Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- SPF, DMARC and DKIM implemented for the mail server.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- SPF: publish a TXT record including spf.protection.outlook.com.
- DKIM: Microsoft Defender portal → Email authentication settings → DKIM → enable for your domain (two CNAME records).
- DMARC: publish a TXT record at _dmarc.yourdomain; move from p=none to quarantine or reject once reports are clean.
Google Workspace
- SPF: TXT record including _spf.google.com.
- DKIM: Admin console → Apps → Google Workspace → Gmail → Authenticate email → generate and publish the key, then start authentication.
- DMARC: TXT record at _dmarc.yourdomain, as above.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- DNS lookup output for SPF, DKIM and DMARC records (time-stamped).
- Screenshot of DKIM enabled in the mail admin console.
Common mistakesVaurely guidance
- DMARC left at p=none forever (monitoring only).
- Two SPF records on the same domain, which breaks SPF.
- DKIM enabled for the main domain but not for other sending domains.
FAQVaurely guidance
+Is DMARC p=none enough?
The standard asks for DMARC to be implemented; p=none only monitors and does not protect. Moving to quarantine or reject is the safer position for an audit. TODO: confirm auditor stance.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.