If you find email forwarding you did not enable, turn it off and look for rules or filters that forward selected messages. Then secure the account: an unknown forwarding setting can be a sign that someone else has access. For work or school mail, your organization’s administrator may need to check settings you cannot see.
Check both kinds of forwarding
Email can be sent elsewhere in at least two ways: an account-wide setting that forwards incoming mail, or a rule that forwards only messages matching certain conditions. The names differ by service: Gmail calls these settings forwarding and filters; Outlook uses forwarding and inbox rules. Disabling account-wide forwarding does not remove a separate forwarding rule, so inspect both. Google documents the two Gmail controls in its Gmail forwarding instructions and filter instructions; Microsoft describes inbox rules as a way to forward or redirect mail in its Outlook forwarding guidance.
As an Amazon Associate I earn from qualifying purchases.
Do not look only for a rule that forwards every message. Someone with access may create a narrower rule and use it to forward specific mail, move messages out of the inbox, delete them, or mark them read so that activity is less noticeable. Microsoft identifies these behaviors in its guidance on suspicious email forwarding activity.
Free tools Windows power users keep installed
One-click scans. No signup required.
If the unfamiliar setting is in a work or school mailbox, it could be a user-created rule or a mailbox-level setting controlled by an administrator. The steps below help you check the visible controls; they cannot establish that every administrator-managed setting is clear.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep the distinction in mind while you investigate. Account-wide forwarding generally sends incoming mail to a destination without requiring a particular subject or sender. A filter or rule has conditions, so it might act only on messages from certain people, with particular words, or meeting another criterion. A rule may also have more than one action: for example, it could forward a message and separately move or delete it. Read the conditions and every action, not just the rule’s name. Names can be vague or misleading, and an unfamiliar destination can be tucked into a rule that appears to do something ordinary.
There is no single list of clicks that works across every service. A personal Gmail account, Outlook.com mailbox, Outlook app, and organization-managed Microsoft 365 mailbox can expose different controls. Start with the provider-specific instructions below, then involve the administrator if you use a work or school account and the visible settings do not account for what you are seeing.
Before changing settings
If you still have access to the account, use a trusted device and a browser where possible. Record the unfamiliar destination address and, if practical, note or capture the rule’s conditions and actions before removing it. That information may help an organization’s IT team investigate. Do not forward suspicious messages to an address you do not control.
If a service displays a notice that forwarding was enabled and you did not enable it, treat the notice as a security warning. Google specifically advises changing the password immediately and turning off forwarding in that situation in its Gmail forwarding instructions. If the account belongs to an employer or school, notify its administrator as well; they may need to investigate mailbox settings and access.
When you inspect settings, make a note of what you find before changing it, especially on a work account. The destination, rule conditions, actions, and approximate time you discovered the setting can help IT understand what to examine. Do not delay disabling an unfamiliar personal-account setting just to document it, but avoid deleting evidence from a managed mailbox if your organization asks you to preserve it.
Gmail: check account-wide forwarding and filters
Use Gmail in a web browser for this check. The mobile app may not expose all of the settings you need; Google’s Gmail security tips direct users to the settings page for forwarding and POP/IMAP checks.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Open Gmail, select the gear icon, then choose See all settings.
- Open Forwarding and POP/IMAP. Review whether forwarding is enabled and inspect the destination address. If you do not recognize it, disable forwarding and save the change. Google’s step-by-step forwarding help covers the setting.
- Open Filters and Blocked Addresses. Inspect filters for an action that forwards mail. Review the conditions too: a filter can target only certain senders, subjects, or other matching messages.
- If a forwarding filter is not yours, edit it to remove the forwarding action or delete the filter. Also inspect unfamiliar filters that delete, archive, or otherwise divert messages. Google explains how to review and manage filters in Create rules to filter your emails.
- Save any changes. Reopen the two settings areas and confirm the unfamiliar forwarding destination or action is gone.
Do not stop after checking the first Gmail tab. The account-wide forwarding control and the filter list are separate places, and clearing one does not show that the other is clear. If forwarding was not enabled account-wide, a filter could still be sending selected messages out. Conversely, a clean filter list does not rule out account-wide forwarding.
Google’s security guidance also recommends reviewing related Gmail access and sending settings, including Send mail as, account delegation, POP access, and filters that delete messages. These are worth checking if forwarding appeared without your knowledge; they can affect who can send or access mail and whether messages remain visible in the inbox. See Gmail security tips and Google’s instructions for a hacked or compromised Google Account.
As you review filters, look beyond the word “forward.” A filter that archives, deletes, or marks selected messages as read may help conceal other activity even if it does not send mail elsewhere. If you find an unfamiliar filter, inspect both its matching conditions and its actions before deciding whether to edit or delete it. Google provides instructions for managing filters, but if you are uncertain whether a setting is legitimate on a work account, check with your administrator.
Outlook.com and Outlook apps: inspect forwarding and rules
Microsoft’s click path depends on the Outlook product and version. Its support instructions cover Outlook.com, Outlook on the web, New Outlook, and classic Outlook, so use the section that matches the interface you have rather than assuming every version uses the same menus. The current paths are listed on Microsoft’s Turn automatic forwarding on or off in Outlook page.
- In supported versions, open Settings > Mail > Forwarding. If forwarding is enabled to an address you do not recognize, turn it off and save the change.
- Open the mail rules area. Depending on the Outlook version, this may be Mail > Rules in settings or Rules > Manage Rules & Alerts in classic Outlook.
- Review each rule for actions that forward or redirect mail. Check the conditions as well as the action; a rule may apply only to selected messages.
- Remove or disable rules you did not create, particularly rules that forward, redirect, delete, move, or mark messages as read. If you are unsure whether a rule is legitimate, ask your organization’s IT administrator before removing a work rule.
- Return to the forwarding and rules screens to verify that the unfamiliar setting is no longer active.
The FBI’s joint advisory for Outlook account security likewise recommends removing suspicious rules and verifying that forwarding is unchecked. Its Practical Guide to Securing Your Outlook Account is relevant for Outlook users who want a security checklist beyond the settings change.
Recommended Free Tools
Outlook rules may use the words forward or redirect; inspect for either action. The important point is what the rule does, not the label it was given. If a rule applies to only a limited set of messages, the conditions may offer a clue as to why some mail disappears or reaches an unfamiliar address while other messages continue arriving normally.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft 365 work or school mail: check with your administrator
A work or school mailbox may have both inbox rules that you can see and mailbox-level forwarding configured outside the ordinary user-facing rule list. Microsoft’s incident guidance discusses investigating suspicious inbox rules, including hidden rules, and removing mailbox forwarding as part of responding to a compromised account. The user-visible Outlook controls may therefore not tell the whole story.
Check the Outlook forwarding setting and rules as described above. If you cannot find the destination, cannot change it, or forwarding returns after you remove it, contact your organization’s IT or email administrator promptly. Provide the destination address, the approximate time you noticed it, and details of any suspicious rule that remain available. An administrator can investigate mailbox-level settings and account activity; Microsoft’s Microsoft 365 compromised-account response guidance describes administrator response actions, including investigation and session revocation.
Automatic external forwarding can disclose information outside the organization. Microsoft notes that forwarding can be useful but also creates a disclosure risk in its guidance on responding to a compromised Microsoft 365 account. Do not assume an unfamiliar external address is harmless simply because the mailbox still works.
A user’s visible inbox rules and administrator-managed mailbox forwarding are different controls. If you have checked the forwarding page and rules list but cannot explain the behavior, that is not proof that no forwarding exists. An organization’s administrator may have permissions and investigation tools that are unavailable in the ordinary mailbox interface, including the ability to examine hidden rules or revoke active sessions. Tell IT what you observed rather than trying to bypass a managed setting yourself.
For an organization, forwarding can expose business or personal information beyond the intended mailbox. That is why an unfamiliar destination should be treated as a security concern, not merely a preference to clean up. Follow your organization’s incident-reporting process, particularly if the rule may have handled sensitive messages.
Yahoo Mail: inspect filters and auto-forwarding
Yahoo’s compromised-account checklist tells users to check both filters and the auto-forwarding address for changes they do not recognize. The exact interface can vary, so consult Yahoo’s Recognize a hacked Yahoo Mail account instructions if the labels in your account differ.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Open Yahoo Mail settings and find the area for filters. Review the conditions and actions for every unfamiliar filter, especially actions that redirect, delete, or move messages.
- Find the auto-forwarding setting and inspect the destination address. Remove or disable forwarding you did not set.
- Save your changes, then return to the filter and forwarding settings to check that the unwanted entries are gone.
- Continue with Yahoo’s compromised-account recovery checks: change your password, remove unrecognized app passwords, review recovery methods, restore other mail settings that were changed, and enable two-step verification.
As with Gmail and Outlook, check both the broad forwarding control and the filter list. A clean auto-forwarding address does not answer whether a filter diverts a smaller group of messages. Review unfamiliar filters for actions that can hide mail, not only those that send copies elsewhere.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Secure the account after removing the rule
Removing an unfamiliar rule stops that particular setting from acting; it does not prove that the account is secure. If someone gained access, they may have changed other settings or still be able to sign in. Work through the recovery checks below, using the provider’s official account-security guidance for your service.
- Change the password from a trusted device. Choose a new password that is not used for another account. Google advises an immediate password change when a user sees an unexpected forwarding notice, and Yahoo includes a password change in its compromised-account checklist: Google Gmail forwarding help and Yahoo compromised-account help.
- Review recovery methods. Check recovery email addresses and phone numbers, and remove anything you do not recognize. Yahoo specifically includes recovery-method review in its checklist; Google’s compromised Google Account guidance covers account recovery and security review.
- Remove unfamiliar access. Review app passwords, connected access, delegation, and other account access paths exposed by your provider. Yahoo advises deleting unrecognized app passwords, while Google recommends reviewing Gmail delegation and related access settings. Follow the relevant provider’s recovery steps rather than assuming a password change removes every existing session or access method.
- Turn on stronger sign-in verification. Enable multi-factor authentication or the provider’s two-step verification option. Yahoo recommends two-step verification in its compromised-account guidance, and Google includes 2-Step Verification in its Gmail security tips.
- Look for signs that messages were concealed or sent. Check rules and filters for actions that delete, archive, move, or mark messages read, and review sent mail and account activity for actions you do not recognize. These checks matter because suspicious rules may do more than forward messages; Microsoft describes hiding behaviors in its forwarding activity guidance.
- For Microsoft 365 work accounts, ask IT to investigate. An administrator may need to examine mailbox forwarding and rules, review account activity, and revoke active sessions as part of incident response. See Microsoft’s compromised-account response guidance.
Use the checks as a connected review rather than assuming the forwarding toggle is the whole problem. For example, an unfamiliar forwarding rule may be accompanied by a changed recovery address, an app password you did not add, or a filter that removes messages from your inbox. Reviewing related settings can help you spot other access or concealment changes, and changing the password helps address the possibility that someone else can still sign in. The exact review controls vary by provider, so use its account-security process for settings you cannot locate.
After the cleanup, check your inbox, sent mail, and available account activity for actions you do not recognize. Pay attention to messages that appear to have been deleted, moved, or read unexpectedly. This is a review for signs of activity, not a guarantee that every message or action will be visible in those folders.
Stronger sign-in verification is a follow-up protection, not a way to remove forwarding. Google recommends 2-Step Verification, and Yahoo recommends two-step verification as part of its compromised-account guidance. A compatible FIDO2 security key is one optional way to strengthen sign-in where the provider supports it, but a key does not find or disable mail rules.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If the forwarding rule comes back
If a setting reappears after removal, do not keep deleting it without checking how access could persist. It may indicate an active unauthorized session, another route into the account, or a control managed by an administrator. This is not a diagnosis that applies to every provider, but it is a reason to recheck sign-in and recovery access and involve the provider or workplace administrator. Google’s compromised-account guidance and Microsoft’s Microsoft 365 response guidance both treat account access and mailbox configuration as part of the investigation: Google Account recovery and Microsoft 365 response.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
For a personal account, use the provider’s account recovery and security-check process if you cannot remove the setting or cannot secure the account. For an organization-managed mailbox, report the recurrence to IT rather than treating it as an ordinary preferences issue.
If you do not recognize the destination but the setting is difficult to change, avoid assuming the interface is broken or that the address is benign. Confirm that you are in the correct account and product, check both the account-wide control and the rules or filters, and then contact the provider’s support or your workplace administrator if the setting remains unexplained. In a managed environment, the administrator can check whether the setting is controlled at mailbox or organization level.
Frequently Asked Questions
Why is my email forwarding to an address I don’t recognize?
It may be enabled in an account-wide forwarding setting or by a rule or filter that forwards only matching messages. Check both controls. If you did not set it up, treat it as a possible account compromise: remove the unfamiliar setting, change the password from a trusted device, and review recovery and other access settings.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesCan an attacker hide emails with a rule?
Yes. A suspicious rule may forward selected messages, but it may also move, delete, or mark messages as read so they are less noticeable. Inspect every unfamiliar rule’s conditions and actions, not only rules labeled as forwarding.
I turned off forwarding. Do I still need to check filters or rules?
Yes. Account-wide forwarding and conditional rules or filters are separate controls. Turning off one does not establish that the other is clear. Review both, then check for other unfamiliar mail settings.
What if the rule is not visible in my Outlook settings?
A Microsoft 365 work or school mailbox can have mailbox-level forwarding or hidden rules that are not apparent in the ordinary user-facing controls. Contact your organization’s IT or email administrator so they can investigate settings and account activity.
What should I do if the forwarding setting returns after I remove it?
Recheck sign-in, recovery, and related access settings, and contact the provider or workplace administrator. A returning setting could involve an active unauthorized session, another access method, or an administrator-managed control; it is not possible to diagnose the cause from the setting alone.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does changing my password remove a forwarding rule?
Do not assume it does. Remove the rule or forwarding setting directly, then change the password and review other access and recovery settings. A password change alone does not confirm that mailbox rules or other access paths have been cleared.
The Bottom Line
Check both account-wide forwarding and conditional rules or filters, remove anything you did not create, and review settings that could hide messages. Then change your password, check recovery and account access, and enable two-step verification. If a work or school mailbox’s behavior is unexplained or returns, involve the administrator.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
