How to forward emails in Gmail (2026 guide)

I set up auto-forward from my personal @gmail.com to a custom-domain mailbox six years ago and have audited the rule every quarter since — forwarding is the single most common silent-compromise vector in Gmail accounts, and Google’s February 2024 bulk-sender enforcement quietly changed how some forwarded mail is delivered. This guide covers every Gmail forwarding scenario in 2026: manual one-off forward, full auto-forward to one address, filter-based forwarding to multiple destinations, the keep-vs-delete dropdown, Workspace admin restrictions, the security audit nobody runs, and the DMARC pitfalls when forwarding to Outlook, iCloud, or your own domain.

---

TL;DR — Forward one email vs auto-forward

To forward a single email: open it → click the curved arrow (Forward) at the bottom or the three-dot menu → Forward → enter recipient → send. To auto-forward all future incoming mail: Settings (gear icon) → See all settings → Forwarding and POP/IMAP → Add a forwarding address → enter address → click the verification link Google sends to that address → return to Gmail → select “Forward a copy of incoming mail to” → choose keep / archive / delete behavior → Save Changes. To forward only some mail: Settings → Filters and Blocked Addresses → Create a new filter → set criteria → “Forward it to” a verified address.

Forwarding is the #1 silent-hack indicator. If an attacker briefly accesses your Gmail, the first thing they configure is a filter that forwards password-reset emails to their address. Audit your filters and forwarding addresses every 90 days — instructions in the security audit section below.

---

Manual forward — one email at a time

Forwarding one email is a per-message action, separate from any forwarding rule. The Forward button appears on every received message and never modifies your Gmail settings.

Standard forward (most common)

1. Open the email you want to forward in Gmail web or app.
2. At the bottom of the message, click the curved arrow icon labeled “Forward” — or click the three-dot menu (top-right of the message header) and choose Forward.
3. A composer opens with the original email quoted below your cursor. Add the recipient(s) in the To field.
4. Optionally edit the subject (Gmail prepends “Fwd:”) or the message body — anything you type above the quoted section appears as your note.
5. Click Send.

The recipient receives a new email from your address, containing the quoted original. They cannot see who you originally received the email from beyond what is in the quoted block, unless you use the next option.

Forward as attachment (preserves original headers)

When you need the recipient to see the original headers — for spam reporting, phishing analysis, or forensic forwarding — use Forward as attachment.

1. Open the email.
2. Click the three-dot menu in the message header.
3. Choose Forward as attachment.
4. The composer opens with the original message attached as a .eml file (Gmail names it after the subject). The recipient can open this file to see the full original including all headers, SPF/DKIM/DMARC results, and routing.

This is the right format when you forward suspicious mail to your IT team or to phishing@your-company.com — they need the headers, not just the body.

Edit before sending

Both forward types allow you to edit the quoted body before sending. This is useful when the original is long and you want to highlight one paragraph, but it also makes the email harder to trust — the recipient cannot tell what was modified. For sensitive forwards (legal, financial), use Forward as attachment instead so the original is verifiably intact.

---

Auto-forward all incoming mail

Gmail’s native auto-forwarding sends every new message you receive to one specified address. Setup requires two stages: register the destination and verify ownership, then enable forwarding behavior.

Stage 1 — Add and verify the destination

1. Open Gmail web at mail.google.com on a desktop browser. Mobile apps do not expose these settings.
2. Click the gear icon in the top-right → See all settings.
3. Open the Forwarding and POP/IMAP tab.
4. Click Add a forwarding address.
5. Enter the destination email address → Next → confirm in the popup → Proceed.
6. Gmail sends a verification email to the destination address. According to Google’s official documentation, you must click the confirmation link from the destination inbox.
7. Open the destination inbox, click the verification link, and confirm.
8. Return to the original Gmail’s Forwarding and POP/IMAP tab and refresh the page (Ctrl+R / Cmd+R).

The destination now appears in the forwarding dropdown. Without the verification click, forwarding cannot be enabled — this is Google’s anti-abuse protection so you cannot silently redirect someone else’s mail.

Stage 2 — Enable forwarding

1. Back on the Forwarding and POP/IMAP tab.
2. Select “Forward a copy of incoming mail to”.
3. Choose the verified address from the dropdown.
4. In the second dropdown, choose what Gmail should do with its own copy: keep in inbox (recommended), mark as read, archive, or delete. See keep vs delete below.
5. Click Save Changes at the bottom.

Forwarding is now active for all incoming mail going forward — it does not retroactively forward old messages.

---

Forward only emails matching a filter

If you want to forward only some emails — for example only invoices, only newsletters from a specific sender, or only emails containing “urgent” — use filters instead of native forwarding. Filters can route mail to any verified forwarding address.

Create a filter that forwards

1. Open Gmail web → click the gear icon → See all settings → Filters and Blocked Addresses tab.
2. Click Create a new filter at the bottom of any existing filter list, or use the search-box dropdown arrow.
3. Define the criteria: From (specific sender), To, Subject, Has the words, Doesn’t have, Size, or Has attachment.
4. Click Create filter at the bottom-right of the criteria box.
5. In the action panel, check “Forward it to” and choose the verified address from the dropdown. If your address isn’t there, click add forwarding address — you go through the same verification flow as native forwarding.
6. Optionally also apply a label, mark as read, or skip the inbox.
7. Click Create filter.

Future mail matching the criteria is forwarded automatically. The filter runs in addition to any native forwarding — both can fire on the same email if both match.

Practical example: I have one filter that forwards every email from noreply@stripe.com to my accountant’s inbox, and another that forwards anything with attachment + the word “invoice” in the subject to my expense tracker. Native forwarding stays off — these two filters cover 100% of what I’d actually want forwarded.

---

Forward Gmail to multiple addresses

Gmail’s native forwarding setting allows only one destination. To forward to multiple addresses, the supported approach is to create multiple filters — each filter can target a different verified destination.

Approach 1 — Multiple filters, same criteria

Create one filter with your criteria, set it to forward to address A. Create a second identical filter, set it to forward to address B. Each filter independently forwards matching mail.

The trap: Gmail’s filter creation flow does not allow a single filter to forward to multiple addresses, and pasting two addresses comma-separated into the field is rejected. You must create one filter per destination.

Approach 2 — Forward to a Google Group

If both destinations are inside the same Google Workspace organization (or you control a Google Group with both as members), forward to the Group address. The Group fans out to all members.

This is the cleanest approach for team inboxes — you forward from your personal Gmail to a single team@company.com Google Group, and the Group delivers to every team member.

Approach 3 — Plus-addressing on one destination

If the multiple addresses are aliases of the same mailbox (for example me+work@gmail.com and me+personal@gmail.com), Gmail forwards to the base address and you sort with filters on the receiving side using the plus tag. This isn’t true multi-destination, but it’s the right pattern when “multiple addresses” means “multiple buckets in one inbox.”

---

Keep a copy vs delete after forward

The dropdown in step 2 of auto-forward setup controls what Gmail does with its own copy after forwarding. Four options: keep in inbox, mark as read, archive, or delete. The right choice depends on whether you still use the Gmail account.

Option	What happens	When to use
Keep Gmail’s copy in the Inbox	Email arrives in the destination AND stays in your Gmail inbox unread	You still actively use the Gmail account; you want a backup
Mark Gmail’s copy as read	Email arrives in destination, stays in Gmail but as read	You want the backup but don’t want unread counts piling up
Archive Gmail’s copy	Email arrives in destination, lives in Gmail’s All Mail (searchable, no inbox clutter)	You no longer check Gmail but want it as a historical archive
Delete Gmail’s copy	Email arrives in destination only; Gmail copy goes to Trash (then permanently deleted after 30 days)	You are fully migrating away from Gmail and want it to act as a passthrough

Recommended default: Keep in Inbox or Archive. Deleting after forward means a single point of failure — if the destination ever fails to receive (server outage, full mailbox, spam-folder bounce), the message is gone after 30 days. Keeping at least the archived copy in Gmail costs nothing (Gmail’s 15 GB free quota holds years of mail) and gives you a fallback.

I keep mine on Archive. Inbox stays empty in the source account, but every message is recoverable from Gmail search for years.

---

Workspace admin restrictions

Google Workspace admins can disable forwarding to external addresses, restrict it to specific domains, or block it entirely. If you can’t enable forwarding on a Workspace account, this is the most likely cause.

Diagnostic — is forwarding blocked?

1. Open Settings → Forwarding and POP/IMAP.
2. If you see the section but Add a forwarding address is greyed out or shows an error like “Forwarding to external addresses has been disabled by your administrator”, admin policy is blocking you.
3. If the entire Forwarding and POP/IMAP tab is missing, the admin has hidden the feature.

What to do

• Ask your IT admin to whitelist your destination domain or grant you an exception. Many orgs block external forwarding by default for security but allow exceptions on request — frame it as “I need this to forward HR notifications to my personal calendar” or similar.
• Filter-based forwarding may still work if the admin only disabled the native forwarding setting. Try the filter route from the previous section.
• Workspace admins: the policy lives in Admin console → Apps → Google Workspace → Gmail → End User Access → Mail delegation / External forwarding. Disabling external forwarding is a security best-practice in regulated industries.

If forwarding is blocked, the supported alternative is to use Gmail’s mail delegation (a delegate gets read/send-as access to your account without forwarding) — see Google’s delegation documentation linked in the sources block.

---

Disabling and auditing forwarding (security)

Forwarding is the single most common indicator of a silently compromised Gmail account. Attackers who briefly access your account often set up a filter that forwards password-reset emails to their address, then sign out — leaving no obvious trace except the filter. Audit forwarding and filters every 90 days.

Security audit checklist

Run this every quarter on every Gmail account you own.

1. Check native forwarding

• Settings → Forwarding and POP/IMAP.
• Look for any “Forwarding a copy of incoming mail to” entry. If you see one you didn’t set up, select Disable forwarding → Save Changes immediately.
• Below, check registered forwarding addresses — Google lists every address that has ever been verified. Remove any you don’t recognize using the Remove address button next to each.

2. Check filters

• Settings → Filters and Blocked Addresses.
• Read every filter. Pay special attention to any with Forward it to in the action. Also flag any filter that deletes mail matching “password reset”, “verification”, “security alert”, or “Google” — these are the classic attacker filters used to hide their tracks.
• Delete unknown filters.

3. Check IMAP/POP

• Same Forwarding and POP/IMAP tab. If POP or IMAP is enabled and you don’t use a desktop client, disable both.

4. Check connected apps

• myaccount.google.com → Security → Your connections to third-party apps & services. Revoke anything you don’t recognize.

5. Check recent activity

• myaccount.google.com → Security → Your devices → Manage all devices. Sign out anything unfamiliar.
• Last account activity at the bottom of every Gmail page (link: “Details”) shows the last 10 sign-in IPs. Foreign IPs you don’t recognize = compromise.

If anything in steps 1-5 looks wrong, change your password immediately (Gmail password change guide), then re-audit.

---

Forwarding to Outlook, iCloud, custom domain — DMARC pitfalls

Forwarded mail preserves the original “From” address. When the original sender’s DMARC policy is strict and your forwarding destination’s server checks DMARC, the forwarded message can land in spam or be rejected outright. Google’s 2024 bulk-sender enforcement made this worse.

In February 2024, Google rolled out new requirements for bulk senders (5,000+ messages/day to Gmail) requiring SPF, DKIM, and DMARC alignment — see Google’s email sender guidelines. The change cascaded into how forwarded mail is handled at the receiving end. Three failure modes to know:

Forwarding to Outlook.com or Microsoft 365

Microsoft’s spam filters check DMARC on incoming mail. When Gmail forwards a message originally sent from a strict-DMARC sender (banks, big SaaS) to your Outlook inbox, the forwarded message fails DMARC on Outlook’s side because the “From” doesn’t match Gmail’s SPF/DKIM. Outlook may bin it as spam.

Mitigation: Gmail adds ARC (Authenticated Received Chain) headers when forwarding, which Outlook respects in most cases. But it’s not universal — check your Outlook spam folder for the first week after enabling forwarding.

Forwarding to iCloud

Apple’s iCloud Mail is stricter than Outlook on DMARC. Forwarded mail from financial senders to iCloud almost always lands in iCloud’s Junk folder. Apple’s documentation does not currently expose a whitelist mechanism for forwarded sources.

Mitigation: Create an iCloud rule (in iCloud Mail web settings) that moves mail from your-original-address@gmail.com to inbox, but be aware Apple does not officially document overriding DMARC.

Forwarding to a custom domain (Fastmail, ProtonMail, self-hosted)

If you forward Gmail to a custom domain mailbox, your receiving server’s DMARC policy is what matters. Fastmail and ProtonMail both respect ARC and usually deliver forwarded mail correctly. Self-hosted (mailcow, Mail-in-a-Box) requires you to configure ARC validation.

Practical test: After enabling forwarding to a new destination, send yourself an email from a strict-DMARC sender (try a Stripe receipt, an Amazon order confirmation, or a password-reset link). Check the destination inbox — if it landed in spam, you have a DMARC issue to investigate.

---

Mobile app limitations

The Gmail mobile apps for iOS and Android do not expose forwarding settings at all. You can forward a single email from mobile (Forward button on the message), but you cannot add a forwarding address, configure a filter that forwards, or audit existing forwarding rules. All forwarding configuration requires a desktop browser at mail.google.com.

What you can do on mobile

• Forward a single email: open the email → tap the three-dot menu in the message header → Forward. Same as web.
• View filters (Android only, partially): the Gmail Android app exposes filter creation from search results in some versions, but the forwarding action is not available — only labeling, archiving, deleting.

What you cannot do on mobile

• Add or verify a forwarding address.
• Enable or disable auto-forwarding.
• Create a filter with the “Forward it to” action.
• Audit existing forwarding rules.
• See the Forwarding and POP/IMAP tab at all.

Workaround if you only have a phone

Open mail.google.com in your phone’s browser → tap the menu → request desktop site. The full settings UI loads but it’s miserable to navigate on a 6-inch screen. If you need to set up forwarding from a phone urgently, a tablet or borrowed laptop is the realistic answer.

This limitation has been consistent across the Gmail mobile app for years and Google has not signaled an intent to change it. For anyone managing multiple Gmail accounts, see our Gmail account switcher guide and the Gmail search operators list for filter syntax you can pre-write before opening the desktop site.

---

---

Sources & references

1. Google Support — “Automatically forward Gmail messages to another account” — official Gmail forwarding documentation including verification flow and copy-handling options. Accessed 2026-05-16. support.google.com/mail/answer/10957
2. Google Support — “Email sender guidelines” — the February 2024 bulk-sender update affecting SPF/DKIM/DMARC for forwarded mail. Accessed 2026-05-16. support.google.com/mail/answer/81126
3. Google Workspace Admin Help — “Set up email forwarding restrictions” — admin controls for disabling external forwarding in Workspace. Accessed 2026-05-16. support.google.com/a/answer/2364580

---

Frequently asked questions

How do I forward a single email in Gmail without setting up automatic forwarding?

Open the email, click the three-dot menu in the top-right of the message, choose “Forward” (or “Forward as attachment” to preserve original headers). Add the recipient, edit the body if you want, and send. This is a one-off action — nothing changes in your Gmail settings.

Why does Gmail send a verification email when I add a forwarding address?

Google requires the destination address to confirm it consents to receive your forwarded mail. After you add the address in Settings → Forwarding and POP/IMAP, Gmail sends a confirmation link to that address. You must click the link from the target inbox, then return to Gmail and refresh the settings page before forwarding becomes active.

Can I forward Gmail to multiple addresses?

Yes, but not directly. Gmail’s native “Forwarding” setting only allows one destination. To forward to two or more addresses, create one or more filters: Settings → Filters and Blocked Addresses → Create a new filter → set “From:” or other criteria → “Forward it to” a verified address. Each filter can target a different verified address.

Should I keep Gmail’s copy in the inbox or delete it after forwarding?

Keep the copy unless you are migrating away from Gmail entirely. Keeping the copy means the original lives in Gmail (searchable, backed up) while your forwarding destination also receives it. Deleting after forward (archive or trash) saves storage but creates a single point of failure — if the destination loses the mail, it is gone from Gmail too.

Does forwarded Gmail break DMARC for the receiving address?

Sometimes. Google’s February 2024 bulk-sender rules tightened SPF/DKIM/DMARC enforcement. Forwarded mail preserves the original “From” header, so the receiving server may flag the message as spoofed if the original sender’s DMARC policy is strict and the forwarding hop does not rewrite headers. Gmail’s forwarding adds ARC headers to mitigate this, but mail forwarded to small custom-domain mailboxes still occasionally lands in spam.

Can I set up Gmail forwarding from the mobile app?

No. The Gmail mobile apps for iOS and Android do not expose forwarding settings — neither the address list nor the verification flow nor filter creation. You must open mail.google.com in a desktop browser (or the desktop site on mobile, which is awkward) to configure any forwarding behavior.

---

Related: Gmail account switcher — switch between multiple accounts — multi-account methods on web and mobile. Gmail search operators — the complete list — find mail across forwarded archives. Gmail keyboard shortcuts complete list — work the inbox without the mouse. Gmail password change guide — if your forwarding audit turns up something suspicious.