Skip to content
MailTwin

ASD ISM email controls check

See how a domain measures up against the email authentication controls in the Australian Signals Directorate's Information Security Manual. The full report includes an ISM panel with each control's result.

You can also paste a URL or an email address.

Try: , ,

The ISM email authentication controls

The Information Security Manual is ASD's framework for protecting systems and data. Its Guidelines for Email include controls for SPF, DKIM, DMARC and MTA-STS. In the September 2026 edition they apply to every classification, including non-classified systems, so they are relevant to any Australian organisation that uses the ISM, not only government.

ControlRequirement (ISM wording)This checkWhat passes
ISM-0574SPF is used to specify authorised email servers (or lack thereof) for an organisation's domains (including subdomains).CheckedOne valid SPF record at the domain.
ISM-1183A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation's domains (including subdomains).CheckedThe record ends with -all.
ISM-1540DMARC records are configured for an organisation's domains (including subdomains) such that emails are rejected if they do not pass DMARC checks.Checkedp=reject, subdomain policy reject (or inherited), applied to all mail.
ISM-0861DKIM signing is enabled on emails originating from an organisation's domains (including subdomains).Not from DNSDKIM keys live under selectors that DNS cannot list.
ISM-1589MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.Not yetPlanned for a later version of the checker.
ISM-1151, ISM-1026, ISM-1799Incoming email is checked with SPF, DKIM and DMARC, and rejected if it fails DMARC.Not from DNSThese are settings on your own mail gateway.

Control text from the Information Security Manual (September 2026), © Commonwealth of Australia, Australian Signals Directorate, licensed under Creative Commons Attribution 4.0.

Not part of the Essential Eight

SPF, DKIM and DMARC are ISM controls, but none of them is in the Essential Eight maturity model. An organisation can reach Essential Eight maturity level three with no DMARC record at all. If your obligations reference the ISM (for example, Commonwealth entities under the PSPF), these controls apply separately.

Records that meet the DNS-visible controls

For a domain that sends email through Microsoft 365:

example.com.au. IN TXT "v=spf1 include:spf.protection.outlook.com -all"
_dmarc.example.com.au. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com.au"

With no sp= tag, subdomains inherit p=reject. Leave out pct= (or set it to 100). Then turn on DKIM signing for the domain in the Microsoft Defender portal (Email authentication settings), which covers ISM-0861.

"Including subdomains" matters. A subdomain that sends mail needs its own SPF record (SPF is not inherited), and a subdomain with its own DMARC record needs p=reject there too. Domains that never send email still need records: see protecting parked domains.

How the result is worked out

  • ISM-0574 passes when the domain publishes exactly one SPF record. Two records cause a PermError, so they fail.
  • ISM-1183 passes when that record ends with -all. ~all is a soft fail and does not meet the control.
  • ISM-1540 passes when the effective policy is reject, the subdomain policy is reject (set or inherited) and pct is 100. p=reject with a weaker subdomain policy or a lower percentage shows as a warning.
  • DKIM and MTA-STS are listed but not scored, because they cannot be confirmed from the domain name alone.

The result is a technical check of published DNS. It is useful evidence for an assessment, but it is not an IRAP assessment or a statement of compliance. Run the full domain check to see the ISM panel alongside every other finding.