Skip to content
Deliverability

SPF, DKIM and DMARC for campus IT teams

A practical, copy-paste guide to authenticating mail for a university domain without breaking existing senders.

INInstantEduMail Editorial Team9 min readUpdated 14 August 2026

Start with an inventory

Before publishing a single record, list every system that sends mail as your domain: the LMS, the ticketing system, payroll, alumni newsletters, and the three departmental scripts nobody documented.

SPF

One record, one lookup budget. Keep it under ten DNS lookups.

dns
v=spf1 include:_spf.instantedumail.com include:_spf.google.com -all

Use -all only once you are confident the inventory is complete; ~all while you monitor.

DKIM

Publish the selector we generate for your domain:

dns
iem1._domainkey.example.edu. TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."

Rotate selectors annually. Keep the previous selector live for one week after rotation.

DMARC

Start at p=none with aggregate reports, then tighten.

dns
_dmarc.example.edu. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.edu; pct=100"

Move to quarantine after two clean weeks, then reject.

The order that avoids outages

  1. SPF with ~all
  2. DKIM signing on every sender
  3. DMARC p=none plus reporting
  4. Tighten SPF to -all
  5. DMARC quarantine, then reject

Skipping step three is the most common cause of a Monday-morning mail outage.

Share

About the author

InstantEduMail Editorial Team

Editorial Team

Guides on temporary email, deliverability and email testing, written and reviewed by the InstantEduMail team against primary sources. Read our editorial policy for how we research, review and correct content.

All posts by InstantEduMail Editorial Team

Comments are coming soon

We're wiring up a moderated discussion thread for each post. Until then, reply by email and we'll add good questions to the article.

Send us a note

Related reading