Back to Checks
googleworkspace

Automatic forwarding options are disabled

gmail_auto_forwarding_disabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Automatic email forwarding allows users to automatically forward all incoming email to an external address. Disabling this feature prevents unauthorized data exfiltration through email forwarding rules.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

With auto-forwarding enabled, an attacker who gains control of a user account can create forwarding rules to exfiltrate all incoming email to an external address. This can persist undetected and provide the attacker with continuous access to sensitive communications even after the account is recovered.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_auto_forwarding_disabled

Recommendation

Disable automatic email forwarding to prevent users and attackers from setting up rules that exfiltrate email data to external addresses.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **End User Access** > **Automatic forwarding**
4Uncheck **Allow users to automatically forward incoming email to another address**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_auto_forwarding_disabled(Check):
    """Check that automatic forwarding options are disabled.

    This check verifies that the domain-level Gmail policy prevents users
    from automatically forwarding incoming email to external addresses,
    reducing the risk of data exfiltration.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            forwarding_enabled = gmail_client.policies.enable_auto_forwarding

            if forwarding_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Automatic email forwarding is disabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                if forwarding_enabled is None:
                    report.status_extended = (
                        f"Automatic email forwarding is not explicitly configured "
                        f"in domain {gmail_client.provider.identity.domain}. "
                        f"Auto-forwarding should be disabled to prevent data exfiltration."
                    )
                else:
                    report.status_extended = (
                        f"Automatic email forwarding is enabled "
                        f"in domain {gmail_client.provider.identity.domain}. "
                        f"Auto-forwarding should be disabled to prevent data exfiltration."
                    )

            findings.append(report)

        return findings

References