Mail forward rule forwards to external domain

Associated with

Inboxes

Underlying signals

External mail forward (RS10)

Reasonings

• Enabled inbox, and
  • Any inbox that is enabled regardless if it’s regular, shared, or a distribution group
• Has mail forward rules, and
  • Inboxes without mail forward rules will never trigger this event
• A mail forward rule that forwards emails to an external address
  • Cork does not consider a domain as external if that domain is present in the same client’s environment
  • These are primarily alias domains

Resolutions

• If you cannot directly remove the rule, but have Exchange or O365 Exchange access you can configure the domain’s outbound spam filter policies to control external mail forwarding
  • You can reference https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding
• Remove the rule from the user
• If user is being offboarded, disable the inbox