Email security audit program.
How to audit whether email domains are protected against spoofing, messages are encrypted in transit and phishing and malware are intercepted effectively.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation secures its email communication technically and organisationally: sender authentication for its own domains, encrypted transport, filtering of malware and phishing, secure configuration of the mail platform such as Exchange Online and a working reporting path for suspicious messages. It also assesses whether retention of business email is governed.
Scope
- All email domains of the organisation, including those not used for sending
- Mail platform (for example Exchange Online or Exchange Server) and upstream filtering services
- External services that send email on behalf of the organisation, such as newsletters or ticket systems
- Out of scope: end-to-end encryption in individual specialist procedures, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy governs business use of email, sending confidential information and forwarding to external addresses. | BSI APP.5.3; ISO/IEC 27001:2022 Annex A 5.14 | Read the policy, check approval and compare it with the technical forwarding settings. | Email policy, rules on information transfer |
| 2 | Every domain publishes an SPF record that permits only authorised senders; non-sending domains exclude sending. | RFC 7208 | Query DNS records for all domains and compare the listed senders with the actual sending services. | Domain list, DNS query, list of sending services |
| 3 | Outgoing messages are signed with DKIM; keys have an adequate length and are rotated. | RFC 6376 | Analyse headers of test messages from every sending path and ask about key length and the last key rotation. | Headers of test messages, DKIM configuration |
| 4 | A DMARC policy is published and set to reject or quarantine; reports are analysed. | RFC 9989; RFC 9990 | Query the DMARC record, establish the policy level and review the analysis of reports for the last three months. | DNS query, DMARC report analysis, actions on misconfigurations |
| 5 | Transport between mail servers is encrypted and protected against downgrade, for example through DANE or MTA-STS with TLS reporting. | BSI TR-03108 | Review the transport configuration and test the encryption of the own mail servers with an external tool. | External test result, connector configuration, TLS reports |
| 6 | Incoming messages are scanned for malware; dangerous attachments are blocked or opened in isolation. | ISO/IEC 27001:2022 Annex A 8.7; BSI APP.5.3 | Review filter rules and blocked file types and analyse detection statistics for the last three months. | Filter configuration, list of blocked file types, detection statistics |
| 7 | Links in messages are checked when clicked, external senders are tagged and sender spoofing is detected. | ISO/IEC 27001:2022 Annex A 8.7 and 8.23 | Review settings for link checking, external tagging and impersonation protection and trace them with a test message. | Phishing protection configuration, tagged test message |
| 8 | The mail platform is hardened: automatic forwarding to external addresses is restricted and legacy authentication is disabled. | BSI APP.5.3 | Read settings for forwarding, mailbox rules and authentication methods and list mailboxes with external forwarding. | Tenant configuration extract, list of mailboxes with forwarding |
| 9 | Sign-ins to mailboxes and to platform administration are protected with multiple factors. | § 30(2) no. 10 BSIG; ISO/IEC 27001:2022 Annex A 8.5 | Review multi-factor rules and have accounts without a second factor listed with justification. | Conditional access policies, factor registration report, exception list |
| 10 | Mailbox access and administrative changes are logged, and logs are retained long enough. | ISO/IEC 27001:2022 Annex A 8.15 | Check that mailbox auditing is enabled and its retention period, and have a log retrieval demonstrated. | Logging settings, example of a log retrieval |
| 11 | Staff can report suspicious messages easily; reports are analysed and answered. | ISO/IEC 27001:2022 Annex A 6.8 | Have the reporting path demonstrated and trace handling, assessment and feedback for five reports. | Description of the reporting path, handled reports |
| 12 | Retention of business email that counts as commercial or business correspondence is governed and technically implemented. | § 147(1) nos. 2 and 3 AO | Review retention rules and the archiving solution and check whether mailbox deletions could undermine retention. | Retention policy, archiving configuration |
Documents to request
- Email policy
- List of all domains and of services sending on behalf of the organisation
- DNS records for SPF, DKIM and DMARC and the DMARC report analysis
- Configuration of transport encryption, filtering and phishing protection
- Tenant or server configuration extract of the mail platform
- Multi-factor authentication report with exceptions
- Description of the reporting path for suspicious messages
- Email retention policy
Typical findings
- The DMARC policy stays at monitoring permanently, reports are not read.
- Unused domains have no record and can be abused for spoofing.
- External sending services are not included in SPF or DKIM.
- Automatic forwarding to private addresses is allowed.
- Some mailboxes and service accounts can be reached without a second factor.
- Reported phishing messages are neither analysed nor answered.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing