Notes – Schools
This page is intended as companion notes to go along with the Schools webpages. The webpages do dynamic DNS lookups for DMARC records only and refresh periodically. Any domain referenced on the dynamic pages was found to have at least one DNS record of type MX, SPF or DMARC. Whereas this page is static and contains observations pertinent to any aspect of the school domains made during the compilation of the dynamic pages. I hope this page will become out of date as things improve going forward.
Executive summary: the UK Government guidance is clear about what is expected, and yet most schools are nowhere close to complying, which is very disappointing.
Education Scotland
educationscotland.gov.scot is one of the very few domains to have attempted MTA-STS configuration. While it is good that they have attempted it and done most of the work, they have left it in ‘testing‘ mode rather than moving to ‘enforce‘.
seemis.gov.scot has a DMARC record defined, but it only has a RUF address defined. This seems very strange, as RUF is of limited use, with RUA being the primary address for receiving activity data.
glowscotland.org.uk deserves special mention here. It might at first appear not too bad, having a policy of reject on its DMARC record. However, it is extensively used to host websites under the blogs.glowscotland.org.uk subdomain, which is covered by the subdomain policy sp=none.
qualifications.gov.scot has DMARC RUA and RUF addresses defined, but the sqa.org.uk domain hasn’t been authorised to receive any reports and hence won’t have been sent any reports.
Aberdeen
Looks like most email is directed via aberdeencity.gov.uk, and that is adequately protected (DMARC policy of quarantine, but ideally it should be a policy of reject).
However, the aberdeen.sch.uk domains should still have DMARC configured to protect them from spoofing, as many of these domains are used for hosting their websites.
Out of 57 domains identified (i.e., as having either an MX, SPF, or DMARC record), only 4 have DMARC records defined, one of which has a policy of ‘none’.
The following domains all have an SPF record defined which looks like:
v=spf1 include:emp.ifl.net ?all
airyhall.aberdeen.sch.uk
ashleyroad.aberdeen.sch.uk
bramblebrae.aberdeen.sch.uk
broomhill.aberdeen.sch.uk
charleston.aberdeen.sch.uk
culter.aberdeen.sch.uk
cultsprimary.aberdeen.sch.uk
danestone.aberdeen.sch.uk
dyce.aberdeen.sch.uk
dyceacademy.aberdeen.sch.uk
fernielea.aberdeen.sch.uk
ferryhill.aberdeen.sch.uk
forehill.aberdeen.sch.uk
gilcomstoun.aberdeen.sch.uk
glashieburn.aberdeen.sch.uk
greenbrae.aberdeen.sch.uk
hanover.aberdeen.sch.uk
hazlehead-ps.aberdeen.sch.uk
holyfamilyrc.aberdeen.sch.uk
kaimhill.aberdeen.sch.uk
kingsford.aberdeen.sch.uk
kingswells.aberdeen.sch.uk
kirkhill.aberdeen.sch.uk
kittybrewster.aberdeen.sch.uk
loirston.aberdeen.sch.uk
middletonpark.aberdeen.sch.uk
mileend.aberdeen.sch.uk
milltimber.aberdeen.sch.uk
muirfield.aberdeen.sch.uk
northfield.aberdeen.sch.uk
oldmachar.aberdeen.sch.uk
quarryhill.aberdeen.sch.uk
scotstown.aberdeen.sch.uk
skenesquare.aberdeen.sch.uk
st-peters.aberdeen.sch.uk
stjosephsprimary.aberdeen.sch.uk
stoneywood.aberdeen.sch.uk
sunnybank.aberdeen.sch.uk
tullosprimary.aberdeen.sch.uk
walkerroad.aberdeen.sch.uk
woodside.aberdeen.sch.uk
This is bad. The ?all on the end means ‘neutral’ which in effect means anyone can match, thus making the situation worse not better!
I think it’s worth mentioning here that another place I have found an SPF records with what amounts to an unprotected setting of ?all are:
rmplc.co.uk v=spf1 ip4:62.171.221.40/29 ip4:62.171.216.0/23 ?all
emp.ifl.net v=spf1 ip4:217.181.2.48/28 ip4:62.171.216.0/23 ?all
ifl.net v=spf1 ip4:217.181.2.48/28 ip4:62.171.221.40/29 ip4:62.171.216.0/23 ip4:194.154.20.59/32 ?all
These all relate to RM plc the major IT supplier to educational services, and obviously a company who doesn’t understand DMARC and SPF.
Aberdeenshire
The following domains have SPF records without any default policy making them functionally useless.
ellonacademy.aberdeenshire.sch.uk v=spf1 ip4:212.219.248.144 ip4:195.194.219.9 ip4:212.219.248.0/24
gordonschools.aberdeenshire.sch.uk v=spf1 ip4:212.219.248.146 ip4:195.194.219.9 ip4:212.219.248.0/24
mearns.aberdeenshire.sch.uk v=spf1 ip4:212.219.248.159 ip4:195.194.219.9 ip4:212.219.248.0/24
The following domains all have digital certificates on issue such that although the certificates all have www. included in the domain, it implies the base name might be used for email and hence they should all have DMARC records defined to mitigate against possible spoofing abuse.
www.aberchirder.aberdeenshire.sch.uk
www.aboyne-pri.aberdeenshire.sch.uk
www.aboyneacademy.aberdeenshire.sch.uk
www.alehousewells.aberdeenshire.sch.uk
www.alford-pri.aberdeenshire.sch.uk
www.annaritchie.aberdeenshire.sch.uk
www.arduthie.aberdeenshire.sch.uk
www.arnage.aberdeenshire.sch.uk
www.auchenblae.aberdeenshire.sch.uk
www.auchnagatt.aberdeenshire.sch.uk
www.auchterellon.aberdeenshire.sch.uk
www.auchterless.aberdeenshire.sch.uk
www.ballater.aberdeenshire.sch.uk
www.balmedie.aberdeenshire.sch.uk
www.banchory-devenick.aberdeenshire.sch.uk
www.banchoryacademy.aberdeenshire.sch.uk
www.banff-pri.aberdeenshire.sch.uk
www.bartholchapel.aberdeenshire.sch.uk
www.bervie.aberdeenshire.sch.uk
www.boddam.aberdeenshire.sch.uk
www.bracoden.aberdeenshire.sch.uk
www.braemar.aberdeenshire.sch.uk
www.buchanhaven.aberdeenshire.sch.uk
www.burnhaven.aberdeenshire.sch.uk
www.cairney.aberdeenshire.sch.uk
www.carronhill.aberdeenshire.sch.uk
www.catterline.aberdeenshire.sch.uk
www.chapelofgarioch.aberdeenshire.sch.uk
www.clatt.aberdeenshire.sch.uk
www.clerkhill.aberdeenshire.sch.uk
www.cluny.aberdeenshire.sch.uk
www.craigievar.aberdeenshire.sch.uk
www.crathes.aberdeenshire.sch.uk
www.crathie.aberdeenshire.sch.uk
www.crimond.aberdeenshire.sch.uk
www.crombie.aberdeenshire.sch.uk
www.crudie.aberdeenshire.sch.uk
www.cultercullen.aberdeenshire.sch.uk
www.dalespark.aberdeenshire.sch.uk
www.daviot.aberdeenshire.sch.uk
www.drumblade.aberdeenshire.sch.uk
www.drumoak.aberdeenshire.sch.uk
www.dunecht.aberdeenshire.sch.uk
www.dunnottar.aberdeenshire.sch.uk
www.durris.aberdeenshire.sch.uk
www.easterfield.aberdeenshire.sch.uk
www.echt.aberdeenshire.sch.uk
www.ellon-pri.aberdeenshire.sch.uk
www.ellonacademy.aberdeenshire.sch.uk
www.elrick.aberdeenshire.sch.uk
www.fetterangus.aberdeenshire.sch.uk
www.fettercairn.aberdeenshire.sch.uk
www.fintry.aberdeenshire.sch.uk
www.finzean.aberdeenshire.sch.uk
www.fisherford.aberdeenshire.sch.uk
www.fishermoss.aberdeenshire.sch.uk
www.fordyce.aberdeenshire.sch.uk
www.forgue.aberdeenshire.sch.uk
www.foveran.aberdeenshire.sch.uk
www.fraserburgh.aberdeenshire.sch.uk
www.fraserburghnorth.aberdeenshire.sch.uk
www.fraserburghsouthpark.aberdeenshire.sch.uk
www.fyvie.aberdeenshire.sch.uk
www.glass.aberdeenshire.sch.uk
www.glenbervie.aberdeenshire.sch.uk
www.gordon-pri.aberdeenshire.sch.uk
www.gordonschools.aberdeenshire.sch.uk
www.gourdon.aberdeenshire.sch.uk
www.hattoncruden.aberdeenshire.sch.uk
www.hattonfintray.aberdeenshire.sch.uk
www.hillofbanchory.aberdeenshire.sch.uk
www.hillside.aberdeenshire.sch.uk
www.insch.aberdeenshire.sch.uk
www.inverallochy.aberdeenshire.sch.uk
www.inverurie.aberdeenshire.sch.uk
www.johnshaven.aberdeenshire.sch.uk
www.keig.aberdeenshire.sch.uk
www.keithhall.aberdeenshire.sch.uk
www.kellands.aberdeenshire.sch.uk
www.kennethmont.aberdeenshire.sch.uk
www.kincardineoneil.aberdeenshire.sch.uk
www.kinellar.aberdeenshire.sch.uk
www.kingedward.aberdeenshire.sch.uk
www.kininmonth.aberdeenshire.sch.uk
www.kinneff.aberdeenshire.sch.uk
www.kintore.aberdeenshire.sch.uk
www.lairhillock.aberdeenshire.sch.uk
www.largue.aberdeenshire.sch.uk
www.laurencekirk.aberdeenshire.sch.uk
www.lochpots.aberdeenshire.sch.uk
www.logiecoldstone.aberdeenshire.sch.uk
www.logiedurno.aberdeenshire.sch.uk
www.longside.aberdeenshire.sch.uk
www.lumphanan.aberdeenshire.sch.uk
www.lumsden.aberdeenshire.sch.uk
www.luthermuir.aberdeenshire.sch.uk
www.macduff.aberdeenshire.sch.uk
www.mackie.aberdeenshire.sch.uk
www.marykirk.aberdeenshire.sch.uk
www.maud.aberdeenshire.sch.uk
www.mearns.aberdeenshire.sch.uk
www.meethill.aberdeenshire.sch.uk
www.meldrum-pri.aberdeenshire.sch.uk
www.meldrumacademy.aberdeenshire.sch.uk
www.methlick.aberdeenshire.sch.uk
www.midmar.aberdeenshire.sch.uk
www.midmill.aberdeenshire.sch.uk
www.milloforest.aberdeenshire.sch.uk
www.mintlaw-pri.aberdeenshire.sch.uk
www.mintlawacademy.aberdeenshire.sch.uk
www.monquhitter.aberdeenshire.sch.uk
www.monymusk.aberdeenshire.sch.uk
www.newburghmathers.aberdeenshire.sch.uk
www.newdeer.aberdeenshire.sch.uk
www.newmachar.aberdeenshire.sch.uk
www.newpitsligo-st-johns.aberdeenshire.sch.uk
www.newtonhill.aberdeenshire.sch.uk
www.oldrayne.aberdeenshire.sch.uk
www.ordiquhill.aberdeenshire.sch.uk
www.oyne.aberdeenshire.sch.uk
www.peterheadacademy.aberdeenshire.sch.uk
www.peterheadcentral.aberdeenshire.sch.uk
www.pitmedden.aberdeenshire.sch.uk
www.portelphinstone.aberdeenshire.sch.uk
www.porterroll.aberdeenshire.sch.uk
www.portlethen-pri.aberdeenshire.sch.uk
www.portlethenacademy.aberdeenshire.sch.uk
www.portsoy.aberdeenshire.sch.uk
www.premnay.aberdeenshire.sch.uk
www.rathen.aberdeenshire.sch.uk
www.raynenorth.aberdeenshire.sch.uk
www.redmyre.aberdeenshire.sch.uk
www.rhynie.aberdeenshire.sch.uk
www.rosehearty.aberdeenshire.sch.uk
www.rothienorman.aberdeenshire.sch.uk
www.sandhaven.aberdeenshire.sch.uk
www.skene.aberdeenshire.sch.uk
www.slains.aberdeenshire.sch.uk
www.st-andrews-pri.aberdeenshire.sch.uk
www.st-andrews.aberdeenshire.sch.uk
www.st-combs.aberdeenshire.sch.uk
www.st-cyrus.aberdeenshire.sch.uk
www.st-fergus.aberdeenshire.sch.uk
www.strichen.aberdeenshire.sch.uk
www.tarland.aberdeenshire.sch.uk
www.tarves.aberdeenshire.sch.uk
www.tipperty.aberdeenshire.sch.uk
www.torphins.aberdeenshire.sch.uk
www.tough.aberdeenshire.sch.uk
www.towie.aberdeenshire.sch.uk
www.tullynessle.aberdeenshire.sch.uk
www.turriff-pri.aberdeenshire.sch.uk
www.turriff.aberdeenshire.sch.uk
www.tyrie.aberdeenshire.sch.uk
www.udnygreen.aberdeenshire.sch.uk
www.uryside.aberdeenshire.sch.uk
www.westfield.aberdeenshire.sch.uk
www.westhill-pri.aberdeenshire.sch.uk
www.westhillacademy.aberdeenshire.sch.uk
www.whitehills.aberdeenshire.sch.uk
www.ythanbridge.aberdeenshire.sch.uk
Angus
Another council that has moved towards a single domain rather than enabling individual domains for each school. It would therefore be expected that they could at least define a DMARC record for their central domain.
Not a single sign of DMARC compliance that I can find for Angus.
Argyll and Bute Council
Another council that has moved towards a single domain rather than enabling individual domains for each school. Thankfully, their single domain has a well configured DMARC record.
The remaining individual school domains all have a pct=75 meaning that the policy is only applied 75% of the time. Note: the pct tag has been deprecated following the publication of RFC 9989 in May 2026 largely because it was found that pct wasn’t properly implemented by vendors making it very ineffective at best and potentially misleading. If present pct should be set to 100.
Clackmannanshire
Another council that has moved towards a single domain rather than enabling individual domains for each school. Thankfully, their single domain has a well configured DMARC record.
Unfortunately, there doesn’t appear to be any other DMARC records, leaving individual school domains unprotected.
Dumfries & Galloway
Another council that has moved towards a single domain rather than enabling individual domains for each school. Thankfully, their single domain has a well configured DMARC record.
Found a few school domains with email still configured with no DMARC defined.
Dundee
Seems to have adopted one domain for centralising email (dundeeschools.scot) configuration, and another for centralising websites (ea.dundeecity.sch.uk). Neither adequately protected with respect to DMARC.
Also, the following have been identified as websites for Dundee schools and therefore should also be protected by DMARC to prevent possible abuse.
ancrumroad.ea.dundeecity.sch.uk
baldragon.ea.dundeecity.sch.uk
ballumbieprimary.ea.dundeecity.sch.uk
barnhill.ea.dundeecity.sch.uk
blackness.ea.dundeecity.sch.uk
braeview.ea.dundeecity.sch.uk
camperdown.ea.dundeecity.sch.uk
claypotts.ea.dundeecity.sch.uk
clepingtonprimary.ea.dundeecity.sch.uk
craigiebarnsprimary.ea.dundeecity.sch.uk
craigiehighschool.ea.dundeecity.sch.uk
craigowl.ea.dundeecity.sch.uk
densroadprimary.ea.dundeecity.sch.uk
downfield.ea.dundeecity.sch.uk
easternprimary.ea.dundeecity.sch.uk
fintry.ea.dundeecity.sch.uk
forthill.ea.dundeecity.sch.uk
glebelands.ea.dundeecity.sch.uk
grove.ea.dundeecity.sch.uk
harrisacademy.ea.dundeecity.sch.uk
kingspark.ea.dundeecity.sch.uk
longhaugh.ea.dundeecity.sch.uk
millofmains.ea.dundeecity.sch.uk
morgan.ea.dundeecity.sch.uk
ourladysprimary.ea.dundeecity.sch.uk
rosebank.ea.dundeecity.sch.uk
rowantree.ea.dundeecity.sch.uk
st-clements.ea.dundeecity.sch.uk
st-pauls.ea.dundeecity.sch.uk
st-peterpaul.ea.dundeecity.sch.uk
standrewsprimary.ea.dundeecity.sch.uk
stfrancis.ea.dundeecity.sch.uk
stjohnshigh.ea.dundeecity.sch.uk
stjosephsprimary.ea.dundeecity.sch.uk
stpiusprimary.ea.dundeecity.sch.uk
victoriapark.ea.dundeecity.sch.uk
East Ayrshire
Another council that has moved towards a single domain rather than enabling individual domains for each school. Its a pity this single domain has no DMARC protection.
East Dunbartonshire
Lots of individual domains, one for each school, and none of them with any DMARC protection.
East Lothian
This is a very different approach. They have defined their own high level domain (i.e. not part of the sch.uk schema) and then issued a subdomain to each school. Every single one has its own DMARC record and every single one has a policy of reject. What’s more, I can see they are all using the default Microsoft Office 365 implementation of DKIM which is excellent. Top marks for East Lothian.
East Renfrewshire
At first sight it looks as if East Renfrewshire has made a reasonable go of configuring DMARC records for every individual school domain. I say at first sight because looking just beneath the surface it becomes apparent there are two issues which are repeated across every single configuration.
The first issue is there are 4 MX servers defined, and all 4 have certificate errors. They all have a errors in with an incomplete certificate chain, and additionally 2 of them have hostname not in SAN errors.
The second issue, both the RUA and RUF email addresses listed for receiving DMARC reports contain the eastrenfrewshire.gov.uk domain, only it hasn’t been authorised to receive reports hence none will have been sent to them.
Edinburgh
All individual school domains but with a complete absence of any DMARC protection.
Eileanan Siar
Another council that has moved towards a single domain rather than enabling individual domains for each school. Its a pity this single domain has no DMARC protection.
I found a number of schools with varying email configurations, some good, some not.
e-sgoil.com is very curious. It is another which is showing certificate hostname errors on 2 out of their three configured MX servers. A simple mistake which should have been spotted. Two of the MX servers have a TLD of .com while one has a TLD of .eu. They should all be defined as .eu.
Falkirk
Another council that has moved towards a single domain rather than enabling individual domains for each school. They also have another generic domain which doesn’t follow the official schema for sch.uk domains. The schema being <school>.<region>.sch.uk. The non-standard domain being education.falkirk.sch.uk which is at least adequately protected.
Just a shame they have left all of the individual school domains unprotected.
Fife
Another council that has moved towards a single domain rather than enabling individual domains for each school. Thankfully, their single domain has a well configured DMARC record. In fact this the best configuration I have come across with regard to DMARC as not only does it have a strong policy of ‘reject’, it has also correctly implemented MTA-STS ensuing connections are encrypted.
While they have taken care of the basics for the email domain, they have two scenarios when it comes to the individual schools and their websites. It looks as if they are moving towards a centralised model for the websites using a domain of fifedirect.org.uk While www.fifedirect.org.uk has a public trusted certificate issued by Let’s Encrypt on port 443, the MX (Mail eXchange) servers it points to don’t look like proper production servers. They are all subdomains of scotland.net with no DMARC records. They have a self signed certificate (with MD5 hash) and not suitable for an internet facing production environment. The certificate also doesn’t have any SAN (Subject Alternative Names) defined within thereby causing it to error as it cannot match any hostname. Appears to generate a new self signed certificate automatically which is only valid for two hours.