ASD ISM 0861 Enable DKIM signing for organisational emails
What it says
DKIM signing is enabled on emails originating from an organisation's domains (including subdomains).
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure emails from your organisation's domains use DKIM to verify authenticity and prevent forgery.
This control means your organisation needs to use a security method called DKIM to ensure that emails sent from your business are genuine. It's like giving your emails a signature that proves they're really from you and not a scammer pretending to be you. If you don't do this, someone could fake emails from your domain, which might trick your customers or partners into providing sensitive information or making wrong decisions.
Free. Save your status, tasks and notes.
Why it matters
Without DKIM signing, attackers can spoof your domains, increasing phishing success and causing fraud, data loss, and reputational harm.
How to implement
IT team should enable DKIM for your organisation's email domain: This involves accessing your email provider's settings and turning on DKIM signing.
You'll need to update your Domain Name System (DNS) records with the details provided by your email service to activate DKIM.
System administrator should update DNS records: Once DKIM is enabled, the administrator must go to your domain host's website and add a DKIM record.
This record acts as a public key that email servers use to verify that your emails are authentic.
IT team should test DKIM configuration: After setting up DKIM, send a test email to a service that checks email authenticity.
Ensure the email passes the DKIM check, confirming it was signed correctly.
IT manager should educate employees about DKIM: Conduct a short session with staff explaining how DKIM protects the organisation.
Explain that this helps prevent email scams and that they should report suspicious emails even with DKIM in place.
IT team should monitor DKIM performance: Set up regular monitoring to ensure DKIM is functioning as expected.
Use tools that alert you if there's an issue with email signing, so you can act swiftly.
Keep it running
Regularly audit DKIM selectors/keys for all domains and rotate keys; monitor DNS and mail gateway changes to detect unauthorised DKIM disablement.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The DNS records for DKIM: Request a screenshot or a printout of your DNS records showing the DKIM settings.
Look at
The configuration details in the email server: Verify that DKIM is set up and actively enabled for all emails.
Good evidence
Setup will show that DKIM signing is turned on for each relevant domain.
- Check 2 of 3What an auditor asks for
Ask for
Logs or reports on email deliveries: Check the logs for indications that emails are being signed with DKIM. Good logs will show DKIM 'passed' statuses for sent emails.
- Check 3 of 3What an auditor asks for
Ask for
To see the DKIM policy document.
Look at
A document detailing when DKIM was implemented and how it is maintained. A robust policy will include clear maintenance schedules and responsible parties.
Good evidence
Will include dates and topics covered in these educational sessions.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-0861 requires DKIM signing on all emails sent from an organisation's domains and subdomains, so recipients can verify that messages genuinely originated from the organisation and were not altered in transit. This is a specific technical measure for the secure transfer of information by electronic messaging, which Annex A 5.14 requires the organisation to govern through transfer rules, procedures or agreements. Annex A 5.14 is much broader, covering all transfer facilities and parties, while ISM-0861 addresses only sender authentication and integrity for outbound email.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.