Mail forward rule forwards to external domain

Associated with

Inboxes

Underlying signals

External mail forward (RS10)

Reasonings

• Enabled inbox, and

  • Any inbox that is enabled regardless if it’s regular, shared, or a distribution group

• Has mail forward rules, and

  • Inboxes without mail forward rules will never trigger this event

• A mail forward rule that forwards emails to an external address

  • Cork does not consider a domain as external if that domain is present in the same client’s environment

  • These are primarily alias domains

Resolutions

• If you cannot directly remove the rule, but have Exchange or O365 Exchange access you can configure the domain’s outbound spam filter policies to control external mail forwarding

  • You can reference https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding

• Remove the rule from the user

• If user is being offboarded, disable the inbox