42% of US county election sites still lack .gov domains
Original title: Election Website Security: 42% of US County Sites Still Lack .gov Domains
Of 2,081 county election sites, 869 are off .gov; about 51% of contact domains lack enforced DMARC.
Mysterium VPN's 2026 County Election Website Security Census reviewed 2,081 county election information sites in the United States. Forty-two percent, 869 sites, were not on .gov, down from 57% in 2024; weighted by population the share is 28%. Among 942 county-controlled contact domains, 23% had no DMARC record and 28% used p=none. The study also found HTTPS failures, limited HSTS use, widespread third-party trackers, and lookalike domains outside government control. It covers public information sites and does not show voting systems were compromised.
Unconfirmed: The report's DMARC counts total 941 rather than the stated 942, and tracking presence does not prove what data was collected.
- Texas accounted for 169 non-.gov sites; Arizona and Nebraska had none identified.
- SPF was present on 98% of checked domains; domains without DMARC fell from 41% in 2024 to 23%.
- Twenty-eight of 2,081 sites had consistent HTTPS failures; only 34% sent an HSTS header.
- Of 1,930 measured pages, 84% contacted at least one tracker; 121 matching names were registered outside government.
Impact: Voters may face impersonation sites, spoofed email, and third-party tracking
- 1.Move county election sites to .gov and redirect older addresses.
- 2.Enforce DMARC beyond p=none on county-controlled election email domains.
- Organizations
- Mysterium VPNFBICISA
- Countries
- United States
From the original article
6 min read at securityaffairs.com
US election websites show improved security, but weak email protection, non-. gov domains and third-party tracking still expose voters to risks. Millions of Americans will use websites to check their registration, find polling places or track ballots before the November 3 election.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.