Setting up forwarding for the security mailbox: a guide for each mail provider

You set up forwarding where the security mailbox lives: in the administration of your mail provider or your mail server. You enter a target address, choose to keep a copy in the mailbox, and save. In Microsoft 365 the outbound spam policy must also allow automatic forwarding to external addresses, and in Gmail a filter must stop reports classified as spam from being held back. A test e-mail to the security mailbox shows at the end whether everything arrives.

How does forwarding work?

Regulation (EU) 2024/2847 requires manufacturers to provide a contact address for reporting vulnerabilities (Annex I, Part II, point 6) and a single point of contact that users can easily identify (Article 13(17)). This is usually an address such as security@ at your domain. Forwarding does not change any of that: the address stays the same, reporters notice nothing, and every incoming e-mail also goes to a second address.

For CRA Response Center, this second address is the virtual address you see next to the mailbox in the application. From the first forwarded e-mail onwards, the tool reads alongside you, classifies and notifies your on-call team. It needs no access to your mailbox and no password. Your mailbox remains the source: every e-mail stays there, and that is where you read it yourself.

Before you start, clarify three things:

• Who may change the setting? In Microsoft 365, Google Workspace and Exchange this usually needs someone with administrator rights; with hosting packages, access to the customer administration.
• Is security@ a mailbox of its own or only a forwarding address? With some hosts the address is just an alias that already forwards to another mailbox. In that case, add a further target there.
• Which spam filter sits in front? A filter upstream that rejects e-mails also prevents forwarding.

The labels are taken from the providers' help pages. Interfaces change, and individual words may differ in your version.

Microsoft 365 and Exchange Online

Forwarding for a mailbox is set by someone with administrator rights in the Exchange admin center. Microsoft also names the Microsoft 365 admin center as a second route. The steps according to Microsoft's help:

1. Open the mailboxIn the Exchange admin center, go to Recipients, Mailboxes and click the security mailbox.
2. Switch on forwardingUnder Mailbox, Email forwarding, click "Manage email forwarding" and turn on "Forward all emails sent to this mailbox".
3. Enter the target addressSelect "Forward to an external email address" and type in the target address.
4. Keep a copySelect "Deliver message to both forwarding address and mailbox" and save.

What to watch for: In Microsoft 365, automatic forwarding to external addresses is controlled by the outbound spam filter policy, with three values: "Automatic - System-controlled", "On - Forwarding is enabled" and "Off - Forwarding is disabled". According to Microsoft, the default "Automatic" has been equivalent to "Off" for new organisations since 2021. If forwarding is blocked, a non-delivery report with the code 5.7.520 comes back and the copy does not arrive. Microsoft recommends creating a separate outbound policy that allows forwarding only for the mailboxes that need it, in this case only the security mailbox. Remote domains and mail flow rules can also block forwarding; where one setting allows and another blocks, the block usually wins. An Inbox rule in Outlook is another route, but it is subject to the same policy.

Official help: Configure email forwarding for a mailbox in Exchange Online and Control external email forwarding (Microsoft Learn).

Google Workspace and Gmail

In Gmail, each person sets up forwarding for their own account, so for the security mailbox this happens in its Gmail settings. With automatic forwarding, Google forwards all new messages except spam. That is why a filter belongs with it. The steps according to Gmail Help:

1. Add a forwarding addressIn Gmail, open Settings, see all settings, choose the "Forwarding and POP/IMAP" tab and add a forwarding address.
2. Confirm the addressGmail sends a confirmation e-mail to the target address. With CRA Response Center it appears in the application next to the mailbox; open the confirmation link there.
3. Switch on forwardingBack in Gmail, reload the page, choose to forward a copy of incoming mail, select "Keep Gmail's copy in the Inbox" and click "Save Changes".
4. Create a filter against spamIn the search bar, open "Show search options", enter the security mailbox address in the To field, click "Create filter", tick "Never send it to Spam" and create the filter.

What to watch for: Without the filter, reports that Gmail considers spam stay in the Spam folder and never reach the target address. Short reports from unknown senders are particularly affected. Google describes a second route, a filter with the action "Forward it"; in that case, turn automatic forwarding off so that nothing arrives twice. In Google Workspace, the administration must allow automatic forwarding: in the Admin console under Apps, Google Workspace, Gmail, End User Access, Automatic forwarding, setting "Allow users to automatically forward incoming email". According to Google it is on by default. If it is off, forwarding is missing from the Gmail settings altogether.

Official help: Automatically forward Gmail messages to another account, Fix issues with valid emails in Spam (Gmail Help) and Let users automatically forward their own Gmail emails (Google Workspace Help).

IONOS

At IONOS, forwarding sits in the settings of the individual e-mail address. The steps according to IONOS Help:

1. Choose the addressLog in to IONOS, go to the Email section, select the right contract if you have several, and click the address of the security mailbox.
2. Add forwardingIn the settings, click Forwarding Address, then "Add Forwarding".
3. Enter the targetEnter the target address and click Next. According to IONOS, forwarding is active within a few minutes.

What to watch for: According to the German IONOS help, incoming e-mails stay in the mailbox as usual and a copy goes to the target. Up to ten targets are possible per address, so an existing forwarding stays in place when you add the target address.

Official help: Setting Up Forwarding for Email Addresses (IONOS Help).

Strato

Strato describes two routes: in the customer login through a filter on the mailbox, or in webmail through a rule. The steps in the customer login according to Strato's help (German labels, the help is only available in German):

1. Choose the mailboxIn the customer login, open the e-mail administration of the package, select the security mailbox and choose Filter bearbeiten (edit filter).
2. Create a ruleChoose Neu anlegen (create new), give the rule a name and set the condition to Alle E-Mails (all e-mails).
3. Enter the targetAs the action, choose Umleiten nach (redirect to), enter the target address and save.

What to watch for: Do not add a second action Verwerfen (discard), otherwise Strato deletes the e-mail from the mailbox after forwarding it. In webmail, the route is the gear icon, all settings, Mail, rules, add a new rule, with the action Umleiten nach; according to Strato the e-mails stay in the mailbox.

Official help: Setting up e-mail forwarding (Strato FAQ, in German).

All-Inkl

At All-Inkl, you create forwardings in the technical administration, KAS. The steps according to All-Inkl's tutorial:

1. Open the sectionLog in to KAS, choose Email in the menu and then Email Forwarding.
2. Create the forwardingChoose "Create a new email forwarding", enter the address of the security mailbox in the address field and the target address under "target 1". Further targets via "another forwarding target".
3. SaveAccording to All-Inkl, forwarding is active after about 5-15 minutes and shows "in progress" until then.

What to watch for: You cannot configure the spam filter of a forwarding yourself at All-Inkl; it is switched on automatically when the target is hosted externally, and KAS then shows a red icon. The tutorial does not say whether a copy remains in a mailbox with the same address. Check this with the test e-mail, and if the address previously went to an internal mailbox, keep that mailbox as one of the targets.

Official help: How to create an email forwarding (All-Inkl tutorials).

Plesk

Many hosts provide Plesk as their control panel. Forwarding is set there on the individual mail address. The steps according to the Plesk documentation:

1. Open the addressUnder Mail, select the address of the security mailbox and open the Forwarding tab.
2. Switch on forwardingTick "Switch on mail forwarding" and enter the target address.
3. Keep a copyLeave "Do not deliver copies of forwarded emails to the Plesk mailbox" unticked and save with OK.

What to watch for: By default, copies stay in the mailbox. How your host has set up the spam filter in front of Plesk varies; if in doubt, ask them whether e-mails are rejected or only marked.

Official help: Setting Up Mail Forwarding (Plesk Obsidian documentation).

cPanel

cPanel is another common control panel at hosts. Forwarding is called a forwarder there. The steps according to the cPanel documentation (localised interfaces translate the labels):

1. Open ForwardersIn the Forwarders section, choose the domain of the security mailbox under "Managing" and click "Add Forwarder".
2. Enter the addressUnder "Address to forward", enter the part before the @ and choose the domain from the Domain menu.
3. Enter the targetChoose "Forward to Email Address", enter the target address and save with "Add Forwarder".

What to watch for: According to cPanel, accounts with forwarding keep a copy. Do not choose the "Discard" option, which drops e-mails without telling the sender.

Official help: Forwarders (cPanel & WHM Documentation).

Exchange Server on premises

With Exchange Server 2016, 2019 and Subscription Edition, you set forwarding in the Exchange admin center or in the Exchange Management Shell. Microsoft points out that the admin center only offers recipients within your own organisation; for an external target address, the shell is the documented route.

1. Open the mailboxIn the Exchange admin center, go to Recipients, Mailboxes, select the security mailbox and click Edit.
2. Review forwardingUnder Mailbox Features, choose "View details" under Mail Flow. It shows whether and where e-mails are forwarded.
3. External address via the shellIn the Exchange Management Shell, use Set-Mailbox to set the target address as ForwardingSMTPAddress and set DeliverToMailboxAndForward to $True so that the e-mail also stays in the mailbox.

According to Microsoft's help, the command looks like this, with your values in place of the placeholders in angle brackets:

Set-Mailbox -Identity "<security mailbox>" -DeliverToMailboxAndForward $True -ForwardingSMTPAddress "<target address>"

What to watch for: Whether external forwarding is actually delivered also depends on the remote domain settings, on transport rules and on any spam filter in front. When your own mail server forwards, the sender check (SPF) can fail at the target; sender rewriting (SRS) on the server or the upstream gateway helps. Check the route with a test e-mail from outside.

Official help: Configure email forwarding for a mailbox (Microsoft Learn, Exchange Server).

Common mistakes

• No copy kept. The e-mail then exists only at the target address. If forwarding fails, it is missing from your own mailbox.
• Confirmation forgotten. In Gmail, forwarding only runs once the link in the confirmation e-mail has been opened.
• Spam gets stuck. Without a "Never send it to Spam" filter, Gmail does not forward spam. With other providers, the spam filter of the security mailbox should mark, not reject.
• External forwarding blocked. In Microsoft 365, the outbound spam policy often blocks it by default; the error code 5.7.520 shows this.
• Wrong mailbox. Forwarding is set on info@ or on a personal mailbox, but the reporting address in the security.txt is a different one.
• No test. A test e-mail from an external address, such as a private account, shows the whole route. An e-mail from inside your organisation often takes a different one.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Frequently asked questions

Further reading

• Spam in the security mailboxWhy the spam filter should mark rather than reject, and how to sort bulk mail.
• security.txt under RFC 9116 and BSI TR-03183-3The file through which reporters find your security mailbox.
• PSIRT for SMEsWho reads the mailbox, who assesses and who replies.

Sources

• Regulation (EU) 2024/2847, Article 13(17), Annex I, Part II, point 6, Publications Office of the EU, 20 November 2024.
• The providers' help pages are linked in each section, as of 20 October 2026.