Question: How do I set up email forwarding and routing in Google Workspace?

Explanation: Email forwarding and routing are the ways in which Google Workspace lets you control what happens to incoming mail before it lands in a mailbox. Forwarding redirects mail to another address, while routing operates at a deeper level where you can define per rule whether a message gets forwarded, copied, redirected, filtered, or delivered via a specific route.

Both methods are crucial for scenarios such as: an employee leaving whose mail should go to a colleague, a general department mailbox that needs to reach multiple people, mail that needs to go to an external helpdesk or ticketing system, or compliance requirements where certain messages must travel via a secure route.

info
The difference between forwarding, routing and filters
Google Workspace has three ways to handle mail differently, and it matters which one you choose:
  • User-level forwarding is the simple option that the user sets up in their own Gmail settings. One address at a time and only for their own inbox.
  • User-level filters work within Gmail and can forward mail based on rules (such as sender, subject, label) to another address. Also only for the user's own inbox.
  • Organisation-level routing is an administrator setting in the Admin Console. Here you can determine at the domain level what happens with incoming mail, for one user, a group, an OU or the entire organisation. Routing rules run before mail reaches a user's mailbox, so also before the user's Gmail filters.
warning
Forwarding can break SPF
When a mail is forwarded, the sending server changes while the original From address stays the same. The receiving system then sees a server that isn't listed in the SPF record of the sender, causing the SPF check to fail. DKIM remains valid, because the signature is tied to the content of the email. This is an important reason to properly configure DKIM and DMARC for sending domains alongside SPF, especially as the Google and Yahoo bulk sender requirements from 2024 have been further tightened in 2026.

Solution:

There are five ways to set up email forwarding or routing in Google Workspace, in order of complexity:

person1. User-level forwarding
The user configures one forwarding address in their Gmail settings. Simple, but limited to one destination and depends on the user setting it up.
filter_alt2. Forwarding via Gmail filters
The user creates a filter on sender, subject or keyword and forwards only specific messages. Suitable for targeted forwarding actions.
admin_panel_settings3. Admin forwarding via recipient address map
Admin creates an organisation-level mapping that redirects incoming mail from address A to address B. Suitable for departed employees and redirections at scale.
alt_route4. Routing rules in the Admin Console
Advanced rules based on sender, recipient, subject, attachments or content. Suitable for compliance, dual delivery and rules per OU.
settings_ethernet5. Default routing
The domain-wide default rule that determines what happens to mail sent to unknown addresses (catch-all) or that delivers all mail to a second mail system.
1
Allow or block user-level forwarding
Before users can set up their own forwarding in Gmail, you need to allow it at the organisation level. By default it's enabled, but in many managed environments it's switched off to prevent data leaks.

In the Admin Console go to:

Appsarrow_forward_iosGoogle Workspacearrow_forward_iosGmailarrow_forward_iosEnd User Access

Locate the setting Automatic forwarding:

  • On: users can set up their own forwarding in Gmail settings.
  • Off: only administrators can set up forwarding/routing via the Admin Console. Strongly recommended for organisations with sensitive data, to prevent a compromised account from exfiltrating mail to an external address.
lightbulb
Want to let users use forwarding, but only to internal addresses? Combine this setting with a Compliance rule under Routing that blocks outgoing forwards to external addresses.
2
User-level forwarding (set up by the user)
The user does the following:
  • Open Gmail and click the gear icon in the top right, then See all settings.
  • Go to the Forwarding and POP/IMAP tab.
  • Click Add a forwarding address and enter the destination address.
  • Google sends a verification email to that address. The recipient must click the confirmation link before forwarding becomes active.
  • Then choose what should happen with the original: keep in Inbox, mark as read, archive or delete.
warning
With this method you can only set up one forwarding address per user account. Want to forward to multiple addresses? Use filters or organisation-level routing.
3
Forwarding via Gmail filters for specific messages
When the user doesn't want to forward all mail but only messages from a particular sender, with a specific subject or with attachments:
  • In Gmail, click the filter icon in the search bar.
  • Fill in criteria (from, to, subject, contains words, has attachment, larger than size, etcetera).
  • Click Create filter.
  • Tick Forward it to: and pick a verified forwarding address from the dropdown.
  • Click Create filter to save the rule.
lightbulb
Forwarding addresses must first be added and verified via step 2 before they show up in the filter dropdown.
4
Admin forwarding via recipient address map (Routing)
This is the recommended method when an employee has left, is on leave, or when you structurally want to send mail from address A to address B. It's a transparent redirect at the domain level that the user can't disable.

In the Admin Console go to:

Appsarrow_forward_iosGoogle Workspacearrow_forward_iosGmailarrow_forward_iosRouting
warning
Pay attention: you need Routing, not Default routing. These are two different sections on the same page, just a short scroll apart. Recipient address map sits under Routing.
  • In the top left select the top-level organizational unit (the mapping must be created at organisation level, not on a sub-OU).
  • Scroll to Email forwarding using recipient address map and click Configure or Add Another Rule.
  • Give the rule a recognisable name, for example Departed: John Smith to Mary Jones.
  • Under step 1 click Add. Under Address enter the original address (for example john@yourdomain.com) and under Map to address the new address (for example mary@yourdomain.com).
  • Repeat for additional mappings. A single rule can hold up to 5,000 mappings, or you spread them across multiple rules.

Below the mappings choose the behaviour of the rule:

  • Exclude original recipient (redirect): The mail goes only to the new address. The original mailbox receives nothing. Use this for departed employees.
  • Include original recipient (forward): The mail goes to both the original and the new address. Use this for employees on leave, so they get their mail back when they return.

Additional options you can tick:

  • All incoming messages or Only external incoming messages: determines whether internal mail (from colleagues) is also forwarded or not.
  • Add X-Gm-Original-To header: adds a header that contains the original recipient address. Very useful for the recipient to see that the message wasn't originally meant for them, and for automated filtering on the receiving end.

Finally click Save. Changes can take up to 24 hours but are usually active within minutes.

5
Import mappings in bulk for large redirections
For large migrations or many departing employees at once, you don't want to enter 500 mappings one by one. Use the bulk add option:
  • Follow the recipient address map steps as above.
  • At the mapping step click Bulk Add.
  • Paste one entry per line: original address, comma, new address. For example: john@yourdomain.com, archive@yourdomain.com.
  • One mapping per line, no extra spaces.
  • Click Add aliases.

Maximum: 5,000 mappings per address map. Spread larger migrations across multiple rules.

6
Advanced routing rules (compliance, content, attachments)
For situations where you don't only want to route on address but also on content (for example: all mail with a national ID number must travel via a TLS route, or mail with attachments larger than 50 MB must be rejected) use the main Routing setting.

In the Admin Console go to:

Appsarrow_forward_iosGoogle Workspacearrow_forward_iosGmailarrow_forward_iosRouting

Scroll to Routing (the main routing setting, not the address map) and click Configure or Add Another Rule. You can configure among other things:

  • Which messages the rule should match: incoming, outgoing, internal, on sender, on recipient, on subject, on content.
  • Which action should be taken: modify message (add header, change subject, change envelope recipient), redirect, add a blind carbon copy, or reject with a specific error message.
  • Also deliver to: copy mail to a second inbox, useful for archiving, audit or monitoring.
  • Compliance routing: send via a TLS-required route, or reject messages that don't meet requirements.
lightbulb
Rules are executed from top to bottom. Always put specific rules at the top and generic rules at the bottom. If you have an existing list and add a rule later, always check whether the order still makes sense.
7
Default routing for catch-all and dual delivery
Default routing is the base rule that determines what happens with mail not caught by another rule. Two common use cases:

Catch-all setup (send all mail to an unknown address within your domain to one central mailbox):

  • Go to
    Appsarrow_forward_iosGoogle Workspacearrow_forward_iosGmailarrow_forward_iosDefault routing
    .
  • Click Add Another Rule.
  • Under Specify envelope recipients to match choose All recipients or Pattern match on your domain.
  • Under If the envelope matches, do the following choose Modify message, scroll to Change Envelope Recipient, tick it and enter your catch-all address (for example unknown@yourdomain.com).
  • Under Account types to affect tick Unrecognized/Catchall so the rule applies only to addresses that don't belong to a real user.
  • Save.

Dual delivery setup (duplicate all incoming mail to a second mail system, for example for migration or audit):

  • Create a Default routing rule that matches All recipients.
  • Under the action choose Also deliver to and add the second address or mail system.
  • Save.
warning
Dual delivery consumes additional mailbox space and may lead to duplicate notifications in both systems. Use this only for temporary migrations or compliance purposes, not as a permanent solution.
8
Test the configuration and monitor with Email Log Search
After saving a rule it can take up to 24 hours, but most rules are active within minutes. Always test by:
  • Sending a test message from an external mailbox (for example a Gmail.com personal address) to the original address.
  • Verifying that it arrives at the correct destination address.
  • Checking, for forwards, whether the X-Gm-Original-To header is present.
  • For compliance rules, checking whether the TLS-required route is actually used by sending a mail to a test domain without TLS.

For deeper diagnostics use the Admin Console:

Reportingarrow_forward_iosAudit and investigationarrow_forward_iosEmail log events

Search by sender, recipient or subject to see how a specific message was processed by Google's system: which rules were applied, which route was chosen, and any error codes.

check_circle
Email Log Search is your most important troubleshooting tool for routing. When a user reports that mail isn't arriving or ends up at the wrong address, start here. It shows you step by step why a message was routed the way it was.

Specific configurations

info
Departed employees
A very common need. Recommended approach:
  • Set the mailbox first to Forward (Include original recipient) or Redirect (Exclude original recipient) via recipient address map, depending on whether the employee still needs to be able to read the mail.
  • Keep the mailbox for at least 6-12 months instead of deleting it immediately, for situations where old mail turns out to be needed later.
  • Communicate to customers and contacts that the address is no longer in use. An auto-reply on the old address with the new contact address is often useful alongside the redirect.
  • For compliance: keep the mailbox as an archive licence (Archived User licence in Google Workspace), which is cheaper than a full licence.
info
General department addresses (info@, sales@, support@)
For addresses that need to reach multiple people, three options:
  • Google Group (recommended): create a group via Apps > Groups. Everyone who is a member receives a copy. Advantage: members are easy to add or remove, and the group can have its own settings (moderation, internal senders only, etcetera).
  • Recipient address map with multiple mappings: forward info@yourdomain.com to anne@yourdomain.com, bart@yourdomain.com and chris@yourdomain.com. Works, but less flexible than a Group.
  • Shared inbox via a ticketing system (Help Scout, Front, Zendesk): route support@yourdomain.com via Default routing or a routing rule to the inbox URL of the ticketing system.
info
Forwarding to a ticketing system (Help Scout, Zendesk, Freshdesk)
External ticketing systems usually use a unique email address per inbox. Configuration:
  • Go to
    Appsarrow_forward_iosGoogle Workspacearrow_forward_iosGmailarrow_forward_iosDefault routing
    .
  • Click Add Another Rule.
  • Under Specify envelope recipients to match choose Single recipient and enter the address you're redirecting, for example support@yourdomain.com.
  • Under Action choose Modify message, scroll to Change Envelope Recipient, tick it and paste the unique ticket inbox address of the system.
  • Also tick Bypass spam filter for this message so legitimate customer mail isn't held back by double spam filters.
  • Save.

Common mistakes and how to avoid them

  • Creating mail loops. When address A forwards to address B and B accidentally forwards back to A, an endless loop forms. Google usually detects this and breaks the chain, but always plan your forwarding chain on paper before activating it.
  • Setting up routing in the wrong place. Default routing and Routing look almost identical and live on the same page. Default routing applies to all mail not caught by a more specific rule. Routing is for specific rules. Check upfront: am I in the right section?
  • Order of routing rules. Rules are executed from top to bottom. Always put specific rules at the top and generic rules at the bottom. Wrong order means a rule you created might never run.
  • External forwarding without DKIM. When you forward mail from your Workspace to an external address (for example a Hotmail or personal Gmail), SPF can break. Make sure the original sender domain has DKIM, otherwise much mail lands in the destination's spam folder.
  • Leaving forwarding active for departed employees without an end date. Plan an end date (for example 6 months) after which the forwarding rule is automatically cleaned up. Google has no built-in reminder for this, so put it in your admin calendar.
  • Routing rule that is accidentally too broad. Create a rule that "all mail with subject 'invoice' must go to accounting" and suddenly spam and newsletters about invoicing also end up in accounting. Be specific in rules, preferably use sender criteria alongside content.
  • Forgetting the X-Gm-Original-To header. When a recipient suddenly gets mail that wasn't originally intended for them, it leads to confusion. With this header, the recipient or their mail client knows that the message came via a redirect, and can filter on it specifically.