Skip to main content

Email Deliverability (SPF, DKIM, DMARC)

When a message arrives, the receiving mail server checks whether it was really authorized by the sending domain. Three checks do this: SPF, DKIM, and DMARC. If they pass, your Manage1to1 email lands in inboxes. If they fail, it is likely to be filtered as spam or rejected.

  • SPF confirms the message came from a server your domain approves.
  • DKIM adds a tamper-proof signature that proves the message is genuinely from your domain.
  • DMARC ties the two together and tells receivers what to do if a check fails.

Sending through Google or Microsoft makes this easy​

When you configure Manage1to1 to send through your own Google Workspace or Microsoft 365 account, your email leaves from the same servers that already send your staff's everyday mail. That means:

  • SPF already passes, because Google's and Microsoft's sending servers are already listed in your domain's SPF record.
  • DKIM is signed by Google or Microsoft using your domain's key, as long as DKIM is turned on in your admin console.

This alignment is the main deliverability advantage of OAuth2 sending over a third-party relay: nothing new has to be trusted, because the mail is coming from your own email provider.

tip

If your staff email from @yourschool.org reliably reaches inboxes today, Manage1to1 email sent through the same Google or Microsoft account will too, once DKIM is confirmed below.

Confirm your domain is ready​

1. Check SPF​

Your domain should already publish an SPF record that includes your provider:

  • Google Workspace: the record includes include:_spf.google.com
  • Microsoft 365: the record includes include:spf.protection.outlook.com

Most districts on Workspace or Microsoft 365 have this in place already. Your DNS or IT team can confirm it. A domain should have only one SPF record, so add to the existing one rather than creating a second.

2. Turn on DKIM​

DKIM is the one item districts most often need to enable, because it is off by default:

  • Google Workspace: in the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email, generate the DKIM key for your domain, add the provided record to your DNS, and start authentication.
  • Microsoft 365: in the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → DKIM, select your domain, and enable signing (adding the two provided records to your DNS first).

Once DKIM is enabled, outbound Manage1to1 mail sent through that account is signed automatically.

3. Add or confirm DMARC​

A DMARC record ties SPF and DKIM together and improves inbox placement. If your domain does not have one yet, ask your IT team to add a DMARC record for the domain. A gentle starting policy simply monitors and reports, and can be tightened over time.

note

SPF, DKIM, and DMARC are configured in your domain's DNS and your Google or Microsoft admin console, not inside Manage1to1. Manage1to1's role is to send through the account you authorized; the authentication records live with your domain.

If you use the built-in service or a generic SMTP server​

  • Manage1to1 built-in service: the built-in delivery service is configured for reliable sending out of the box. If your messages display your own district domain as the sender and you want the strongest inbox placement, contact Manage1to1 Support so the correct authorization can be added for your domain.
  • Generic SMTP server: deliverability depends on how your own mail server and domain are set up. Confirm that server's SPF, DKIM, and DMARC with the team that operates it.

Why messages still land in spam​

If mail authenticates but still filters to spam, the usual causes are:

  • DKIM was generated but not switched on, so messages are unsigned.
  • A second, conflicting SPF record exists (only one is allowed).
  • The sending address domain does not match the account you authorized.

Confirm the three checks above, and re-run Test Configuration on the Email Server screen after any change.

Related articles

Loading…