How email forwarding works — and why it matters for privacy

Email forwarding is one of those things most people have heard of but rarely think about. It's simple in concept — email arrives at one address, gets redirected to another — but the detail of how it works, and the privacy implications, are worth understanding.

The basics: what email forwarding does

When email forwarding is set up on an address, any message that arrives there is automatically sent on to a second address. The original recipient address still receives the email, but it also triggers a copy being delivered elsewhere.

From the sender's point of view, nothing unusual happens. They sent an email to an address. It was delivered. They have no visibility into what happens next.

From the receiver's point of view, the email arrives in the destination inbox. Depending on how the forwarding is set up, it may arrive exactly as sent, or with some headers modified to show it came via a different address.

How it works technically

Email delivery uses a protocol called SMTP (Simple Mail Transfer Protocol). When a message is sent, it travels between mail servers — the sender's outgoing server hands it off to the recipient's incoming server, which accepts delivery and places it in the inbox.

Forwarding adds a step. When the receiving mail server accepts an email, instead of (or in addition to) placing it in the inbox, it issues a new SMTP delivery attempt to a different address. The forwarding server acts as an intermediary — it received the original, and now sends on a copy.

What happens to the headers — the metadata like From, To, Reply-To, and the routing trail — depends on the forwarding configuration:

• Simple forwarding passes the original message mostly intact, with the recipient address changed to the destination. The From field still shows the original sender.
• Rewriting forwarding modifies some headers — for example, adding a note that it was forwarded via a particular address — to preserve deliverability and help spam filters understand the routing.

Types of email forwarding

Account-level forwarding

Most email providers let you set up forwarding within your account settings. Gmail, Outlook, and most others offer this. You configure a destination address, and from that point on, every email that arrives in that account is forwarded on.

This is useful if you're moving providers, consolidating multiple accounts into one inbox, or just want a copy of everything landing somewhere else.

Domain-level forwarding

If you own a domain, you can set up forwarding rules at the domain level — so any email sent to any address at that domain is forwarded to a destination. This is often managed through your domain registrar or DNS provider.

Cloudflare, for example, offers email routing as part of its DNS management. You define rules: email sent to contact@yourdomain.com goes to your personal Gmail. Email sent to orders@yourdomain.com goes to a different address. It's flexible and free at the basic level.

Alias-based forwarding

This is the most privacy-oriented type. Instead of forwarding everything from a single account, you create individual aliases — each one a separate address that forwards to your real inbox. You control each alias individually: you can pause it, delete it, or let it run.

The key difference from account-level forwarding is granularity. You're not forwarding everything — you're creating specific, disposable addresses that each serve a particular purpose. When one gets spammed or compromised, you delete it without affecting anything else.

Does the original sender know their email was forwarded?

No. There's nothing in the standard email protocols that notifies a sender when their message is forwarded. They sent an email, it was delivered, and that's all they see. Whether you read it in the original inbox, a forwarded inbox, or both — they have no way to tell.

This is fundamental to how forwarding-based privacy tools work. The alias address receives the email, forwards it to you, and the sender is never informed about either the forwarding or your real address.

What about spam filters and deliverability?

This is a practical concern with email forwarding. When an email is forwarded, it arrives at the destination inbox from the forwarding server — not from the original sender. Some spam filters flag this because the message appears to be coming from an unexpected source.

Well-configured forwarding services handle this through a standard called SRS (Sender Rewriting Scheme), which rewrites the envelope sender address to preserve deliverability. Services designed for forwarding also implement DKIM and SPF correctly to avoid being flagged as suspicious.

In practice, forwarded emails from established providers arrive cleanly. Forwarding you set up yourself on a small domain may require some configuration to achieve the same result.

Forwarding vs fetching: what's the difference?

Some people consolidate email not through forwarding but through POP3 or IMAP fetching — where a destination inbox periodically connects to a source account and pulls down messages. This is different from forwarding.

Fetching is slower (messages only arrive when the fetch cycle runs, typically every few minutes), requires your destination provider to know the credentials for the source account, and works at the account level rather than the address level. Forwarding is real-time and requires no credential sharing.

For privacy use cases, forwarding is nearly always the right choice.

Why email forwarding matters for privacy

The privacy value of forwarding is straightforward: it lets you give out one address while receiving at another. The address you share publicly, or with a service you're not certain about, never has to be the same address tied to your identity, your recovery options, or your primary communications.

Combined with aliases — so each service gets a unique, purpose-built forwarding address — you also gain traceability. If a service leaks or sells your data and spam starts arriving, the alias it arrives on tells you exactly where the leak came from.

And critically: when you've had enough, you delete the alias. The forwarding stops. The sender — whether a legitimate company or a spammer — gets a bounce, and nothing reaches you again. You don't need to change your real address, notify anyone who has it legitimately, or manage any complex filters. One click, and it's done.

SMS forwarding: the same idea, for your phone number

The same principle applies to phone numbers. A virtual UK number receives texts and forwards them — as emails — to your real inbox. The sender has your Privify number; they don't have your real mobile. If the number starts receiving unwanted contacts, it can be replaced without affecting your actual phone.

Privify offers both: email aliases for your inbox, and a private UK number for SMS. Both forward to wherever you already receive messages. Neither requires anything to be installed or a new app to check.