Cybersecurity
DMARC Setup in Saudi Arabia: SPF, DKIM and DMARC Done Properly
We set up SPF, DKIM and DMARC on your company domain so criminals cannot easily send email that looks like it came from you. It is for any Saudi business on Microsoft 365 or Google Workspace, and for companies preparing for the NCA's private-sector controls.
- Microsoft 365 and Google Workspace
- Stops domain spoofing
- Supports NCA Haseen requirement
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
Why DMARC setup in Saudi Arabia matters now
DMARC setup in Saudi Arabia is one of the cheapest ways to stop a costly fraud. Without it, anyone can send an email that shows your domain in the From line. Your customers then receive a fake invoice with new bank details, and the money is gone before anyone calls.
SPF, DKIM and DMARC work together. SPF lists the servers allowed to send your mail. DKIM signs each message so changes can be detected. DMARC tells receiving servers what to do with mail that fails, and sends you reports on who is using your domain.
Many Saudi companies have one or two of these records, often set up years ago and never checked. A half-finished setup gives a false sense of safety, so we check all three together.
- Stops criminals spoofing your exact domain
- Protects customers and suppliers from fake invoices
- Improves delivery of your genuine email
- Shows every service sending mail in your name
The NCA Haseen requirement for email domains
The NCA's Cybersecurity Controls for Non-CNI Private Sector Entities (NCNICC-1:2025) are its first control set for ordinary private companies. They apply to entities the NCA notifies. A consultancy summary of the controls reports that control 2-4-1-2 requires the email domain to be documented through the NCA's Haseen platform using SPF, DKIM and DMARC.
No public notifications or deadlines had been confirmed as of July 2026. Even so, getting your records right now means you are ready when your company is notified. Aramco CCC auditors also look closely at email security.
NCNICC control 2-4-1-2: email domain documented on the NCA's Haseen platform with SPF, DKIM and DMARC (per Uniqus summary, Jul 2026).
How Waves sets up DMARC
Domain check
We read your current DNS records and list every service that sends mail for you, such as Microsoft 365, your ERP or marketing tools.
Fix SPF
We build one clean SPF record that stays inside the DNS lookup limit.
Turn on DKIM
We enable DKIM signing in Microsoft 365 or Google Workspace, and in third-party senders that support it.
Start DMARC in monitor mode
We publish DMARC at p=none and read the reports, so no real email is blocked by surprise.
Move to enforcement
Once all genuine senders pass, we step up to quarantine and then reject. Spoofed mail is then blocked.
Haseen evidence
We give you a short record of your settings to support documentation on the NCA's Haseen platform when required.
What is included
Microsoft 365
SPF, DKIM and DMARC for Exchange Online, plus a review of anti-phishing and impersonation settings.
Google Workspace
DKIM key generation, SPF and DMARC records, and checks for Gmail routing.
Third-party senders
ERP, CRM, website forms and bulk email tools aligned so they pass DMARC.
Email security add-on
Sophos Email filtering for phishing, malware and lookalike domains that DMARC alone cannot stop.
Brands and partners
MicrosoftSophosKnowBe4Fortinet
Managed DMARC monitoring, every month
DMARC is not set-and-forget. New tools, a new website host or a new invoicing system can start sending mail in your name at any time. If nobody is watching, genuine mail starts to fail, or the policy is left at p=none for years and spoofing is never actually blocked.
Waves provides a cloud DMARC monitoring platform plus a monthly report written in plain English. We read the DMARC data for you, fix problems before they affect delivery and move your policy to full protection safely. The service is priced per domain, per month.
Who sends mail in your name
A clear list of every service and server sending email for your domain, genuine or not.
Failing sources fixed
We find senders that fail SPF, DKIM or DMARC and fix them, so real email keeps arriving.
Safe path to reject
We move your policy from p=none to quarantine and then reject, only when the reports show it is safe.
Spoofing and DNS alerts
Alerts when someone tries to spoof your domain, and when your SPF, DKIM or DMARC records change.
SPF lookup-limit fixes
We keep SPF inside the 10 DNS lookup limit as you add services, so it does not silently break.
BIMI readiness
Once you reach enforcement, we check your domain is ready for BIMI, which can show your logo in supporting inboxes.
Aramco SACS-210 requires SPF, DKIM and DMARC, anti-spam protection and a private company email domain (TPC1.20–1.23). Monthly reports give you ongoing evidence for CCC reviews.
Frequently asked questions
What is DMARC in simple terms?
DMARC is a DNS record that tells other mail servers how to treat email that claims to be from your domain but fails checks. It also sends you reports. Together with SPF and DKIM, it stops most direct spoofing of your domain.
Will DMARC block our real emails?
Not if it is done in stages. We start in monitor mode, find every genuine sender and fix them first. Only then do we move to quarantine or reject.
Is DMARC required by the NCA?
The NCA's NCNICC-1:2025 controls include documenting your email domain on the Haseen platform with SPF, DKIM and DMARC, according to a published consultancy summary. The controls apply to private companies the NCA notifies. We recommend setting it up now either way.
Does DMARC stop all phishing?
No. It stops criminals using your exact domain. It does not stop lookalike domains or phishing from other addresses. That is why we pair it with email filtering and staff awareness training.
How long does DMARC setup take?
SPF and DKIM are usually done in a few days. Moving DMARC to full enforcement safely takes a few weeks of monitoring, depending on how many services send mail for you.
We use both Microsoft 365 and an ERP that sends invoices. Is that a problem?
No, but the ERP must be included in SPF or set up with DKIM. Otherwise its invoices may fail DMARC. We check and align every sender before enforcement.
Who reads the DMARC reports after setup?
DMARC reports are machine-readable files that are hard to read by hand. We can review them for you after setup and tell you when a new service starts sending mail in your name. That way enforcement stays safe as your systems change.
Do we need ongoing DMARC monitoring after setup?
Yes, in most cases. Your email setup changes over time as you add new systems and suppliers. Monthly monitoring catches new or failing senders, spoofing attempts and DNS record changes early, so enforcement stays safe and your real email keeps being delivered.
Can you manage DMARC for all our domains, including parked ones?
Yes. We monitor every domain you own, including old and parked domains that send no email. Parked domains are easy targets for spoofing, so we publish strict records that tell receiving servers to reject any mail from them. The monthly service is charged per domain.
Get a free DMARC check for your domain
Send us your domain name. We will reply with your current SPF, DKIM and DMARC status and what needs fixing.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
