middle.network
Health check
Guide for auditors

Auditing email authentication: SPF, DKIM and DMARC explained for auditors

What each record proves, the five findings that matter, and the questions to ask.

Auditors, GRC teams, IT managers7 min readUpdated

Three records, three questions

  • SPF answers “which servers may send email for this domain?”. It’s a TXT record listing allowed senders.
  • DKIM answers “was this email changed, and did an allowed system sign it?”. The sending system signs each message; the public key is in DNS.
  • DMARC answers “what should a receiver do when SPF and DKIM don’t line up with the From address?”. It’s the only one of the three that stops spoofing of the visible From address, and it sends reports back to the domain owner.

Why DMARC is the record that matters

SPF and DKIM on their own don’t protect the From address people see. DMARC ties them to it and tells receivers to act. Without an enforcing DMARC policy, anyone can send email that appears to come from the domain, and many receivers will deliver it.

Since 2024 Google, Yahoo and Microsoft require DMARC from bulk senders, so a missing record now also affects delivery.

The five findings that matter

  • No DMARC record: spoofing is unrestricted and nobody is told about it.
  • DMARC p=none: monitoring only. Acceptable for a few weeks during rollout; a finding if it has been like that for months.
  • No rua reporting address, or one nobody reads: the organisation can’t see who is sending as it.
  • SPF over 10 DNS lookups, or ending in +all: SPF fails or allows everyone.
  • No DKIM on a major sending service (for example the CRM or newsletter tool): those emails fail DMARC once it’s enforced, which is often why p=none never moves.

Questions to ask

  • Who reads the DMARC aggregate reports, and how often?
  • What is the plan and date to move from p=none to quarantine or reject?
  • Which third parties send email in your name, and are they on the sender inventory?
  • Do parked and unused domains have a reject policy and an SPF record of v=spf1 -all?
Tip: Parked domains are the quick win. A domain that never sends email should publish v=spf1 -all and a DMARC policy of p=reject. It costs nothing and removes a spoofing route.

Mapping to frameworks

ISO 27001:2022: A.5.14 Information transfer, with A.8.20 Networks security as supporting. SOC 2: CC6.6. In Australia, the ASD Information Security Manual’s email guidelines call for SPF, DKIM and DMARC, and in the UK the NCSC recommends DMARC at reject for all government domains.

Beyond authentication: encryption in transit

SPF, DKIM and DMARC don’t encrypt anything. MTA-STS tells other mail servers to insist on TLS when delivering to the domain, and TLS-RPT sends reports when they can’t. Check both under A.8.24 Use of cryptography.

This maps what we can see from the internet to common controls, to help you gather evidence. It isn’t a certification, an audit opinion or legal advice. Your auditor, your scope and your Statement of Applicability decide what applies.

More guides

ISO 27001:2022 evidence you can collect from outside the network Which Annex A controls leave a trace on the internet, and how to evidence them in ten minutes. 8 min read · ISO 27001 auditors and ISMS owners
TLS and certificate evidence for ISO 27001 A.8.24 and SOC 2 CC6.7 Protocol versions, certificate management and HSTS: what to check and what to ask for. 6 min read · Auditors and security engineers
The ten-minute external security review: a checklist for auditors A repeatable outside-in review of any organisation’s domain, with what to record. 6 min read · Auditors and third-party risk teams
DNS and domain controls auditors overlook: DNSSEC, registrar lock and nameserver redundancy The domain itself is an asset. How to check it is owned, protected and resilient. 6 min read · Auditors and IT managers