Free tool · SACS-210 TPC1.20 & TPC1.23
Check your domain’s public e-mail security records
Aramco’s SACS-210 standard requires SPF, DKIM and DMARC on your mail domain, and a private company domain. Enter your domain or an e-mail address to check it in a few seconds.
Indicative check — does not establish CCC compliance
The lookup runs in your browser through public DNS-over-HTTPS resolvers (Google Public DNS, Cloudflare as fallback). Vaurely does not receive or store the domain you enter.
Results for
Need to fix something? Step-by-step guidance for Microsoft 365 and Google Workspace: TPC1.20 SPF, DKIM, DMARC · TPC1.23 private domain.
Checking DNS records…
What this tool checks
- Private domain (TPC1.23): flags public e-mail services (Gmail, Outlook.com, Yahoo…) and domains with no mail servers.
- SPF (TPC1.20): exactly one record, with a restrictive ending (-all or ~all).
- DMARC (TPC1.20): a valid record; p=none is flagged because it only monitors.
- DKIM (TPC1.20): keys on the common selectors used by Microsoft 365, Google Workspace and major providers.
This is a quick external check, not an audit. Your authorised audit firm will expect its own time-stamped evidence, such as screenshots of your mail admin console.
Preparing your Aramco CCC or CCC+?
E-mail is 4 of the 33 general controls. Our engineers handle the other 29 too.
Talk to our team →Vaurely is not affiliated with, endorsed by, or acting on behalf of Saudi Aramco, SABIC, or any Authorized Audit Firm, and does not issue the CCC. Control descriptions on this site are our own summaries for guidance only. Always refer to the official SACS-210 standard.