SPF, DKIM, and DMARC for School Districts
Learn how the three authentication standards work together, why a green DNS check is not enough, and how to move toward enforcement without surprising legitimate school senders.
What this guide helps you do
Leave with a workable next step.
- SPF and DKIM authenticate; DMARC evaluates alignment with the visible From domain.
- Inventory every legitimate sender before enforcement.
- Use reports and representative messages to advance policy gradually.
The three checks in plain language
DMARC can pass through aligned SPF or aligned DKIM. Forwarding often changes the SPF outcome, which makes durable DKIM signatures especially useful. Mailing lists and gateways can also change messages, so test the district’s real paths.
Inventory school senders before changing policy
Common senders include Google Workspace or Microsoft 365, SIS and LMS notifications, transportation, food service, mass communication, HR and recruiting, payroll, benefits, copiers, help desk, website forms, fundraising, athletics, libraries, and cloud infrastructure. For each, identify the From domain, envelope domain, DKIM signing domain, owner, and expected lifetime.
SPF: authorize the sending path
Publish one SPF TXT record for a domain. Include only approved senders, understand recursive includes, and stay within SPF’s processing limit. A broad or stale record increases exposure; multiple SPF records can produce a permanent error.
Google’s SPF setup guide provides the Google Workspace include and explains how to add other senders.
DKIM: sign mail with a domain key
Generate a key in the sending service, publish the public key under its selector, enable signing, and verify a delivered message. Prefer 2048-bit keys where supported. Track selectors so the district can rotate keys and retire vendor access cleanly.
Follow Google’s DKIM setup procedure for Workspace domains and test mail after any gateway that modifies message bodies or headers.
DMARC: align, observe, then enforce
- 1Monitor
Publish a reporting address and observe representative traffic without changing delivery.
- 2Resolve
Identify legitimate, unknown, retired, and malicious sources; correct alignment for approved senders.
- 3Advance
Move toward quarantine or reject in controlled increments after the reports and business owners agree.
Google recommends enabling SPF and DKIM before DMARC and describes a gradual DMARC rollout. Do not copy a record from an example without replacing its reporting addresses and validating the district’s actual senders.
Test the public posture now
HootShield domain scan
Check before you change DNS.
Enter a school domain to review SPF, DKIM, DMARC, lookup depth, and related posture. Use the snapshot to guide investigation; verify real delivered mail before enforcement.
Sources and further reading
Primary guidance and related K12First material used to review this resource.
This resource provides general operational guidance. Apply changes through your district’s authorized security, privacy, legal, and change-management processes.
