Getting .edu.ph and Google Workspace Education Right for a Private Philippine Institution

Private educational institutions in the Philippines can't just register .edu.ph through a commercial registrar. It goes through PHNET, requires government recognition papers, and has a process most people don't know until they're in it. On top of that, Google Workspace for Education is a separate product from Google Workspace Business — different signup flow, different verification, and free at the Fundamentals tier. Getting both wrong costs days.

This is the process end-to-end.

Registering .edu.ph Through PHNET

PHNET — Philippine Network Foundation — is the sole registry for .edu.ph. Registration is handled through their services portal. No third-party registrar carries it.

Eligibility requires verified government recognition. DepEd for SHS programs, CHED for college. SEC and BIR documents do not qualify. If you submit those, the application stalls and PHNET won't tell you why in the first email.

Required documents:

• Authorization letter on official school letterhead, signed by the school president or principal, dated within 30 days of submission
• Government recognition paper — DepEd recognition certificate (SHS) or CHED recognition certificate (college programs)
• Bank deposit slip for the registration fee (paid to PHNET's bank account, details on their site)

All submitted via email to PHNET support. Keep the total attachment size under 2MB. Scanned multi-page certificates at full resolution get large fast — compress before sending.

The CHED recognition paper was the blocker. It was in the records office in physical form only. Two days to locate and scan it cleanly. The authorization letter needed a physical signature on letterhead, then scanning — another three working days of coordinating with administration. The bank deposit required an in-person trip.

Start collecting documents before doing any technical work. Registration processes quickly once PHNET has everything. The paperwork timeline is entirely outside your control.

Before submitting: set the technical contact to a role-based institutional email, not a personal address. PHNET renewal notices and domain correspondence go to that contact. A personal address that leaves with a person creates a renewal problem that's annoying to fix later.

Pointing DNS to Vercel

I manage DNS through Vercel for this project. After the domain is registered and active in PHNET:

1. Add the .edu.ph domain to your Vercel project under Project Settings → Domains
2. Vercel shows nameservers — typically ns1.vercel-dns.com and ns2.vercel-dns.com
3. Log into PHNET's DNS management panel and update the nameservers for the domain to Vercel's values
4. Wait for propagation — usually under an hour, occasionally longer

Once nameserver delegation is complete, all DNS records for the domain are managed entirely through the Vercel dashboard. PHNET's panel is only needed for nameserver changes and domain renewals at that point.

Vercel will show a warning on the domain until DNS propagates fully. Verify with dig NS [yourdomain].edu.ph — when it returns Vercel's nameservers, you're live.

Setting Up Google Workspace Education

Google Workspace for Education and Google Workspace Business are separate products. Education Fundamentals is free for qualifying institutions. Business is per-user per-month. They have separate signup URLs and separate institutional verification flows. Using the wrong one costs you the domain claim and support wait time to undo it (more on this at the end).

Go through the Google for Education signup, not the standard Workspace signup.

During setup:

1. Enter the institution's .edu.ph domain
2. Verify domain ownership — Google gives you a TXT record to add in Vercel's DNS dashboard
3. Add that TXT record in Vercel, wait a few minutes, confirm in the Google setup wizard
4. Submit institutional verification — upload the DepEd or CHED recognition certificate. Same document used for PHNET.

Google's review for institutional status takes 3–5 business days. They're verifying it's a real accredited institution, not a commercial entity. With the right government papers it clears without back-and-forth.

Education Fundamentals tier gives you Gmail, Drive, Docs, Meet, and Classroom at no cost. For a private institution that's just getting formal systems in place, this covers everything needed: institutional email, file storage, and basic Classroom delivery. The paid tiers (Standard, Teaching and Learning Upgrade, Plus) add advanced audit logs, enhanced security controls, and premium Meet features — none of which matter at this stage.

Account allocation. Education Fundamentals has a user account limit. For a small institution it's workable, but the limit forces a real decision about who gets institutional email. Accounts I provisioned first:

1. School president — CHED and DepEd correspondence
2. Registrar (primary) — enrollment records, portal access
3. Registrar (backup) — so this role is never a single point of failure
4. Finance officer — billing, scholarship coordination
5. IT admin — domain management, system alerts
6. info@ — general external inquiries 7–8. Two department heads with the most external-facing communication

Faculty and internal coordination stays on personal Gmail for now. That's the realistic starting point at the free tier. Budget for paid licenses before capacity becomes a constraint, not after.

Email Authentication Records

With Workspace Education live, these four DNS records go into Vercel's dashboard:

MX records. Directs inbound mail to Google's servers. Values come from the Admin console under Setup → Set up Gmail. Five records, each with a priority value.

SPF.

v=spf1 include:_spf.google.com ~all

Declares Google's infrastructure as authorized to send from the domain. Without this, outbound Workspace mail hits spam consistently.

DKIM. Go to Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate the key pair there. Google gives you the public key as a TXT record value and the selector subdomain to publish it at. Add that TXT record in Vercel. Return to the Admin console and click "Start authentication" once it propagates.

DMARC.

v=DMARC1; p=none; rua=mailto:admin@[institution].edu.ph

Start at p=none with aggregate reporting. Run it for at least a week before moving to p=quarantine or p=reject.

The monitoring week is not optional. The institution's system sends transactional emails — enrollment status updates, student credential delivery — through a separate SMTP relay, not through Google's servers directly. That relay wasn't in the initial SPF record. The DMARC aggregate reports caught it as an SPF fail before enforcement would have silently dropped those emails. Fixed the SPF record to include the relay's IP, monitored a few more days, then moved to p=quarantine.

You will find a sending path you forgot. That's what the monitoring week is for.

The Domain Claim Mistake

While waiting on PHNET, I started exploring the Google Workspace admin console using the institution's actual domain — it was already in Vercel for DNS work, so it felt available. I completed domain verification under a Google Workspace Business account.

When I went to create the Education account: Google rejected it. One domain can only be claimed by one Workspace account. The Business account held the claim.

Fix: contact Google Workspace support, request the Business account deleted, wait for the domain to release. Ownership proof wasn't the issue — admin access and DNS control made that easy. The wait was several days of support back-and-forth.

Use a throwaway domain for any Workspace test setup. Never the client's actual domain.