ISM-1799 policy ASD Information Security Manual (ISM)

Enforce Email Rejection for Failed DMARC Checks

Emails not verified by DMARC are blocked to enhance email security.

Preventative NC OS P ASD Information Security ManualGuidelines for email Secure communications

record_voice_over

Plain language

This control makes sure that emails failing to verify through DMARC checks are blocked. It's important because it keeps potentially dangerous or fraudulent emails out of your inbox, protecting your business from phishing attacks or scams that could lead to data loss or financial harm.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Aug 2022

Control Stack last updated

19 Mar 2026

E8 maturity levels

N/A

Guideline

Guidelines for email

Section

Email gateways and servers

Topic

Domain-based Message Authentication, Reporting and Conformance

Official control statement

Incoming emails are rejected if they do not pass DMARC checks.

policy ASD Information Security Manual (ISM) ISM-1799

priority_high

Why it matters

If emails that fail DMARC are not rejected, spoofed messages can reach users, increasing phishing and the likelihood of credential theft or fraud.

settings

Operational notes

Review DMARC aggregate reports and adjust SPF/DKIM alignment so valid senders pass; keep the DMARC policy at reject to block spoofed mail.

02 - Implement

build

Implementation tips

The IT team should configure the email server to enforce DMARC checks. This means setting up the server so that it automatically checks incoming emails against DMARC standards before allowing them through to the recipient.
Managers in charge of communications should train staff on recognising legitimate email failures. Once DMARC is set up, if someone expects an email and it hasn’t arrived, they should verify it was sent from a legitimate address and wasn't blocked by the filter unnecessarily.
System administrators should regularly update DMARC policies. They need to stay informed about the latest DMARC standards and ensure their email server settings reflect any changes to keep security measures current.
The IT team should monitor and review email logs periodically. Check the logs to identify any patterns or regular incidents of email rejection, ensuring legitimate emails aren't being blocked.
Business owners should coordinate with their email service provider to ensure DMARC settings are enabled and robust. They should confirm that the service provider supports DMARC and that the required configurations are in place.

03 - Audit

fact_check

Audit / evidence tips

AskThe email server configuration document: Request to see documentation that details how DMARC checks are set up GoodIncludes evidence that settings align with security policies and reject emails which fail checks
AskThe latest email system training logs: Verify if staff have undergone training related to DMARC and email safety GoodIncludes recent, comprehensive training that focuses on recognising issues stemming from DMARC rejections
AskTo see the DMARC policy records: Request the policy documentation stating how emails are handled when they fail DMARC checks GoodShows a current, enforced policy designed to reject failing emails for security
AskAccess to recent email log reports: View a sample of logs detailing rejected emails due to DMARC failures GoodIs logs displaying legitimate and expected rejections with minimal false positives
AskEvidence of coordination with email service providers: Request any email communication or agreements regarding DMARC implementation GoodIncludes correspondence affirming DMARC compliance support

04 - Mappings

link

Cross-framework mappings

How ISM-1799 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

link_off

No cross-framework mappings recorded yet.