ASD ISM 0574 Use SPF to authorise email servers
What it says
SPF is used to specify authorised email servers (or lack thereof) for an organisation's domains (including subdomains).
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSPF helps confirm which email servers are allowed to send emails for your organisation's domain.
The Sender Policy Framework (SPF) is a safety measure to make sure only approved email servers can send emails on behalf of your organisation. This helps prevent scammers from sending fake emails using your business name, which could damage your reputation and lead to people losing trust in your organisation.
Free. Save your status, tasks and notes.
Why it matters
Without SPF DNS records, attackers can spoof your domain in email, enabling phishing, fraud and reputational harm.
How to implement
The IT team should create a list of all email servers that are currently used by the organisation.
They can do this by checking the current email hosting service and any email services connected to the organisation's domain.
Once the list is created, the IT team should update the Domain Name System (DNS) settings for the organisation's domain to include an SPF record.
This record states which servers are authorised to send emails on behalf of the organisation.
The IT team should use an online SPF checker tool to ensure that the SPF record is correctly set up.
This tool will provide feedback on whether the record is configured properly to prevent unauthorised use.
Management should inform all staff of the importance of using authorised email servers only, to prevent any potential emailing through unauthorised systems.
This can be done through a quick training session or a company-wide email.
The IT team should routinely review and update the SPF record, especially when replacing or adding email servers, to ensure it continues to list only the authorised servers.
A regular check, perhaps quarterly, will keep it up to date.
Keep it running
Maintain SPF DNS TXT records for all domains/subdomains; update senders when mail services change and validate syntax/lookup limits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The DNS configuration file: Request a copy of the DNS settings for the organisation's domain.
Look at
The SPF record within the file.
Good evidence
The SPF record lists all current authorised email servers with a "v=spf1" identifier.
- Check 2 of 5What an auditor asks for
Ask for
Evidence of email server audits: Request documentation showing when and how often email server authorisations are reviewed.
Look at
The dates and outcomes of these reviews.
Good evidence
Documents show regular review dates with any amendments clearly noted and actioned.
- Check 3 of 5What an auditor asks for
Ask for
Staff about email server training: Request records of any staff training concerning email servers and SPF.
Look at
The attendance lists and training materials.
Good evidence
Training records indicate comprehensive sessions explaining the importance of authorised email servers.
- Check 4 of 5What an auditor asks for
Ask for
A test email sent from each authorised server: Request recent emails sent from listed servers to check that they aren't flagged as spam.
Look at
The email headers for SPF verification status.
Good evidence
Emails pass SPF checks and aren't marked as spam.
- Check 5 of 5What an auditor asks for
Ask for
Logs of rejected emails: Request logs from the email server showing attempts to send emails from unauthorised servers.
Look at
The frequency and server details of rejected attempts.
Good evidence
Logs show blocked attempts from servers not included in the SPF record.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-0574 requires SPF records to specify the authorised email servers (or the lack of any) for all of an organisation's domains and subdomains. This lets receiving parties authenticate email sent in the organisation's name, a specific control for securing electronic messaging, which is one of the transfer facilities Annex A 5.14 requires to be governed by transfer rules and procedures. Annex A 5.14 covers every type of information transfer, while ISM-0574 addresses only sender authorisation for email domains.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.