Skip to content
Email
ASD ISMISM-1183

ASD ISM 1183 Implement hard fail SPF records for email security

What it says

A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation's domains (including subdomains).

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use a strict SPF record to ensure only authorised servers send emails on behalf of the organisation.

This control involves setting up a strict set of rules, called an SPF record, which tells the world which email servers are allowed to send emails on your behalf. It matters because if you don't do this, cybercriminals could send fake emails that look like they come from your organisation, leading to scams, data loss, or damage to your reputation.

Why it matters

Without a hard fail SPF record (-all), attackers can send mail spoofing your domain, increasing phishing risk, delivery failures and reputational damage.

How to implement

  1. IT team should create an SPF record: They need to make a list of all the mail servers that are authorised to send emails for your organisation.

    This can be done by working with your email service provider to ensure that these servers' IP addresses are included in your SPF record.

  2. IT manager should update the DNS settings: Once the SPF record is created, they should access the domain registrar's portal and add this record to your domain's DNS settings.

    This may involve inputting text entries that specify which servers are trusted.

  3. IT security personnel should test email delivery: After updating DNS settings, they must send test emails to check the SPF record is correctly configured.

    Ensure emails arrive as expected and check spam folders to confirm none are mistakenly identified as spam.

  4. System administrator should configure 'hard fail' policy: This means updating the SPF record to use '-all', which tells other servers to reject emails not coming from authorised sources.

    Set this option to prevent any unauthorised emails from being accepted.

  5. Office manager should communicate changes: Inform staff about this update as it might affect how internal communication is handled.

    Explain the reason behind these changes to ensure everyone understands the importance of email security.

Keep it running

Publish SPF with hard fail (-all) where appropriate; review senders, keep within 10 DNS lookups, and update promptly when authorised mail services change.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The current SPF record entry in the DNS settings: Request a snapshot or download of the DNS configuration from whoever manages the domain.

    Look at

    The SPF details like the list of authorised servers and the presence of '-all' for hard fail.

    Good evidence

    Is an SPF record showing specific authorised servers and a hard fail setting.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Logs or reports showing the email delivery tests conducted after the SPF implementation.

    Look at

    The timestamps, successful deliveries, and any failure reports.

    Good evidence

    Includes records showing successful email transmissions and zero unauthorised access attempts.

  3. Check 3 of 5What an auditor asks for

    Ask for

    A change management log: Request documentation that shows when the SPF record was updated and by whom.

    Look at

    Historical entries reflecting the timing of changes and authorisation signatures.

    Good evidence

    Is a detailed log showing changes, responsible person, and approval evidence.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Emails or briefing documents sent to employees about the SPF implementation.

    Look at

    The clarity of the message and the explanation of why it's important.

    Good evidence

    Includes clear instructions and understandable rationale communicated to staff.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see training materials: Request records of any training provided to staff about recognising and reporting suspicious emails.

    Look at

    Content that covers recognising phishing and the importance of SPF.

    Good evidence

    Includes comprehensive training material and records of attendance or completion.

Mappings

Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.9Configuration management for secure IT systemsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.