Six small DNS records decide whether a stranger can send email that looks exactly like it came from your school. None of them cost anything. Most schools have one or two, and the gap usually isn’t reluctance — it’s that nobody explained what they do.
This guide covers each record the free Mail check looks at: what it is, what it means when it says not set up, and what to ask for. You do not need to be technical to use it. You do need to know who runs your DNS — that is usually your IT provider, your trust’s central team, or whoever built your website.
SPF — which servers may send as you
SPF (Sender Policy Framework) is a list of the mail servers allowed to send email using your domain. Receiving systems check the list. If a message arrives from somewhere not on it, that is a signal the message is forged.
If it says not set up
There is no list, so nothing contradicts a forged message. This is the first record to fix and the one that most affects your score.
What to ask for
- A TXT record on your domain beginning
v=spf1, naming every service that sends on your behalf — Microsoft 365 or Google Workspace, plus your MIS, your parent messaging service, your payments provider and anything else that emails parents. - It should end
-all(“anything else is forged”) rather than~all(“anything else is probably forged”). We grade-allhigher because it is the one that actually stops a message.
include: entries, ask whoever runs it to check the lookup count.DKIM — a signature that proves a message is genuinely yours
DKIM (DomainKeys Identified Mail) adds an invisible cryptographic signature to every message you send. The matching key sits in your DNS, so a receiving system can verify the message really came from you and wasn’t altered on the way.
If it says not set up
We could not find a published key. Your mail may still be signed internally, but without a published key nobody can check the signature — so it counts for nothing. It also means DMARC below has only half the evidence it needs.
What to ask for
DKIM is switched on in your mail platform, not typed by hand. In Microsoft 365 it is enabled per domain in the Defender portal and publishes two CNAME records; Google Workspace generates a key in the Admin console and gives you one TXT record. Whoever administers your mail platform can do this in a few minutes.
DMARC — what to do with mail that fails the tests
SPF and DKIM detect forgery. DMARC is where you say what should happen to it — and it is the only one of the three that stops anything. It also asks receiving systems to send you reports on who is sending as your domain, which is how you find out about impersonation you would otherwise never see.
If it says not set up
Forged mail claiming to be from your school is delivered normally, and you get no reports. Even with SPF and DKIM in place, nothing acts on the result.
The three settings, and why we grade them differently
p=none— watch only. Nothing is stopped, but reports start arriving. A sensible place to begin, and a bad place to stay.p=quarantine— suspicious mail goes to junk instead of the inbox.p=reject— suspicious mail is refused outright and never reaches anyone. This is the goal.
p=none first and read the reports for a few weeks. They will almost certainly reveal a legitimate service nobody remembered — a trip provider, a photographer, a payments platform — that is not yet in your SPF record. Moving to reject before fixing those will stop your own mail. The order is: publish DMARC at none, read the reports, fix what they show, then tighten.MTA-STS — insist that mail to you is encrypted
Mail between servers is usually encrypted, but by default that encryption is optional: if an attacker interferes with the connection, the sending server will quietly fall back to sending your mail in the clear. MTA-STS (Mail Transfer Agent Strict Transport Security) is you saying “don’t do that — if you cannot deliver to me securely, do not deliver at all.”
If it says not set up
Mail addressed to your school can be downgraded to an unencrypted connection without anyone noticing. This matters most for the messages you would least like read in transit — safeguarding correspondence, HR matters, anything with pupil data in it.
What it takes, honestly
MTA-STS is the fiddliest record here, because it is not only DNS. It needs three things:
- A TXT record at
_mta-sts.yourdomainholding a version and an ID. - A policy file served over HTTPS at
https://mta-sts.yourdomain/.well-known/mta-sts.txt, listing your mail servers and the mode. - A valid certificate on that
mta-sts.subdomain — which is the part that usually stalls a school, because it means somebody has to host a small web page and keep its certificate renewed.
Start in mode: testing, which reports problems without refusing any mail, and move to mode: enforce once the reports are clean. If hosting that page is the blocker, Ceidwad customers can ask us to host the policy for them, so all that is left on your side is the one TXT record.
TLS-RPT — find out when secure delivery fails
TLS-RPT (TLS Reporting) is a single line of DNS that asks other mail systems to email you a daily summary whenever they could not deliver to you securely. It stops nothing by itself. Its whole job is to tell you that something is wrong — including telling you whether it is safe to turn MTA-STS from testing to enforce.
If it says not set up
Secure delivery to your school could be failing every day and there is no way for you to find out.
What to ask for
One TXT record at _smtp._tls.yourdomain containing v=TLSRPTv1; and a rua=mailto: address to send the reports to. Use a shared mailbox rather than a person, so the reports survive that person leaving. This is the smallest job on this page — usually under five minutes.
BIMI — your logo beside your emails
BIMI (Brand Indicators for Message Identification) lets supporting mail apps display your school’s logo next to messages you send. It is the only record here that is about recognition rather than protection, and it is the last one to worry about.
If it says not set up
Nothing is at risk. You are simply not showing a logo. It carries a small weight in our score because it is a genuine signal to parents, not because its absence is a problem.
What it needs first
BIMI only works once DMARC is at quarantine or reject — so it is a reward for finishing the work above, not a shortcut. You also need your logo as an SVG in a specific profile, and some mail providers additionally require a paid Verified Mark Certificate. Worth doing last, if at all.
DNSSEC — signing the noticeboard itself
Every record above lives in DNS. DNSSEC signs your DNS so that someone cannot tamper with the answers on the way to whoever asked. Without it, an attacker who can interfere with a DNS response could in principle undo everything else on this page.
If it says not set up
Your DNS answers are not signed. In practice this is a lower priority than SPF, DKIM and DMARC — fix those first.
CAA — who is allowed to issue certificates for you
A CAA record names the certificate authorities permitted to issue HTTPS certificates for your domain. It narrows the field: without one, any authority in the world can issue a certificate for your name if it is tricked into doing so.
If it says not set up
No restriction is published. Add a CAA record naming the authority you actually use — for most schools that is Let’s Encrypt (letsencrypt.org) or whoever your web host uses. Check with your web host before adding it, because a CAA record that omits your host’s authority will block their certificate renewals.
Nameservers — how many places answer for you
Your nameservers are the servers that hold your DNS. If they all sit with one provider in one place, an outage there takes your DNS with it — and when DNS goes, your email and your website go with it, whatever else you have done.
If it looks thin
We look at how many nameservers answer for your domain and whether they are spread across more than one provider. Two providers is a meaningful improvement over one. This is a conversation with whoever hosts your DNS rather than a record you add yourself.
If you only do three things
In this order, because each one makes the next worth having:
- SPF — publish the list of who may send as you.
- DKIM — switch on signing in your mail platform and publish the key.
- DMARC at
p=none— start the reports, read them for a few weeks, fix what they reveal, then move to quarantine and on to reject.
That is the bulk of the risk dealt with. MTA-STS and TLS-RPT are the next pair, and BIMI is optional.