To stop mailboxes automatically forwarding mail outside your Microsoft 365 organization, set the outbound spam policy to Off, and use remote domains or mail flow rules as extra layers. When one control allows forwarding and another blocks it, the block typically wins. Do not rely on the Automatic setting.
Why it matters
Microsoft notes that forwarding can be useful but risks disclosing information, and that users can create Inbox rules that forward externally either deliberately or because the account is compromised. A hidden forwarding rule is a common way for an intruder to keep reading mail after the password is changed. Our post on signs a mailbox was taken over covers spotting those rules at /resources/blog/signs-your-mailbox-was-taken-over-inbox-rules-forwarding.
Two kinds of forwarding
- User Inbox rules that forward messages externally.
- Admin configured mailbox forwarding, also called SMTP forwarding, which can optionally keep a copy.
Control one: outbound spam policy
The outbound spam filter has three automatic forwarding values:
- Automatic, system controlled. Equivalent to On when first introduced, but in 2021 it became Off for new organizations and for existing ones not actively using it. Existing organizations already using it may still behave like On.
- On: external forwarding allowed.
- Off: forwarding disabled, and the sender gets a non delivery report.
Because Automatic behaves differently across organizations, Microsoft advises choosing On or Off explicitly. Turning forwarding off also disables existing Inbox rules and mailbox forwarding that send mail to external addresses. Internal forwarding is not affected.
Control two: remote domains
Remote domains can allow or block automatic forwards to some or all external domains. They override user Inbox rules and Outlook on the web forwarding. Important caveat: forwarding that admins configure through mailbox forwarding or mail flow rules is not affected by remote domain settings.
Control three: mail flow rules
Mail flow rules can detect and block automatically forwarded messages sent by Inbox rules.
How they combine
If the spam policy is Off, forwards are blocked even where remote domains allow them. If the spam policy is On but a remote domain or mail flow rule blocks, the forward is blocked. That lets you allow forwarding generally but restrict which external domains receive it.
Finding who forwards today
Use the Auto forwarded messages report for cloud mailboxes. For on premises mailboxes forwarding through Microsoft 365, Microsoft describes a mail flow rule that matches the X-MS-Exchange-Inbox-Rules-Loop header.
Check the report before switching to Off, so a real business process does not break unnoticed. Then agree an exception path with an owner, rather than leaving the control open.
Quick check
Does turning forwarding off affect forwarding between internal users?
No. Internal automatic forwarding is not affected by outbound spam policy settings.
What does a blocked forward look like to the sender?
A non delivery report with a 5.7.520 access denied message.
Sources
Last reviewed: 19 October 2026.
