What does ASD ISM 1502 require?

policyASD Information Security Manual (ISM)

ASD ISM 1502Block Inbound External Email Spoofing Internal Domains

Inbound email that arrives over an external connection with a source address using one of the organisation's own internal domains or subdomains is blocked at the email gateway.

Preventative NC OS PASD Information Security ManualGuidelines for email MFA Authentication

record_voice_over

Plain language

This control stops email that arrives from outside the organisation but claims to come from one of the organisation's own internal domains or subdomains. Genuine internal mail never reaches the gateway over an external connection, so any external message carrying an internal source address is almost certainly forged and is blocked before it reaches recipients. It is a targeted gateway rule that defends against a common impersonation trick where an attacker fakes a trusted internal sender to make an email look legitimate.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Sept 2022

Control Stack last updated

10 Aug 2026

E8 maturity levels

N/A

Guideline

Guidelines for email

Section

Email gateways and servers

Topic

Blocking Suspicious Emails

Official control statement

Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain, are blocked at the email gateway.

policyASD Information Security Manual (ISM)ISM-1502

priority_high

Why it matters

Without this rule, an attacker can send external email that appears to originate from a trusted internal address, making phishing, fraud and impersonation attacks far more convincing and more likely to succeed.

settings

Operational notes

Because the rule keys on the organisation's own domains, its accuracy depends on keeping the internal domain and subdomain inventory and any legitimate-sender exceptions current as mail infrastructure changes.

02 - Implement

build

Implementation tips

Configure the email gateway to reject or quarantine inbound mail that arrives over an external connection when the source address uses one of the organisation's internal domains or subdomains, and apply the check to both the envelope sender and the header From address.
Maintain a complete and current inventory of every internal domain and subdomain the organisation owns, and update the gateway rule whenever domains or subdomains are added, changed or retired so the rule always covers them all.
Identify legitimate external senders or relays that must send using an internal-looking address, such as a hosted marketing platform or a partner mail relay, and allowlist them by source address so valid mail is not lost.
Enable logging and alerting on every message the rule blocks so security staff can review and investigate attempted spoofing of internal domains.
Test the rule regularly by sending sample messages that spoof internal domains and subdomains from an external source, and confirm that each one is blocked at the gateway.

03 - Audit

fact_check

Audit / evidence tips

AskDoes the email gateway block inbound mail arriving over an external connection when the source address uses an internal domain or subdomain?GoodA rule is enabled that rejects or quarantines external inbound mail whose source address matches an internal domain or subdomain.
AskDoes the rule evaluate both the envelope sender and the header From address?GoodThe rule triggers on an internal domain or subdomain found in either the envelope sender or the header From field.
AskIs the list of internal domains and subdomains used by the rule complete and current?GoodEvery owned internal domain and subdomain is present in the rule, and the inventory is kept up to date as infrastructure changes.
AskHow are legitimate external senders that must use an internal-looking address handled?GoodApproved external senders are allowlisted by source address with a documented business justification, and no broad exception weakens the rule.
AskAre blocked spoofing attempts logged, alerted on and periodically tested?GoodBlocked messages are logged and generate alerts, and periodic tests with spoofed sample messages confirm the rule works as intended.