No easy way to restrict the creation of the mail rules without customising the mail template - however, you can disable the functionality at the server level. The setting is in your config doc under Router/SMTP->Restrictions and Controls->Delivery Controls

This option would prevent any mail forwarding rules from working, so yes, it would block internal forwarding too. I take it then it's just external mail forwarding you want blocked?

Hmm. That makes it a bit trickier. I don't think there's a setting for that, but here's something you can try - haven't tried it myself so I don't know if it will work or not:

First up, set the user forward rule return path to construct non-deliverable return addresses - if you're running 8.5, you can do this via the configuration document (the field is just below the one that disables mail rule forwarding). If you're pre-8.5, then you need to set the following parameter in the notes.ini:

RouterUserRuleForwardReversePath=3

What that does is prepends the outgoing e-mail address with 'nobounce' (so, in your example, it'd be nobouncedocternotes@acme.com).

Next, create a mail rule in your configuration document. If you have designated servers that deal with all internet e-mail, the rule should only need to be created on those servers. Set the criteria to:

When sender contains nobounce
AND To contains @
AND To contains .

That *should* limit the rule to messages sent to internet addresses via a mail forwarding rule - although you'd have to make sure your users were using the Notes address rather than the internet e-mail address in their rules. You can then set the action to 'Do Not Deliver' and either silently delete the message or send an NDR.

I'm sure there's probably a hole in my logic somewhere (and I'd like to think I've missed an easier way to do this) but I think this should sort you out.

My bad - rather than checking 'To' for @ and . you need to check 'All Recipients' - I've just tested it out here and it works quite nicely. Your rule should look like this:

When sender contains nobounce
AND any Recipient contains @
AND any Recipient contains .