Is email forwarding secure? 7 risks a small business should check
Email forwarding can be a practical way to send messages from a business address to an inbox your team already checks. But every forwarding route creates another path for quotes, invoices, bookings and customer details. That path needs an owner, a known destination and regular checks.
Email forwarding is not automatically secure or insecure. Risk depends on who controls the forwarding rule and destination inbox, what information passes through the route, and whether the business reviews access and tests the exact setup. Treat forwarding as another access path: protect both accounts, remove stale rules and confirm who can receive each address.
1. Check for hidden or unauthorised forwarding rules
A forwarding rule should exist because someone in the business approved it. An unexpected rule may quietly copy future messages to another address. Its presence does not prove an account has been compromised, but it does deserve investigation.
Check which rules are active, who created them and where they send messages. Settings and administrator controls vary, so ask your email provider or administrator if the route is not clear. It also helps to understand how forwarding differs from a redirect, because the terms and behaviour may not be identical in every setup.
2. Protect the destination inbox too
Forwarding does not remove the source account from the picture. It adds a destination inbox that can receive the same business messages. If quotes@fictionalplumbing.au forwards to a manager’s inbox, access to either account matters.
Use a unique password for each account, enable multi-factor authentication where supported, keep recovery details current and restrict access to the people who need it. If one address forwards to several people, document every destination and review the added exposure before forwarding one address to several inboxes.
3. Know what information passes through the route
A trade or field-service inbox may receive more than appointment times. Customers might send home addresses, invoices, job-site photos, identification documents or payment details. Forwarding those messages to a personal, former or loosely managed account can put them in the wrong hands.
List the types of messages the address receives, then decide whether each destination is appropriate. For sensitive or regulated information, ask your provider, IT or security adviser, or another appropriate professional for advice specific to your business. Forwarding is a routing choice, not proof of privacy or compliance.
4. Remove stale routes when people change
Staff, contractors and bookkeepers come and go. A forwarding rule can remain active long after someone has stopped working with the business, especially when no one records who owns it.
Include forwarding destinations in your staff and contractor offboarding checklist. Remove routes that are no longer needed and confirm access to both the source and destination accounts. A forwarding destination is not the same thing as mailbox ownership or a named user account, so check each layer rather than assuming one change covers everything.
5. Test the exact route from outside the business
A saved rule is not evidence that the complete route works as expected. Send a test from an unrelated external address and confirm which inboxes receive it, whether the source keeps a copy and whether filters place it somewhere unexpected.
Use fictional, non-sensitive test content. Include a small photo and PDF if customers normally send files, then test photos, PDFs and other attachments. Reply from the destination too, and check what customers see when you reply. Provider behaviour and available controls vary.
6. Run this 7-point forwarding check
Before relying on a business forwarding route:
- Confirm who approved and owns the forwarding rule.
- Confirm every destination address receiving messages.
- Review current staff, contractor and adviser access.
- Protect both source and destination accounts.
- Send an external test through the exact route.
- Inspect reply behaviour, retained copies, filters and attachments.
- Set a recurring date to review or remove the rule.
Record the result somewhere the business owner or administrator can find it. Repeat the check after staff changes, provider changes or changes to the information the address receives.
7. Consider a shared mailbox or managed setup
Forwarding may suit a simple route from 1 business address to 1 existing inbox. It may be a poor fit when several people need controlled access, assignment, shared history or clear responsibility for each message. In that case, compare when a shared mailbox is a better fit and ask your provider or administrator what the setup supports.
Want a shorter .au address that can forward to an inbox you already use? Contact Short Mail to check an option. Availability, fit, eligibility, setup and provider compatibility are manually confirmed before any next step.