Exchange transport rule analyzer

Paste Exchange transport rules to find auto-forwarding and BCC to external addresses, and unconditional rules.

Runs in your browser · nothing is sentMicrosoft 365New

Everything runs in your browser. Nothing is sent anywhere, including rule names and email addresses in your export.

Transport rules (JSON)

Run "Get-TransportRule | ConvertTo-Json -Depth 5" in Exchange Online PowerShell and paste the result here.

Your accepted domains (comma-separated)

Needed to tell internal addresses apart from external ones for the forwarding and BCC checks. Run "Get-AcceptedDomain | Select DomainName" to list yours. Without this, those two checks are skipped.

How to use

Run "Get-TransportRule | ConvertTo-Json -Depth 5" in Exchange Online PowerShell.
Run "Get-AcceptedDomain | Select DomainName" and note your domains.
Paste both into the tool.
Review the findings and the rule table, then export the report if needed.

Common scenarios

Investigating a suspected mailbox compromise

Check whether any rule was added that forwards or BCCs mail from the affected mailbox to an address outside your organization.

Auditing mail flow rules before a security review

Export all transport rules and confirm none of them are unconditional, left in audit-only mode by mistake, or quietly copying mail externally.

About this tool

Run "Get-TransportRule | ConvertTo-Json" in Exchange Online PowerShell and paste the result here, along with your accepted domains, and the tool checks every rule for patterns commonly used to quietly exfiltrate mail: automatic forwarding to an address outside your organization, a blind or regular copy sent to an external address, and rules with no condition at all that still forward, delete or otherwise act on every message that reaches them. It also flags rules left in audit-only mode and disabled rules, both easy to forget about. Everything runs locally; rule names and addresses never leave your browser.

🔒 Your input stays in your browser and is never sent anywhere.

Frequently asked questions

Does this connect to my Exchange organization?

No. There are no credentials and no API calls. You export the rules yourself with Exchange Online PowerShell and paste the JSON here.

Why do I need to enter my accepted domains?

The tool needs to know which addresses are "yours" to tell a normal internal forward from exfiltration to an outside address. Without this, the auto-forward and BCC checks are skipped rather than guessed, since getting that distinction wrong would be worse than not checking at all.

Why is an unconditional rule flagged even if it looks harmless?

Microsoft's own documentation warns that a rule without any "When" condition applies its action to every message that reaches it, inbound and outbound, across the whole organization. That is usually far broader than intended, especially for destructive actions like deleting or forwarding mail.

Does this check inbox rules too?

No, only organization-wide transport rules (mail flow rules), not a specific mailbox's personal inbox rules, which are a different, per-user setting.

What to do next

Also useful

Entra ID Conditional Access analyzerPaste exported Conditional Access policies to check for missing admin MFA, unblocked legacy auth and overly broad scopes.
DKIM checkerCheck a DKIM record for a selector: key type and length, testing mode and revoked keys. Look up selector._domainkey.domain in DNS or paste the record.
DMARC analyzerCheck a DMARC record: policy, subdomain policy, pct and report addresses, with a diagram of what receivers do. Look it up in DNS or paste records.
Email header analyzerPaste email headers to see the delivery path, SPF, DKIM and DMARC results, and spot spoofing signs like a mismatched From domain.
SPF analyzerCheck an SPF record: lookup count against the limit of 10, include chain, -all vs ~all and risky IP ranges. Look it up in DNS or paste records.

Found a problem or have a suggestion? Tell us