Skip to content
Email
ASD ISMISM-1027

ASD ISM 1027 Configure email distribution lists to preserve DKIM signatures

What it says

Email distribution list applications used by external senders is configured such that it does not break the validity of the sender's DKIM signature.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure email lists don't invalidate DKIM signatures from external senders.

This control ensures that when you send emails through a group email list, the original email's authenticity isn't messed up. Why does this matter? If the DKIM signature isn't preserved, important emails might end up in spam folders or could be tampered with, which could damage trust and communication with your clients.

Why it matters

Compromised DKIM signatures can result in legitimate emails being marked as spam or malicious, damaging client trust and disrupting communication channels.

How to implement

  1. The IT team should review how email distribution lists are set up.

    They need to make sure that when emails are sent through these lists, the DKIM signature from the original sender remains intact. This can be done by avoiding changes to the email content or headers that might invalidate the DKIM signature.

  2. System administrators should enable email gateway features that support DKIM.

    They need to configure these settings to ensure DKIM signatures are verified and not altered, which means setting parameters to leave the signed portions of emails unchanged.

  3. The IT department should work with the email service provider to understand DKIM requirements.

    They should confirm the provider supports DKIM and discuss ways to maintain integrity when emails pass through distribution lists. This could involve reviewing the provider's best practices or configuration options.

  4. Business managers should periodically check how external emails are managed by the office email system.

    They should work with the IT team to test sending emails through distribution lists and confirm the DKIM signature is preserved. This involves sending a test email and checking the headers for the DKIM signature.

  5. Email administrators should educate staff on the importance of DKIM and its role in email security.

    They should provide basic guidance on how email distribution lists should be used to avoid issues that can lead to DKIM signature problems, such as unnecessary editing of forwarded emails.

Keep it running

Regularly test distribution list behaviour to ensure forwarded mail preserves DKIM validity and avoids header/body rewrites that invalidate signatures.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The email distribution list configuration settings: Request a detailed configuration report from the IT team.

    Look at

    Settings related to DKIM preservation and any rules that affect email integrity.

    Good evidence

    Will show settings that explicitly mention preserving email headers and content.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Logs of email transmissions through distribution lists: Request a log showing emails sent through lists.

    Look at

    The DKIM signatures before and after transmission to ensure they remain valid.

    Good evidence

    Will indicate no changes to DKIM signatures.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Documentation on email provider details: Request material that confirms the email service's support for DKIM.

    Look at

    Service provider agreements or user manuals explaining DKIM handling.

    Good evidence

    Will have clear provider documentation on how DKIM is maintained.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Records of employee training on email handling: Request records of training sessions on preserving email integrity.

    Look at

    Attendance lists and training content.

    Good evidence

    Will have evidence of recent training that included DKIM and email handling best practices.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A report from a recent email security review: Request a report showing a security audit of the organisation's email practices.

    Look at

    The findings on DKIM signature management and suggested improvements.

    Good evidence

    Will show a review date and corrective actions taken.

Mappings

Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.9Configuration management for secure IT systemsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.