sync/turn-pop-and-imap-on-or-off-for-users)
- [Google Workspace Admin Help: Let users delegate access to a Gmail account](https://knowledge.workspace.google.com/admin/gmail/let-users-delegate-access-to-a-gmail-account)
- [Google Workspace Admin SDK: Login audit activity events (email_forwarding_out_of_domain)](https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login)
- [Gmail API: users.settings.getAutoForwarding](https://developers.google.com/workspace/gmail/api/reference/rest/v1/users.settings/getAutoForwarding)
- [Gmail API: Managing forwarding](https://developers.google.com/workspace/gmail/api/guides/forwarding_settings)
- [MITRE ATT&CK: Email Forwarding Rule (T1114.003)](https://attack.mitre.org/techniques/T1114/003/)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-disable-automatic-email-forwarding (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt