FACTS DKIM, DMARC & SPF Setup Guide

Key Takeaways

DKIM is your primary focus. FACTS does not support Return-Path domain matching for custom sender domains, meaning SPF will almost always fail DMARC alignment. You must rely on a custom DKIM signature to pass DMARC checks.
Request custom DKIM values. There are no universal DNS values for FACTS. You must explicitly contact their support team to enable custom DKIM signing for your specific school domain.
Merge SPF carefully. If FACTS support provides an SPF include or IP address, add it to your existing SPF record. Never create a second SPF TXT record.
Begin with a simple DMARC monitoring policy (p=none) to receive aggregate reports and review your traffic before moving to a strict enforcement policy.
Use a third-party DMARC checker tool like PowerDMARC to instantly verify your DNS configurations are live and functioning correctly.

If your school or educational institution relies on FACTS to manage student information systems (SIS) and send critical communications to families, setting up proper domain authentication is an absolute must.

Configuring proper email authentication (SPF, DKIM, and DMARC) ensures your school’s domain is protected from spoofing and guarantees that your vital alerts, attendance notices, and billing messages safely land in parents’ inboxes rather than getting flagged as spam.

Why Authenticate Your Domain for FACTS?

FACTS is a leading platform used by private schools for admissions, tuition management, and family communications.

When you accurately configure the necessary security protocols for FACTS, you will see immediate benefits:

Stronger Protection: Safeguards your school’s domain against phishing and spoofing attacks targeting your students’ families.
Increased Deliverability: Ensures strict mailbox providers (like Gmail and Yahoo) trust your emails, keeping critical school communications out of the junk folder.
Boosted Reputation: Enhances your sender score and establishes trust with global email networks.
Actionable Visibility: Grants transparent insights into every system and third-party vendor sending emails on behalf of your school.

Steps to Configure FACTS SPF and DKIM Records

Because FACTS handles custom domains on a strict account-by-account basis, you will need access to your DNS management console and assistance from FACTS support.

Step 1: Contact FACTS Support for Custom DKIM

To pass DMARC, your emails must be signed with a DKIM key that matches your visible “From” address.

1. Log in to your FACTS SIS administrator portal.

2. Verify the exact sender email address used for your school communications (e.g., [email protected]).

3. Contact FACTS support and formally request that they enable custom DKIM signing for that specific domain.

4. FACTS support will generate and provide you with a unique DKIM selector, hostname, and target CNAME value.

Step 2: Add the DKIM Record to Your DNS

Head over to your DNS provider (e.g., Cloudflare, GoDaddy, Namecheap) where your school’s domain is managed. Create a new CNAME record using the details provided by FACTS.

Type: CNAME
Host/Name: [selector]._domainkey (e.g., facts1._domainkey)
Value/Target: Use the exact target URL provided by FACTS support.

Once saved, reply to your FACTS support ticket and ask them to validate and activate the DKIM signing on their end.

You can check the record itself with PowerDMARC’s DKIM checker.

Step 3: Handle Your SPF Record

Because FACTS uses their own servers in the hidden Return-Path of your emails, SPF alignment will inherently fail during DMARC checks. This is normal, which is why your DKIM setup is so crucial.

However, if FACTS support provides you with a specific include mechanism or IP range for SPF, you should add it to your DNS.

If you have an existing SPF record (e.g., for Google Workspace or Microsoft 365), simply merge the FACTS include into it before the ~all tag:

Value: v=spf1 include:_spf.google.com include:[provided_facts_spf] ~all

Important: Do not create a second SPF TXT record. Having multiple SPF records will result in a PermError and cause your emails to fail authentication entirely.

If you’re managing several sending sources and getting close to the limit, our Hosted SPF solution is worth looking into, and you can check your current record with PowerDMARC’s SPF checker.

Steps to Enable FACTS DMARC Record

You shouldn’t fly blind when configuring a tool as important as FACTS. If you don’t have a DMARC record with reporting enabled, you won’t know if legitimate school emails are failing authentication or if bad actors are spoofing your domain.

Instead of guessing, use PowerDMARC’s free DMARC record generator to create a comprehensive record.

1. Go to PowerDMARC’s Free DMARC Record Generator tool.

2. For the Policy, select p=none (monitor-only mode). This ensures no emails get blocked initially, allowing you time to safely review your traffic before moving to enforcement.

If you are confused about what p=none is, here is a concise explanation of the DMARC policies:

p=none (Monitor): Delivers all mail normally but generates reports showing who is sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam/junk folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely, preventing them from being delivered.

Note: Jumping straight to p=reject risks blocking legitimate staff emails or other school software. Start with p=none to map out your mail flow safely.

1. Add your dedicated IT or security email address to the Reporting field to receive your DMARC aggregate reports (rua).

2. Log into your DNS management console and add a new record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save the record.

Verify Your Setup

Step 1: Test a Live Email

Send a real FACTS email (like an attendance alert or test message) to a mailbox you control. Inspect the message headers and confirm that the Authentication-Results show a DKIM “Pass” and that the d= domain matches your school’s domain.

Step 2: Run a Final Check with PowerDMARC

To guarantee that your configuration is fully accurate and active, follow these verification steps:

Use PowerDMARC’s free DMARC Record Checker to instantly verify that your record is published correctly.

What to expect in your domain health results:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Valid (even if alignment fails in practice due to FACTS infrastructure, the record itself should be valid).

Final Words

Securing a school’s email infrastructure is critical for keeping families informed and protected. If you want to take your email security further, move securely from p=none to DMARC enforcement without disrupting school operations, configure BIMI to display your school’s logo in the inbox, and monitor your automated reports seamlessly, the PowerDMARC team is here to help.

Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

FACTS DKIM, DMARC, and SPF Setup Guide