Google Workspace Email Security for Schools: A Practical District Checklist
Build a defensible baseline around the controls Google already provides, then identify where your district needs more inspection, explanation, and response capacity.
What this guide helps you do
Leave with a workable next step.
- Inventory every sending service before changing authentication policy.
- Review Google’s native Gmail protections, allowlists, and administrator access.
- Write and rehearse a compromised-account response path before an incident.
Start with the real mail environment
A school district’s email boundary is larger than the Gmail Admin console. Student information systems, transportation tools, learning platforms, HR systems, copiers, alerting services, athletics platforms, and fundraising tools may all send as a district domain. Begin with an owner and a business purpose for every sender.
Deliverable: one inventory with the owner, sending domain, return path, expected volume, authentication method, and retirement date for each service.
Make SPF, DKIM, and DMARC work as one system
SPF identifies approved sending infrastructure. DKIM gives receiving systems a cryptographic signature to validate. DMARC requires alignment with the visible From domain and tells receiving systems how to handle failures. A passing record check is the beginning; representative mail from every legitimate source must also align.
- 1Publish and validate SPF
Keep one SPF record, include every legitimate sender, remove retired services, and watch the ten-DNS-lookup processing limit.
- 2Enable DKIM for every sender
Use 2048-bit keys where supported, record selectors, and verify that gateways or footer tools do not invalidate signatures.
- 3Observe DMARC reports
Begin with monitoring, resolve unknown or misaligned sources, and only then advance enforcement in controlled increments.
Free domain check
See what your school domain publishes today.
HootShield checks SPF, DKIM, DMARC, and related domain posture, then gives your team a clear place to begin.
Review Gmail’s native protections
Use Google’s Spam, Phishing and Malware settings as a deliberate baseline. Review attachment protections, shortened-link and external-image checks, employee-name and similar-domain spoofing defenses, and how unauthenticated mail is handled. Apply changes first to a controlled organizational unit or pilot group when the option exists.
| Control area | What to verify | Evidence to retain |
|---|---|---|
| Attachments | Untrusted scripts, unusual types, encrypted attachments, and action | Setting export and pilot results |
| Links and images | Shortened URLs, linked images, and untrusted-domain warnings | Test-message outcomes |
| Spoofing | Employee names, lookalike domains, unauthenticated mail | Quarantine or warning behavior |
| Allowlists | Every bypass has an owner, reason, scope, and review date | Approved exception register |
Protect accounts with the most authority
Separate administrator work from daily email, keep the number of super administrators small, require strong multifactor authentication, review OAuth grants, and maintain tested recovery contacts. CISA’s K-12 guidance prioritizes MFA and recommends approaches resistant to phishing for consequential access.
- Dedicated admin accounts are not used for routine inbox activity.
- Super admin membership and recovery methods have named owners.
- High-risk users such as finance, payroll, leadership, and IT receive extra attention.
- Third-party OAuth applications are reviewed and unused access is removed.
- Suspicious login, forwarding, routing, and delegation events have alert owners.
Prepare the response before the alert
A useful playbook distinguishes a suspicious message from a compromised account. Preserve message and account evidence, contain access, revoke active sessions and tokens when appropriate, inspect forwarding and delegation, determine the affected audience, remove related messages, and communicate through a trusted channel.
Google provides a detailed compromised-account procedure. Adapt it into a district-owned runbook with contact roles, decision authority, evidence handling, family or staff communication, and after-hours escalation.
Know when the district needs another layer
Native controls are the foundation. Districts may still need a focused layer that joins authentication, sender identity, links, QR codes, attachments, impersonation, related messages, quarantine, and reviewed response into one investigation. Evaluate the gap using actual school mail patterns rather than a generic feature count.
Guard adds explainable inbound inspection, quarantine and investigation workflows for qualified Google Workspace environments. Begin with a guided, limited-scope evaluation and an agreed rollback plan.
Sources and further reading
Primary guidance and related K12First material used to review this resource.
This resource provides general operational guidance. Apply changes through your district’s authorized security, privacy, legal, and change-management processes.
