Your ISMS is certified. Your Statement of Applicability covers the controls. Your auditor arrives and runs a DNS lookup on your domain.



dig _dmarc.yourdomain.com TXT +short






The output shows p=none. The auditor makes a note.

This is not a hypothetical. DMARC policy enforcement has become a standard ISMS audit check since ISO 27001:2022...