# Which Microsoft 365 mail flow rules improve email security, and how do you set them up safely?

URL: https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Useful Exchange Online mail flow rules for security: block external auto-forwarding, add warnings, stop risky attachments, test safely and avoid SCL -1 rules.

## Short answer

Use mail flow rules for narrow jobs: blocking or tracking external auto-forwarding, adding a warning to risky external mail, and catching executable attachments. Turn off external forwarding in the outbound spam policy first, use the anti-malware common attachments filter for file types, test each rule in audit mode, and never add a rule that sets SCL -1.

Mail flow rules, also called transport rules, let you inspect every message passing through Exchange Online and act on it: reject it, tag it, redirect it or add text. That power cuts both ways. A good rule closes a gap Microsoft's built-in policies leave open, and a careless one opens a hole in your spam filter for everyone.

This guide covers the security rules worth having, the built-in settings you should use instead where they exist, and how to test rules before they touch real mail.

## Where do you manage mail flow rules in Microsoft 365?

Mail flow rules live in the Exchange admin center (EAC), not the Defender portal ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules)):

- **Path:** **Mail flow** > **Rules** in the EAC at `https://admin.exchange.microsoft.com`.
- **Direct link:** `https://admin.exchange.microsoft.com/#/transportrules`
- **PowerShell:** `Get-TransportRule`, `New-TransportRule` and `Set-TransportRule` in Exchange Online PowerShell.

Three behaviors catch people out:

1. **Rules created in the EAC start disabled.** Microsoft does this so you can review them first. Turn the rule on in its details flyout when you're ready.
2. **Changes aren't instant.** Microsoft says a new or modified rule "might take 30 minutes or more" to apply.
3. **Order matters.** The rule at the top has priority 0 and runs first. A rule with **Stop processing more rules** prevents later rules from touching the message.

The limits are generous for a small business: 300 rules per organization, 8 KB per rule, and 20 KB for all the words and regular expressions in every rule's conditions and exceptions combined ([Exchange Online limits](https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits)).

## When should you use a mail flow rule instead of a built-in policy?

Use the built-in control first whenever one exists. Policies are designed for the job, show up in Microsoft's security recommendations, and are harder to get subtly wrong.

| Goal | Use first | Where a mail flow rule fits |
|---|---|---|
| Stop external auto-forwarding | Outbound spam policy: **Automatic forwarding rules** set to **Off** | Allow approved exceptions, or track forwarding |
| Block dangerous file types | Anti-malware policy: common attachments filter | Rules scoped to specific senders or recipients |
| Show that mail is from outside | Native external sender tag (`Set-ExternalInOutlook`) | A banner on a narrower set of risky messages |
| Block a sender or domain | Tenant Allow/Block List | Organization-specific conditions the list can't express |
| Let a partner's mail skip filtering | Don't. Fix authentication or use the Tenant Allow/Block List | Never with SCL -1 on sender domain alone |

The sections below go through each row.

## How do you block automatic forwarding to external addresses?

Automatic forwarding is a favorite trick after an account takeover. An attacker who gets into a mailbox adds an Inbox rule that quietly copies mail to an outside address. Microsoft notes that users can set up such rules "deliberately or as a result of a compromised account" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)).

### Step 1: Set the outbound spam policy to Off

The outbound spam policy is the control that covers both Inbox rules and admin-configured mailbox forwarding. Its **Automatic forwarding rules** setting has three values:

- **Automatic - System-controlled** (the default). Microsoft changed it to mean "Off" in 2021 for new organizations, but for some older tenants it can still mean "On". Microsoft says to pick On or Off explicitly because "the behavior can differ by organization."
- **On - Forwarding is enabled.**
- **Off - Forwarding is disabled.** Forwarded mail bounces with `5.7.520 Access denied, Your organization does not allow external forwarding`.

Microsoft's Standard and Strict recommendations are both **Off** ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)). To set it:

1. In the Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-spam** (`https://security.microsoft.com/antispam`).
2. Open **Anti-spam outbound policy (Default)**.
3. Under **Protection settings**, set **Automatic forwarding rules** to **Off - Forwarding is disabled** and save.

Or in PowerShell:

```powershell
Set-HostedOutboundSpamFilterPolicy -Identity Default `
    -AutoForwardingMode Off
```

Forwarding between internal users isn't affected. If someone genuinely needs external forwarding, create a custom outbound spam policy set to **On** that applies only to them. Our [550 5.7.520 page](https://iblockspam.com/smtp-errors/550-5-7-520) covers the bounce users see.

### Step 2: Know how the controls combine

Microsoft offers two other places to restrict forwarding: remote domains (`Set-RemoteDomain -AutoForwardEnabled $false`) and mail flow rules. Its rule is that "the block typically wins." If the outbound spam policy is On but a remote domain or a mail flow rule blocks forwarding, the forwarded mail is blocked. That's useful: you can leave the policy On and use a remote domain to allow forwarding only to one partner's domain.

### Step 3: Add a mail flow rule only for what's left

A rule using the message type **Auto-forward** can reject forwarded mail to outside recipients:

```powershell
New-TransportRule -Name "Block external auto-forward (Inbox rules)" `
    -MessageTypeMatches AutoForward `
    -SentToScope NotInOrganization `
    -RejectMessageReasonText "External forwarding is not allowed. Contact IT." `
    -Mode Audit
```

Know its blind spot. Microsoft says that if a message is forwarded with mailbox forwarding (SMTP forwarding), the auto-forward condition "will not" match ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)). That's why the outbound spam policy comes first. To see who is forwarding today, check the **Auto forwarded messages report** in the EAC, and see our guide to the [signs of a compromised email account](https://iblockspam.com/blog/signs-email-account-compromised) for the mailbox checks.

## How do you add a warning banner to risky external email?

For a simple "this came from outside" marker, Microsoft's native external tag is usually the better choice. It shows an **External** label in Outlook without editing the message. Our guide to the [Outlook external email warning tag](https://iblockspam.com/blog/outlook-external-email-warning-tag) compares it with banners.

A banner rule earns its place for narrower cases, such as external mail whose display name matches one of your executives:

```powershell
New-TransportRule -Name "Warn: external sender using staff name" `
    -FromScope NotInOrganization `
    -HeaderContainsMessageHeader "From" `
    -HeaderContainsWords "Jane Example","John Example" `
    -ApplyHtmlDisclaimerLocation Prepend `
    -ApplyHtmlDisclaimerText "<p style='background:#fff4ce;padding:8px'><b>Caution:</b> this message is from outside the company but uses a staff member's name.</p>" `
    -ApplyHtmlDisclaimerFallbackAction Ignore `
    -Mode Audit
```

Points to get right:

- **The fallback action.** If the banner can't be added, for example to a signed or encrypted message, the default **Wrap** creates a new message with the original attached. Microsoft says not to use Wrap in rules that affect incoming external mail because it "interfere[s] with Safe Attachments scanning," and suggests **Reject** instead ([New-TransportRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule?view=exchange-ps)). **Ignore** delivers the original without the banner. Choose deliberately: Reject bounces some legitimate signed mail.
- **Subject tags.** `-PrependSubject "[EXTERNAL] "` is an alternative. Add a **The subject includes** exception so replies don't collect repeated tags, the same approach Microsoft recommends for disclaimers.
- **Banner fatigue.** If every external message carries a loud banner, people stop reading it. Keep banners for messages that deserve a second look.

## How do you block dangerous attachments?

Start with the **common attachments filter** in the anti-malware policy, at **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-malware** (`https://security.microsoft.com/antimalwarev2`). Its default list includes types such as `exe`, `dll`, `iso`, `img`, `lnk`, `hta`, `scr`, `vbs` and `docm`. Microsoft says it uses "best effort true type matching" so a renamed `exe` is still caught, and falls back to extension matching where that fails ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-about)).

The filter is on by default in new policies and in the default policy of tenants created after December 1, 2023, and its default action is to reject with an NDR. Older tenants should check it's turned on:

```powershell
Get-MalwareFilterPolicy | Format-List Name, EnableFileFilter, FileTypeAction
```

Mail flow rules add two attachment conditions that are useful alongside the filter:

- **Any attachment has executable content** (`AttachmentHasExecutableContent`) inspects the file's properties rather than its extension.
- **Any attachment's file extension matches** (`AttachmentExtensionMatchesWords`) also checks files nested inside other attachments.

For example, to send executable attachments from outside to quarantine instead of bouncing them:

```powershell
New-TransportRule -Name "Quarantine external executables" `
    -FromScope NotInOrganization `
    -AttachmentHasExecutableContent $true `
    -Quarantine $true `
    -SetAuditSeverity Medium `
    -Mode Audit
```

Microsoft notes that when the quarantine action runs, rule evaluation stops, and later rules aren't evaluated even after release. Place it low in the list. Our guide to [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types) explains which formats attackers favor.

## Which mail flow rules should you avoid?

The most damaging rule is one that sets the spam confidence level to **-1** (**Bypass spam filtering**). It shows up in headers as `SFV:SKN`, and Microsoft's troubleshooting guide names an overly broad SCL -1 rule as a cause of spam reaching inboxes ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-troubleshooting)). On its [allowlist page](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365), Microsoft says never to use a sender domain as the only condition, and not to use your own domains or popular domains as conditions, because attackers can spoof them. Our guide on [why spam gets through Microsoft 365](https://iblockspam.com/blog/microsoft-365-spam-getting-through) shows how to find these rules.

Also avoid:

- **Allowing by sender domain without authentication.** If an exception is truly needed, require `dmarc=pass` in the `Authentication-Results` header as an extra condition.
- **Silent deletes.** **Delete the message without notifying anyone** leaves no bounce for a legitimate sender. Quarantine is easier to recover from.
- **Duplicating policy settings.** A rule and a policy that disagree are hard to debug months later. Add a comment to every rule saying why it exists.

## How do you test a rule before enforcing it?

1. **Create the rule in test mode.** In PowerShell, `-Mode Audit` logs what the rule would do without affecting delivery. `AuditAndNotify` also sends notifications. In the EAC, choose **Test without Policy Tips** or **Test with Policy Tips**.
2. **Set a severity.** Any severity other than **Not audit** makes matches appear in the **Exchange transport rule report** under **Reports** > **Mail flow**. Microsoft notes some data can take up to 5 days to appear.
3. **Send test messages** after waiting at least 30 minutes, then run a message trace to confirm the rule matched.
4. **Check the headers** of a test message in our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). Our guide to [Microsoft 365 spam headers](https://iblockspam.com/blog/microsoft-365-spam-headers-explained) explains the fields.
5. **Enforce:**

```powershell
Set-TransportRule -Identity "Quarantine external executables" `
    -Mode Enforce
```

6. **Back up your rules** before larger changes with `Export-TransportRuleCollection`.

## Next steps

1. Set **Automatic forwarding rules** to **Off** in the outbound spam policy, with custom policies for approved exceptions.
2. Confirm the common attachments filter is on with `Get-MalwareFilterPolicy`.
3. List your rules with `Get-TransportRule | Format-Table Name, State, Priority, Mode` and remove any SCL -1 rule scoped only by sender domain.
4. Add new rules in audit mode, check the report, then enforce.
5. Run a free [Email Health Check](https://iblockspam.com/tools/email-health-check) to confirm your MX, SPF and DMARC records, and see [how to block a sender or domain in Microsoft 365](https://iblockspam.com/blog/block-sender-or-domain-microsoft-365) for blocking without a rule.

If you want inbound filtering in front of Microsoft 365 with its own attachment-type and geographic filters, compare the options in [Microsoft 365 built-in filtering vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway). Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Do mail flow rules block mailbox forwarding set by an admin?

Not with the auto-forward message type condition. Microsoft says that condition doesn't match messages sent with mailbox forwarding, also called SMTP forwarding. To stop every kind of automatic external forwarding, set Automatic forwarding rules to Off in the outbound spam policy, which covers Inbox rules and mailbox forwarding alike.

### How long does a new mail flow rule take to work?

Microsoft says it might take 30 minutes or more for a new or changed mail flow rule to apply to email. Wait before you test, and don't assume a rule failed because the first test message slipped through. Message trace shows which rules a message matched.

### How many mail flow rules can a Microsoft 365 tenant have?

Microsoft lists a limit of 300 transport rules per organization, 8 KB per individual rule, and 20 KB in total for all the words and regular expressions used in rule conditions and exceptions. A small business rarely gets close, but long keyword lists use up the 20 KB quickly.

### Should I block attachments with a mail flow rule or the anti-malware policy?

Start with the common attachments filter in the anti-malware policy. It's on by default in newer tenants, detects many file types by their content rather than their name, and rejects matches by default. Add a mail flow rule only for something the filter can't express, such as a rule scoped to particular senders.

### What does audit mode do in a mail flow rule?

In PowerShell, Mode Audit writes the actions a rule would have taken to the message tracking log without changing delivery. AuditAndNotify does the same and also sends notifications. In the Exchange admin center the equivalents are Test without Policy Tips and Test with Policy Tips. Switch to Enforce once results look right.

## Sources

- [Microsoft Learn: Manage mail flow rules in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules)
- [Microsoft Learn: Mail flow rule conditions and exceptions (predicates) in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)
- [Microsoft Learn: Mail flow rule actions in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rule-actions)
- [Microsoft Learn: New-TransportRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule?view=exchange-ps)
- [Microsoft Learn: Control external email forwarding and fix 5.7.520 errors](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)
- [Microsoft Learn: Anti-malware protection for email in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-about)
- [Microsoft Learn: Recommendations for Microsoft 365 security settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)
- [Microsoft Learn: Exchange Online limits](https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt