What you’re seeing
- The person who set up forwarding receives a bounce with 5.7.520 saying access is denied because the organization does not allow external forwarding.
- Forwarded copies never reach the personal, partner or accountant's address even though the rule appears to be active.
- Forwarding works to colleagues inside the company but not to anyone outside it.
- It stopped working without any change by the user, often after a security update to the tenant.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The Microsoft 365 outbound spam policy blocks automatic external forwarding, which is now the default setting.
- A transport rule or security baseline was added that rejects auto-forwarded messages to outside domains.
- The forwarding was configured as an inbox rule, which is subject to the same block as mailbox-level forwarding.
- A remote domain setting prevents automatic forwarding to that particular destination.
Why it matters
Automatic forwarding to outside addresses is one of the first things attackers set up after compromising an account, because it quietly copies every incoming message to them. That is why Microsoft blocks it by default. When legitimate forwarding is blocked, a manager may stop seeing customer requests, or an outsourced bookkeeper may miss invoices. The business decision is how to balance that convenience against the real risk of data quietly leaving the company.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Is it safe to allow forwarding for just one person?
It can be done narrowly for specific users or destinations rather than for everyone. Our engineer will explain the trade-offs so you can decide what fits your compliance needs.
Could this block mean an account was compromised?
Sometimes. If nobody remembers creating the forwarding rule, it is worth treating as a possible break-in, and we review recent sign-in activity as part of the investigation.