01 / BUSINESS
Business email
Employee correspondence and company communication. Recommended focus: company-controlled identities, MFA, anti-phishing, malware protection, safe forwarding and appropriate retention.
EMAIL INFRASTRUCTURE · INDIA
Build trust in
every email.
Business correspondence, promotional campaigns and transactional messages share security foundations. Their permissions, delivery rules and audit evidence can differ.
Selected official references reviewed: 17 October 2026. Applicability depends on entity category, channel, recipient, volume and current circulars.
START WITH THE MESSAGE
Three uses. Different controls.
02 / PROMOTIONAL
Promotional email
Newsletters, offers and campaigns. Recommended focus: documented recipient permission, clear identity, easy opt-out, suppression lists and sender reputation. Check recipient-provider requirements before bulk sending.
03 / TRANSACTIONAL
Transactional email
Receipts, statements, password resets and service alerts. Recommended focus: correct triggers and recipients, confidentiality, delivery evidence and fraud protection. Keep necessary service notices separate from promotional opt-outs and avoid mixing in offers.
These are operational categories, not a universal SEBI/RBI classification of email. A message’s purpose and the applicable sector rules determine its treatment.
REGULATORY SCOPE
Which requirements may apply?
SEBI · CSCRF
The 2024 CSCRF includes SPF, DKIM and DMARC, email filtering, malware scanning and email-protection controls such as MFA and encryption (Part II, pages 95–96). These controls require evidence beyond DNS.
The base network-security table excludes small-size and self-certification REs from the relevant mandatory category. Confirm your current classification, exemptions and subsequent clarifications before applying this checklist; it is not a mandate for every Indian business.
CSCRF source ↗ · 2025 technical clarifications ↗ · SEBI cybersecurity portal ↗
RBI · Urban co-operative banks
RBI’s 31 December 2019 graded cybersecurity framework addresses Primary (Urban) Co-operative Banks. Annex I, Level I, item 1 specifies bank-specific email domains and anti-phishing, anti-malware and DMARC controls at the email solution.
This citation is specific to UCBs. Other banks, NBFCs and payment entities must map their own applicable RBI directions; this page does not extend the UCB circular to all businesses or all RBI-regulated entities.
CERT-In · Logs & incidents
The 28 April 2022 directions cover service providers, intermediaries, data centres, body corporates and government organisations. They require secure ICT logs for a rolling 180 days within India and reporting specified cyber incidents within six hours of noticing or being notified of them.
Map relevant email-system logs, clock synchronisation and incident procedures to the directions and FAQs. This is not a blanket requirement to keep every email message for 180 days.
MeitY · Personal-data handling
The DPDP Rules, 2025 were notified with phased implementation. Confirm the commencement date of each relevant Act provision and rule before treating it as currently enforceable.
Prepare purpose-specific notices, a valid processing basis, recipient preferences, safeguards and retention practices for personal email/contact data. Do not assume that a transactional label settles every privacy obligation.
MeitY publication hub ↗ · Government timeline announcement ↗
TRAI · Do not confuse email with SMS
TRAI’s cited commercial-communication guidance concerns voice calls and SMS using telecom resources. Its Principal Entity, header and template processes should not be presented as a general DLT-registration requirement for ordinary email marketing.
If a campaign also sends SMS or makes calls, assess those channels separately.
DELIVERABILITY IS A SEPARATE LAYER
Mailbox-provider policies
These are recipient-provider rules, not SEBI or RBI regulations. Requirements can depend on sending volume, destination and message type.
Google · Personal Gmail recipients
Google distinguishes ordinary and bulk senders. Its bulk requirements include SPF, DKIM, DMARC, alignment, TLS and DNS requirements. Marketing and subscribed messages must support one-click unsubscribe and a visible body link under the applicable bulk-sender rules. Review the current volume definition and full guidance before sending.
Google sender guidelines ↗Microsoft · Outlook consumer delivery
Microsoft publishes requirements for high-volume senders to its consumer email service. Review the current authentication requirements and enforcement guidance for your sending volume and destination.
Provider acceptance does not establish Indian regulatory compliance or guarantee inbox placement.
Microsoft sender requirements ↗FROM CHECKLIST TO EVIDENCE
What can be checked?
The website scan provides public DNS observations. Request a private email test to assess a sample message through the connected receiver. Mailbox controls and organisational processes still need administrator/auditor evidence.
| Control | Evidence to collect | Verification method |
|---|---|---|
| Email domains & senders | Inventory employee mail, applications, CRM, newsletters and third-party senders. Use company-controlled domains and accountable owners. | Operator review |
| SPF | Public TXT records identify a published sender policy. Validate authorised senders and SPF lookup limits separately. | Partial · public DNS |
| DKIM | A public key at a queried selector can be observed. Obtain actual selectors and validate signatures on real messages. Four common selectors do not cover every sender. | Partial · public DNS |
| DMARC | Inspect the published policy. Verify real-message From-domain alignment, reporting and deployment coverage; a record alone does not prove enforcement. | Partial · public DNS |
| Mail transport & certificates | Test SMTP STARTTLS, mail-server certificate names/trust/expiry and delivery paths. The website HTTPS certificate is a different check. | Mail-server testing needed |
| Mailbox & gateway security | Evidence of MFA, administrator controls, anti-phishing, malware filtering, forwarding restrictions and account offboarding. | Operator review |
| Promotional permissions | Document permission, sender identity, unsubscribe handling, suppression lists, complaints and bounce management. Test actual messages and workflow. | Message & process review |
| Transactional delivery | Evidence of sending triggers, correct recipient, authentication, retry/failure handling and any applicable delivery/record-keeping duties. | Message & process review |
| Logs & incident response | Verify relevant retention, access, location, clock synchronisation, incident reporting and response ownership. | Operator review |
DMARC AGGREGATE REPORTS
See your domain’s sending sources.
Upload an XML, GZIP or ZIP report to explore receiver-reported authentication, message volumes and dispositions. Keep private history and download PDF or Excel findings.
Analyse a DMARC report →Email security and DNS tools
Inspect SPF, DMARC, DKIM, MX, SMTP, MTA-STS, BIMI, certificates and other public evidence.
Open email tools →ASSESS · DOCUMENT · IMPROVE
Email compliance self-assessment
Record organisational controls alongside your technical tests. Every answer is self-declared. Evidence references are notes only; files are not uploaded or reviewed.
0 of 9 controls answered · Completion measures responses, not compliance.
Drafts are saved on this browser only when you select Save draft. They are not added to your account history. Downloads are generated on the server without saving the questionnaire.
Connect website and email assurance.
Start with the website’s public DNS evidence, then review email controls with your IT and compliance teams.