Skip to content
Email
ASD ISMISM-1151

ASD ISM 1151 Verify email authenticity using SPF

What it says

SPF is used to verify the authenticity of incoming emails.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

SPF helps confirm if an email really comes from who it claims to, preventing fake emails.

The 'Verify Email Authenticity Using SPF' control is about ensuring that emails you receive are truly from who they claim to be, rather than from a scammer or hacker impersonating someone else. This matters because fake emails could trick you into revealing sensitive information or downloading harmful software, potentially leading to data breaches or financial loss.

Why it matters

Without SPF checks, attackers can spoof your domain in inbound email, increasing successful phishing, fraud, and data compromise.

How to implement

  1. IT team should configure the email server to use SPF.

    This involves setting up SPF records in your domain's DNS settings to specify which email servers are permitted to send emails on behalf of your domain. Use a simple guide from the Australian Cyber Security Centre (ACSC) to make sure everything is set up correctly.

  2. Email administrators should regularly update the SPF records.

    Whenever new email services or third parties are used to send email on your behalf, ensure these are added to the SPF record. This will prevent delivery issues and maintain security.

  3. Managers should educate staff on the importance of email authentication.

    Conduct training sessions to inform employees about how SPF works as a first line of defence against phishing attacks. Provide examples of what legitimate email looks like.

  4. IT support should monitor for SPF-related errors.

    Use email gateway reports and alerts to identify and address any issues with non-compliant SPF senders. This ensures legitimate emails aren't accidentally blocked.

Keep it running

Maintain an accurate SPF TXT record for your domain, update it when senders change, and keep DNS lookups within SPF limits.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The current SPF record configuration: Request access to the DNS settings that show the SPF records.

    Look at

    Details on authorised IP addresses or servers marked in the records.

    Good evidence

    An inclusive list of only those services that legitimately send emails for the organisation.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Email gateway logs that track SPF failures: Check if rejected emails due to incorrect SPF configurations are documented.

    Look at

    Timestamps and the supposed sender's information.

    Good evidence

    Logs showing prompt handling of SPF failures with corrective actions taken.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Documented procedures for updating SPF records: Request the guidelines on modifying SPF records when needed. Look to see if these documents are comprehensive and easy to follow.

    Good evidence

    A clear procedure with designated responsibilities and steps for updating SPF records.

  4. Check 4 of 5What an auditor asks for

    Ask for

    A list of training materials shared with staff about email authenticity.

    Look at

    Content specifics around SPF importance and practices.

    Good evidence

    Training sessions or materials that clearly explain SPF and its role in protecting against phishing.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Reports on external email service inclusions in SPF records: Request documentation of approvals for third-party email services.

    Look at

    How decisions were made and who authorised them.

    Good evidence

    Formal approval from management for each third-party service added to the SPF record.

Mappings

Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.5Secure authentication technologies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.