ASD ISM 1026 Verification of DKIM signatures on incoming emails
What it says
DKIM signatures on incoming emails are verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that DKIM signatures on received emails are checked to identify legitimate sources.
This control ensures that emails your organisation receives are verified to confirm they're from legitimate senders. This is important because if you don't check these email signatures, you might fall victim to scams or phishing attacks, thinking fraudulent emails are from trusted sources.
Free. Save your status, tasks and notes.
Why it matters
If DKIM on incoming mail is not verified, spoofed or tampered emails may be accepted, increasing phishing risk, fraud, and potential data compromise.
How to implement
IT teams should ensure the email system is set up to check DomainKeys Identified Mail (DKIM) signatures.
They can do this by configuring the email server settings to automatically verify these digital signatures whenever an email is received.
The IT manager should regularly update the email system to maintain its ability to verify DKIM signatures.
They can achieve this by scheduling monthly checks for any available updates or patches for the email software and applying them as needed.
The cyber security officer should provide training for staff on recognising the value of DKIM signatures.
This can be done using simple examples showing how verified emails appear different from non-verified ones, highlighting the 'trusted source' factor.
Business owners should have a policy in place that outlines the importance of DKIM signature verification for email security.
This policy should be communicated clearly to all staff during security briefings or through an internal memo.
System administrators should conduct tests on email systems to ensure DKIM signature verifications are functioning correctly.
They can do this by sending test emails with DKIM signatures from a legitimate source and confirming these are correctly recognised and marked by the email system.
Keep it running
Enforce DKIM verification on inbound gateways, alert on DKIM failures, and review signature failures by domain/selector to detect spoofing or misconfiguration quickly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The system configuration documentation: Confirm there are settings that specify the checking of DKIM signatures.
Look at
The sections describing email server options.
Good evidence
Is detailed yet straightforward documentation showing DKIM signature checks are enabled and active.
- Check 2 of 5What an auditor asks for
Look at
Timestamps and verification statuses.
Good evidence
Would show regular instances of signature checks happening as expected.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of system capabilities: Have someone from the IT team show the process of a DKIM signature being checked in real-time.
Look at
The screen while they open and verify a test email.
Good evidence
Is a step-by-step walkthrough showing the emails passing DKIM checks visibly.
- Check 4 of 5What an auditor asks for
Look at
Dates, attendee lists, and materials that discuss DKIM.
Good evidence
Includes up-to-date records that show ongoing efforts in educating staff about email security and DKIM's role.
- Check 5 of 5What an auditor asks for
Ask for
The email security policy document: Ensure it mentions DKIM signature verification and its importance.
Look at
A clear section or paragraph that references verification practices.
Good evidence
Is a policy document that outlines the need for and steps to verify DKIM signatures.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-1026 requires DKIM signatures on incoming emails to be verified, confirming that messages came from an authorised domain and were not altered in transit. This is a specific integrity and sender authentication measure for electronic messaging, one of the transfer facilities that Annex A 5.14 requires to be governed by information transfer rules and procedures. Annex A 5.14 is broader, covering all transfer types and agreements with other parties, while ISM-1026 addresses only verification of inbound email signatures.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.