Skip to content
Deliverability

SPF, DKIM and DMARC for campus IT teams

A practical, copy-paste guide to authenticating mail for a university domain without breaking existing senders.

MAMaya Oduya9 min readUpdated 5 August 2026

Start with an inventory

Before publishing a single record, list every system that sends mail as your domain: the LMS, the ticketing system, payroll, alumni newsletters, and the three departmental scripts nobody documented.

SPF

One record, one lookup budget. Keep it under ten DNS lookups.

dns
v=spf1 include:_spf.instantedumail.com include:_spf.google.com -all

Use -all only once you are confident the inventory is complete; ~all while you monitor.

DKIM

Publish the selector we generate for your domain:

dns
iem1._domainkey.example.edu. TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."

Rotate selectors annually. Keep the previous selector live for one week after rotation.

DMARC

Start at p=none with aggregate reports, then tighten.

dns
_dmarc.example.edu. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.edu; pct=100"

Move to quarantine after two clean weeks, then reject.

The order that avoids outages

  1. SPF with ~all
  2. DKIM signing on every sender
  3. DMARC p=none plus reporting
  4. Tighten SPF to -all
  5. DMARC quarantine, then reject

Skipping step three is the most common cause of a Monday-morning mail outage.

Share

About the author

Maya Oduya

Head of Deliverability

Maya spent eight years running mail infrastructure for university systems before joining InstantEduMail. She writes about SPF, DKIM and the unglamorous work of landing in the inbox.

All posts by Maya Oduya

Comments are coming soon

We're wiring up a moderated discussion thread for each post. Until then, reply by email and we'll add good questions to the article.

Send us a note

Related reading