ASD ISM 1026Verification of DKIM Signatures on Incoming Emails
Official control statement
DKIM signatures on incoming emails are verified.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure that DKIM signatures on received emails are checked to identify legitimate sources.
What this means in practice
This control ensures that emails your organisation receives are verified to confirm they're from legitimate senders. This is important because if you don't check these email signatures, you might fall victim to scams or phishing attacks, thinking fraudulent emails are from trusted sources.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Detective
Classifications
NC, OS, P, S, TS
ISM last updated
June 2023
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
If DKIM on incoming mail is not verified, spoofed or tampered emails may be accepted, increasing phishing risk, fraud, and potential data compromise.
Operational notes
Enforce DKIM verification on inbound gateways, alert on DKIM failures, and review signature failures by domain/selector to detect spoofing or misconfiguration quickly.
Implementation tips
- IT teams should ensure the email system is set up to check DomainKeys Identified Mail (DKIM) signatures. They can do this by configuring the email server settings to automatically verify these digital signatures whenever an email is received.
- The IT manager should regularly update the email system to maintain its ability to verify DKIM signatures. They can achieve this by scheduling monthly checks for any available updates or patches for the email software and applying them as needed.
- The cyber security officer should provide training for staff on recognising the value of DKIM signatures. This can be done using simple examples showing how verified emails appear different from non-verified ones, highlighting the 'trusted source' factor.
- Business owners should have a policy in place that outlines the importance of DKIM signature verification for email security. This policy should be communicated clearly to all staff during security briefings or through an internal memo.
- System administrators should conduct tests on email systems to ensure DKIM signature verifications are functioning correctly. They can do this by sending test emails with DKIM signatures from a legitimate source and confirming these are correctly recognised and marked by the email system.
Audit / evidence tips
- AskThe system configuration documentation: Confirm there are settings that specify the checking of DKIM signaturesLook atThe sections describing email server optionsGoodIs detailed yet straightforward documentation showing DKIM signature checks are enabled and active
- Look atTimestamps and verification statusesGoodWould show regular instances of signature checks happening as expected
- AskA demonstration of system capabilities: Have someone from the IT team show the process of a DKIM signature being checked in real-timeLook atThe screen while they open and verify a test emailGoodIs a step-by-step walkthrough showing the emails passing DKIM checks visibly
- Look atDates, attendee lists, and materials that discuss DKIMGoodIncludes up-to-date records that show ongoing efforts in educating staff about email security and DKIM's role
- AskThe email security policy document: Ensure it mentions DKIM signature verification and its importanceLook atA clear section or paragraph that references verification practicesGoodIs a policy document that outlines the need for and steps to verify DKIM signatures
Cross-framework mappings
How ISM-1026 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 5.14 | ISM-1026 requires DKIM signatures on incoming emails to be verified, confirming that messages came from an authorised domain and were not... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Email
See all Guidelines for email controls, or browse the full ASD ISM library.