Email spoofing is sending a message with somebody else’s address in the “from” line — and unless your school’s domain says otherwise, it is trivially easy. No password is stolen, nothing is hacked: the forger simply writes your address on the envelope, because the email system was designed in an era that assumed nobody would.
What it looks like from the receiving end
A parent gets a message from office@yourschool.sch.uk asking them to pay for a trip through a new link. A business manager gets an email from the head — name right, signature right — asking for an urgent supplier payment. A member of staff gets an IT notice from their own domain asking them to re-enter their password. All three read as internal. None of them needed access to any school system to send, and the reply-to quietly points somewhere else. The reader’s only defences are suspicion — or a domain that told the world’s mail systems to check.
Why a school is worth impersonating
Because a school’s name is trusted by exactly the people attackers want to reach: parents who pay for trips, meals and clubs; staff who open anything from the head; and suppliers who change bank details on request. Impersonation scales, too — the same forged “from” line works on every family in the school. This is not a reason for alarm; it is a reason to close a gap that costs nothing but a few DNS records to close.
What SPF, DKIM and DMARC each do about it
- SPF publishes which servers may send as your domain — the guest list.
- DKIM signs each real message so it can be checked for tampering — the wax seal.
- DMARC tells receiving systems what to do when a message fails both — the instruction on the door. At p=reject, the forged message is refused before anyone sees it.
Practical steps for a school
- Find out where you stand — the free check reads your public records and takes about a minute. (It reads public DNS only — it cannot tell you whether anyone has targeted your school, and neither can anybody else from the outside.)
- Hand the fixes to whoever runs your DNS — the report names the exact records. The school’s job is the asking, not the editing.
- Take DMARC to enforcement properly — the staged rollout is the whole subject of DMARC for schools.
- Tell staff what you’ve done and what remains — “forged mail from our own domain now bounces; lookalike domains are still possible, so keep reporting anything odd” is a sentence that upgrades everyone.
- Add payment-change verification — any request to change bank details or make an unusual payment gets confirmed by a known phone number, no matter how legitimate the email looks. This one is procedure, not DNS, and it catches what the records can’t.
The wider record set — including protecting mail in transit — is covered in the email security hub, and record-by-record instructions for your IT provider live in the records guide.