Mailbox forwarding redirects or copies messages to another address after they reach a mailbox or service.
External forwarding can move organizational data outside managed boundaries. It can also complicate SPF/DMARC because the forwarded SMTP connection is different from the original delivery.
Security angle
Attackers who compromise accounts sometimes create forwarding rules to retain visibility into conversations.
Monitor administrative and user-created forwarding according to the platform’s capabilities and organizational policy.