Before You Auto-Forward Your Work Email: A Checklist

Auto-forwarding is easy to switch on and hard to unwind. Work through this checklist before you send any work mail to a personal address.

TL;DR

• Many organizations ban external auto-forwarding, so get a written yes or no from IT or HR before you set up any rule.
• A forwarding rule never sleeps. It keeps sending sensitive messages, and attackers who compromise a mailbox sometimes add hidden rules of their own.
• Forwarded mail can trip spam filters and land in junk, and personal accounts carry limits such as Gmail’s rejection of a single message sent to more than 500 recipients.
• Most providers support IMAP, so you can read two accounts in one app without copying mail anywhere.
• If you find a forwarding rule you did not create, treat it as a security incident and change your password.

Auto-forwarding takes about a minute to switch on. Undoing the habit, and any trouble it causes, takes far longer. Copying work mail to a personal address touches security, company policy and even deliverability all at once, so run through the checks below before you flip the switch.

Why Do People Auto-Forward, and What Goes Wrong?

The reasons are usually practical. Some people want every message in one inbox instead of checking two accounts. Others want copies of correspondence before they change jobs. And after Gmail removed its option to fetch mail from other accounts through POP, Google itself pointed users toward automatic forwarding from the old provider as a workaround.

The trouble starts because a forwarding rule never sleeps. It sends every matching message, including the ones you would never forward by hand, for as long as it exists. Once mail leaves the company’s systems, the employer loses visibility and control over it, and if it lands in an unsecured account the information is exposed immediately. Attackers who break into a mailbox sometimes add hidden forwarding rules of their own, so they keep receiving copies long after the initial breach. That pattern is a common feature of business email compromise, and it is one reason many organizations ban external forwarding outright.

What Does Your Employer’s Policy Say?

Start here, because the answer shapes everything else.

• Ask for the rule in writing. Many organizations prohibit forwarding to outside addresses because it limits what a compromised account can leak. Get a clear yes or no from IT or HR before you configure anything.
• Get approval if the policy is silent. In a Dutch court case from 2025, an employee who forwarded 63 work emails to his private address was fired on the spot. The court ruled that forwarding alone was not grounds for instant dismissal, partly because the employer had no clear policy on handling company information. The employee still had to fight the dismissal in court, which is not a position you want to be in.
• Check retention expectations. Businesses often must keep certain messages for set periods, and copies sitting in a personal inbox sit outside those obligations.
• Remember who owns the mail. Work correspondence generally belongs to the employer, not to the person reading it.

What Are the Security Risks of Forwarded Mail?

• Your personal account becomes the weak point. IT can require multifactor sign-in, managed devices and monitoring on a company mailbox. On your personal account, it can do none of that.
• Copies keep flowing after a break-in. Adding a mail rule is something attackers do after they already control a mailbox. Restricting forwarding is damage limitation, and it only works when every forwarding rule is visible to the people who can act on it.
• Personal inboxes carry more clutter and more phishing. Shopping receipts, newsletters and family mail mix with forwarded work messages, so one misclick puts both worlds at risk.

What Happens to Deliverability and Legit Messages?

Forwarding can quietly break mail in both directions.

• Forwarded mail can trip spam filters. Links, attachments or wording that looked fine in the original can raise flags once the message travels a new path.
• Check the junk folder early. Outlook’s own guidance says to look there the first time you confirm messages are forwarding, because forwarded mail often lands in Junk at the start.
• Sending limits still apply. A personal Gmail account rejects a single message sent to more than 500 recipients, and hitting the daily sending cap means you can send again within 24 hours. Busy group threads forwarded to a personal account can push you toward those limits.
• Bulk senders face stricter rules. Since February 1, 2024, anyone sending more than 5,000 messages per day to Gmail accounts must set up SPF and DKIM authentication, add DMARC, and keep reported spam rates below 0.3%. Forwarding does not lift you out of that system.

What Can You Do Instead of Forwarding?

• Add the account to your email app. Most providers support standard IMAP, which lets one app show two accounts without copying anything. This is the option Google recommends to people who lost POP fetching.
• Use filters inside the work account. Rules that label, archive or highlight messages can tame a crowded inbox without any mail leaving approved systems. Our getting-started guide to email filters and rules walks through the basics.
• Ask about approved access. Webmail, a managed mobile profile or a shared mailbox often solves the same problem forwarding was meant to fix.
• Forward single messages, with permission, when you truly need to. A one-off forward of a specific message is easy to track and delete. An automatic rule is neither.
• Lock down the receiving account anyway. If you do get approval, work through Five Ways to Lock Down Your Email Account before the first forwarded message arrives.

How Do You Turn It Off Later?

• In Outlook, open the Forwarding and IMAP settings, toggle forwarding off and save. If you set it up as an inbox rule instead, delete that rule on the Email Rules tab.
• In Gmail, check the forwarding and POP/IMAP settings, then review the Filters and Blocked Addresses list for any filter that forwards mail.
• Search for rules you forgot. Anything you did not create yourself deserves a closer look.
• Note the dates if you are migrating. Migration tools that remove duplicate messages can use the date forwarding was switched on, which reduces the risk of copied mail showing up twice.
• Change your password afterward. That matters most if the rule ran for a long time or you cannot account for everything it sent.

Open your settings today and check whether a forwarding rule already exists on your accounts, and if you find one you did not create, act on it as a security incident now.

Quick answers

Q: Is it illegal to forward work email to a personal account?

A: It depends on your employer’s rules and what the messages contain. A Dutch court ruled in 2025 that forwarding alone was not grounds for instant dismissal, but the safer path is written approval from your employer first.

Q: Will forwarded email go to spam?

A: It can. Links, attachments or wording that looked fine in the original can trigger spam filters once the message travels a new path. Check your junk folder when you first turn forwarding on.

Q: What should I use instead of auto-forwarding?

A: Add your work account to your email app with IMAP, or set up filters and labels inside the work account itself. Ask IT about approved options such as webmail or a shared mailbox.

Q: How do I check whether forwarding is already on?

A: In Outlook, open the Forwarding and IMAP settings. In Gmail, check the forwarding settings and the Filters and Blocked Addresses list for any rule that forwards mail.

Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.