diff --git a/modules/mail.nix b/modules/mail.nix
index 73cb32c..56cdc1b 100644
--- a/modules/mail.nix
+++ b/modules/mail.nix
@@ -177,6 +177,24 @@ in
       }
     '';
 
+    # Mail to forwarded addresses leaves again from our IP. Spam that would
+    # normally only be marked ("add header") is rejected instead, so we never
+    # pass it on to Gmail & co. under our own reputation. Rejecting during
+    # SMTP leaves the bounce to the sending server: no backscatter.
+    "settings.conf".text = lib.optionalString (settings.forwards != { }) ''
+      forwarded_recipients {
+        priority = high;
+        rcpt = ${builtins.toJSON (lib.attrNames settings.forwards)};
+        apply {
+          actions {
+            reject = ${toString settings.forwardRejectScore};
+            "add header" = null;
+            "rewrite subject" = null;
+          }
+        }
+      }
+    '';
+
     # Cap how much mail one authenticated account can send, so a leaked
     # password can't turn the server into a spam cannon (and get its IP
     # blocklisted).
diff --git a/settings.nix b/settings.nix
index 0f0cf85..2565a79 100644
--- a/settings.nix
+++ b/settings.nix
@@ -58,6 +58,9 @@
   # Forwarding breaks SPF; Sender Rewriting Scheme (SRS) is turned on
   # automatically when forwards exist, so forwarded mail still passes.
   forwards = { };
+  # Spam score at which mail to a forwarded address is rejected rather than
+  # passed on (Rspamd's normal "add header" threshold is 6).
+  forwardRejectScore = 6;
 
   # Contact address published in DMARC/TLS-RPT reports and used for the
   # Let's Encrypt account.