Check What Happens Before You Read Your Mail
An inbox can look ordinary while messages take a second route. Forwarding may send copies elsewhere. A filter may archive a security warning before you notice it. Both features have legitimate uses, which makes them worth inspecting rather than automatically trusting or deleting.
A mailbox audit asks three questions: which messages are selected, what happens to them, and who else can receive or manage them? Start with your primary personal email account. Finish that review before moving to old addresses or household accounts.
For work or school mail, involve the administrator when a setting is unfamiliar. Organization-level routing and shared-mailbox access may extend beyond the controls you can see. A personal settings review cannot certify the security of an entire mail system.
Open the Mailbox Through a Trusted Route
Use the provider's website through your usual bookmark or known address, preferably on a trusted computer. Confirm the selected account before inspecting settings. Several signed-in accounts can make it surprisingly easy to review the wrong inbox.
The browser interface is a useful starting point because a phone app may expose only part of the configuration. If you also use a desktop mail client, plan to inspect its rules separately. Some actions run at the provider; others depend on the client running.
If a surprise message prompted this audit, first verify the account security alert independently. Do not use a link in that message to reach the settings or install a suggested mailbox-cleaning tool.
Keep a private record of the account, review date, relevant settings, and decisions. Avoid copying message contents or credentials into an ordinary task list. Screenshots and exports can reveal private addresses and filtering details, so protect them accordingly.
Inspect General Forwarding and Individual Rules
Forwarding is not necessarily controlled by one switch. A mailbox may have an account-wide destination and separate rules that forward only selected messages. Review both, even when the main forwarding control is off.
Gmail
In Gmail on a computer, open Settings, then See all settings. Inspect the Forwarding and POP/IMAP tab, which may appear as Forwarding. Record whether forwarding is enabled, the destination, and what happens to the original copy.
Then open Filters and Blocked Addresses. Examine each filter's matching criteria and actions, especially forwarding, deletion, and skipping the inbox. Gmail supports forwarding through filters, so a general forwarding review alone is incomplete.
Outlook
In Outlook on the web or new Outlook, inspect Settings, Mail, Forwarding, and then Mail, Rules. Read individual rule details as well as the general forwarding setting. In classic Outlook, review Rules and Manage Rules & Alerts for the correct account.
Menu names and available controls vary by version and account. Use the provider's current help when your interface differs. For third-party accounts opened inside a mail client, also inspect settings at the service that actually hosts the mailbox.
Read Each Rule as a Small Program
A reassuring rule name tells you little. Open its details and work through its behavior:
- Conditions: which senders, recipients, subject words, or other properties select a message?
- Actions: is the message copied, forwarded, redirected, moved, deleted, or marked as read?
- Exceptions: which matching messages escape the action?
- Sequence: where supported, does the rule's position or a stop-processing option affect later rules?
Pay attention to combinations. Consider a hypothetical rule that selects messages containing account-related words, moves them into a rarely checked folder, and marks them as read. It might be an overenthusiastic filing shortcut. It might also hide warnings you need to see. The combination deserves an explanation.
Do not label every archive rule malicious. A newsletter filter can be perfectly reasonable. Ask whether you recognize the purpose, still need it, and can explain the destination. Open unfamiliar folders and check what they contain without executing attachments or following unexpected links.
Record disabled rules too, distinguishing them from active ones. An inactive rule is not proof of current forwarding, but its presence can still explain an old workflow or identify something that should not be re-enabled.
Verify Destinations and Other Access Paths
Read complete forwarding addresses rather than relying on display names or a familiar fragment. An old personal address, former assistant, or discontinued service may once have been appropriate and no longer be under the intended person's control.
For a destination you deliberately maintain, open that account independently and confirm that you still control it. For someone else's address, verify the arrangement through an established contact route. Do not send a test message to an unfamiliar destination to ask who owns it.
A verified forwarding address means the provider's verification process was completed. It does not establish that you currently want mail sent there. Give every retained destination a present purpose and check whether forwarding exposes more information than that purpose requires.
Delegated access is another control to review. In Gmail, look under Accounts and Import or Accounts for Grant access to your account. Delegates can read, send, and delete mail; this is broader than receiving selected forwarded messages. For managed mailboxes, ask IT to confirm the authorized people and permissions.
Also audit connected apps and their account permissions. An integration that can read email is a separate access path. Removing a forwarding rule does not revoke an app's permission, and disconnecting an app does not prove that mailbox rules are clean.
Remove Obsolete Behavior Without Losing Useful Mail
For routine cleanup, document a recognized rule before changing it. Disable it first where supported, or record its conditions and actions before deleting it. Gmail offers filter exports, but keep any export private and do not later import an unreviewed collection simply to restore one useful filter.
Change one item at a time. Reopen settings after saving and confirm the resulting state. Check general forwarding and conditional rules again so a second mechanism does not quietly preserve the behavior you intended to stop.
For a destination you own and have deliberately retained, a harmless new message can test the expected route. Use no personal data, credentials, security codes, or confidential attachments. If behavior depends on a desktop client, account for whether that client is running.
A normal test message proves only what happened to that message. It does not exercise a rule that selects different senders or subjects. Compare the result with the actual conditions, and avoid triggering password resets just to test a filter.
Treat Unauthorized Changes as an Incident
An unrecognized destination combined with unexplained sign-ins, missing warnings, or messages you did not send calls for more than tidying the rules list. Preserve the rule's details and any available timestamps promptly, then follow the provider's account-compromise process. Do not leave clearly unauthorized forwarding active while conducting a lengthy investigation.
From a trusted device, secure the account, review recovery methods and authentication settings, end unauthorized sessions, and revoke suspicious access as the provider directs. Check forwarding and rules explicitly after changing credentials. A password change is not evidence that every mailbox setting has been restored.
For work accounts, notify IT promptly through a known route. Administrators may need to inspect hidden rules, additional forwarding configuration, and audit records unavailable in your interface. Avoid running administrative cleanup scripts found in search results.
Stopping future forwarding cannot retrieve copies already delivered elsewhere. Record what the rule selected and what period is known or uncertain. A personal cybersecurity incident response kit helps organize the evidence, containment steps, and follow-up without turning the affected inbox into your only notebook.
Keep a Small Baseline You Can Recheck
Finish with a concise baseline: approved forwarding destinations, intentional filters that move important mail, authorized delegates, and unresolved questions. Record the review date and the reason for each powerful rule. Keep secrets out of the baseline.
Revisit it after a project ends, an assistant changes, an account is recovered, or expected mail starts disappearing. The useful result is straightforward: you can explain where incoming messages go, why each exception exists, and who is allowed to act on the mailbox.