ASD ISM 0567 Restrict email relay to specific domains
What it says
Email servers only relay emails destined for or originating from their domains (including subdomains).
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure email servers only relay emails within their own domains to prevent misuse.
This control ensures your email server only sends or accepts emails from your specific organisation's domain, like yourcompany.com, including subdomains. It prevents outsiders from using your email server without permission, which could lead to spam or fraudulent emails being sent from your address, damaging your reputation and clogging up your system.
Free. Save your status, tasks and notes.
Why it matters
If relay isn't restricted to your own domains/subdomains, attackers can abuse the server as an open relay for spam/phishing, damaging your organisation's reputation.
How to implement
IT team should configure the email server settings to restrict email relay.
This means setting rules so that emails can only be sent or received if they're from the same domain, like 'yourcompany.com'. This can often be done through server management software or by contacting your email service provider for guidance.
System administrators should test the configured email relays.
They can do this by trying to send an email from an external domain through the server and ensuring it's blocked. If it succeeds, further adjustments are needed to tighten the settings.
Office manager should communicate the importance of this control to all staff.
They should organise a short info session explaining why emails should remain within company domains to prevent misuse and avoid external threats.
Procurement should ensure all new email server solutions include easy-to-use relay restrictions as part of their features.
This involves checking with vendors on how they handle domain restrictions during the purchasing process.
The IT team needs to regularly review and update relay settings.
This involves checking for system updates or changes in company domains and adjusting restrictions accordingly to maintain security.
Keep it running
Review SMTP logs for unauthorised relay attempts and regularly verify allowed sender/recipient domains (incl. subdomains) so relay rules stay aligned to current domain settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The email server configuration document: Request the documentation detailing how the server is set up to restrict email relays to specific domains.
Look at
Specific settings that limit email relays to 'yourcompany.com' and any subdomains.
Good evidence
Clear documentation showing these settings are active and configured correctly.
- Check 2 of 5What an auditor asks for
Ask for
Evidence that tests have been conducted to check the restriction's effectiveness.
Look at
The test results for successful blocks of non-company domain emails.
Good evidence
A document showing blocked attempts from outside domains.
- Check 3 of 5What an auditor asks for
Ask for
To see the email server's access logs: Request logs that show email traffic on the server. Look to confirm that relays attempt from outside domains are rejected.
Good evidence
Logs showing zero successful relays from external domains.
- Check 4 of 5What an auditor asks for
Ask for
Proof of the office manager's session with staff about the relay policy.
Look at
Meeting minutes or notes.
Good evidence
Records showing the session was conducted and key points discussed.
- Check 5 of 5What an auditor asks for
Ask for
Vendor communication records: Request any communications with vendors regarding email server purchases and configuration inquiries.
Look at
Discussions about domain restriction features.
Good evidence
Records showing vendor confirmation of domain relay restrictions in the purchased system.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-0567 requires email servers to be configured so they only relay emails destined for or originating from the organisation's own domains (including subdomains), preventing open relay misuse. ISO/IEC 27001:2022 Annex A 8.9 requires configuration management across IT systems, under which implementing and maintaining secure mail transfer agent (MTA) relay restrictions is a concrete configuration baseline item. Annex A 8.9 is broader (covering all system configurations and their governance), while ISM-0567 is a specific mail-server configuration requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.