In Google Workspace, Gmail automatic forwarding is on by default. Admins can turn it off, allow only internal addresses, or allow any address, per organizational unit. For most companies the safest practical choice is internal addresses only, with a documented exception path, because attackers use forwarding to keep reading mail.
Where the setting is
Admin console, Apps, Google Workspace, Gmail, End User Access, Automatic forwarding. You need the Gmail Settings administrator privilege. You can set it for the whole organization or for an organizational unit, with override or inherit.
What the options do
When the setting is off, the forwarding option does not appear in users' Gmail settings. When on, you choose between any email address and internal addresses only. Internal means addresses on your primary or secondary domains, including subdomains.
Other behaviors from Google's page:
- Users can set up only one forwarding address.
- Spam is not forwarded.
- Users can create filters to forward only certain messages.
- Sender and recipient both need a Google Workspace license, since forwarding passes through the user's Gmail account.
- You can check forwarded messages with Email Log Search.
Why limit it
An intruder who reaches a mailbox can add a forwarding address and keep a copy of everything, even after the password is reset. A forward to an outside address is quiet and easy to miss. Limiting forwarding to internal addresses closes the easy version of this.
It also reduces accidental leakage: someone forwarding work mail to a personal account for convenience puts company data outside every control you have.
A plan
- Decide the default per organizational unit. Internal only is a reasonable default.
- Use Email Log Search to see whether anyone forwards externally now.
- Contact those users and offer an alternative such as delegation or a shared mailbox.
- Apply the setting and document any exception with an owner and an end date.
- Add forwarding checks to your incident response checklist for a compromised account.
A note on delegation
Many forwarding requests are really requests for shared access. A delegated mailbox or a shared inbox gives the colleague the mail without copying it to an address you do not control, and removing delegation later is a single admin action rather than a hunt through filters.
When someone is compromised
Part of any mailbox takeover response is to look for forwarding addresses and filters, and to remove them. The Microsoft 365 version of this checklist is at /resources/blog/compromised-mailbox-response-checklist-microsoft-365, and the same idea applies in Gmail.
Safeguard's compliance automation can keep the setting and your review in the evidence trail.
Quick check
Is automatic forwarding off by default?
No. Google states it is on by default.
Does internal only cover subdomains?
Yes. Internal addresses include your primary and secondary domains and their subdomains.
Sources
Last reviewed: 19 October 2026.
