Email is the door a school cannot close: it must accept messages from strangers, and it must send messages parents will trust. Both halves are protected by a small set of DNS records that most schools have never checked — records that decide whether the world can tell your real email from a forgery. This page explains the set; the guides below go deep on each part.
The problem, in one paragraph
Out of the box, email has no proof of sender. Anyone, anywhere, can put your school’s address in the “from” line of a message to a parent, a supplier or your own staff — asking for a payment, a password, or a child’s details. The fix is not a product; it is a set of public DNS records that let receiving mail systems check “did this really come from the school?” and act when it didn’t. The NCSC’s anti-spoofing guidance (sources below) describes the same set for every UK organisation; the DfE’s cyber standard expects school data and accounts kept secure, and email is where most attempts start.
The four records, in plain English
SPF publishes the list of servers allowed to send email as your domain. DKIM puts a tamper-proof signature on each message. DMARC is the policy that tells the world what to do when a message fails those checks — and sends you reports about who is sending as your domain. MTA-STS protects messages in transit between mail systems. They work as a set: SPF and DKIM prove, DMARC enforces, MTA-STS protects the journey.
Email spoofing: how it works and how to stop it — start here if you want the threat explained first.
DMARC for schools — the enforcement policy, none → quarantine → reject, and how to roll it out safely.
The records, one by one — the practical how-to for whoever runs your DNS, covering SPF, DKIM, DMARC, MTA-STS and TLS-RPT.
Find out where your school stands, today
This is one of the few corners of cyber security where you can get a complete, honest answer, because every one of these records is public by design — anyone can read them, including you. Our record-by-record guide walks through what to look up for SPF, DKIM and DMARC, what each answer means, and the exact records to hand to whoever manages your domain. Nothing connects to your systems, and the same grading runs continuously inside the Craidd platform for customers.
Who actually fixes this
Almost always, not the person reading this page. DNS records are usually managed by an IT provider, a broadband supplier, or whoever registered the school’s domain — so the school’s job is to ask, with the specifics in hand. That is why every report our checker produces is written to be forwarded: the person who cares about the risk and the person who can change the records are almost never the same person, and the handover between them is where this work usually stalls.