Australian Information Security Manual

Guidelines for email

Australian Information Security Manual ISM-1183: A hard fail SPF record is used when specifying authorised email servers (or lack thereof)

A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation's domains (including subdomains).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for email

ISM-0264 An email usage policy is developed, implemented and maintained.
ISM-0267 Access to non-approved webmail services is blocked.
ISM-0269 Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To
ISM-0270 Protective markings are applied to emails and reflect the highest sensitivity or classific
ISM-0271 Protective marking tools do not automatically insert protective markings into emails.
ISM-0272 Protective marking tools do not allow users to select protective markings that a system ha
ISM-0565 Email servers are configured to block, log and report emails with inappropriate protective
ISM-0567 Email servers only relay emails destined for or originating from their domains (including

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls