National Government Security Report Card

Real-time security posture data across 29,258 tracked government domains

78,906

Government organizations in the U.S. Census directory

21,133

Domains assessed for security

51

States and territories covered

Web Security

93%

Valid SSL/TLS

19,728 of 21,133

70%

HTTPS Redirect

14,744 of 21,133

28%

HSTS Enabled

5,872 of 21,133

91%

Certificate Valid

19,194 of 21,133

2%

CAA Record

353 of 21,133

27%

X-Frame-Options

5,616 of 21,133

45%

X-Content-Type

9,407 of 21,133

1%

security.txt

171 of 21,133

Email Security

47%

SPF Configured

10,025 of 21,133

45%

DKIM Signing

9,579 of 21,133

24%

DMARC Enforced

4,988 of 21,133

0%

MTA-STS

71 of 21,133

1%

TLS-RPT

186 of 21,133

DNS & Infrastructure

5%

DNSSEC

958 of 21,133

13%

IPv6 Support

2,845 of 21,133

67%

RPKI Valid

14,256 of 21,133

17%

.gov Domain

3,616 domains on .gov

Top States by Website Coverage

StateGovernmentsWith WebsitesCoverage
California 3,518 1,825 52%
Illinois 6,043 1,621 27%
Pennsylvania 4,311 1,579 37%
Texas 4,575 1,431 31%
New York 2,775 1,386 50%
Michigan 2,293 1,300 57%
Colorado 3,875 1,291 33%
Ohio 3,300 1,174 36%
Florida 2,072 1,113 54%
Minnesota 3,310 1,047 32%
Wisconsin 2,598 1,017 39%
Washington 1,583 753 48%

Recently Checked Domains

DomainCheckedSecurity Checks
pldd.org
D+Web Security3/8
Web Security
✓ SSL/TLS
✓ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
FEmail Security0/5
Email Security
✗ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
FDNS & Infrastructure0/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✗ RPKI
portofsouthwhidbey.com
CWeb Security4/8
Web Security
✓ SSL/TLS
✓ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✓ sec.txt
D-Email Security1/5
Email Security
✗ SPF
✓ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
FDNS & Infrastructure0/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✗ RPKI
toandos.org
CWeb Security4/8
Web Security
✓ SSL/TLS
✓ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
FEmail Security0/5
Email Security
✗ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
portoc.org
B-Web Security5/8
Web Security
✓ SSL/TLS
✓ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✓ X-Frame
✓ X-Content
✗ sec.txt
D-Email Security1/5
Email Security
✓ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
ejfr.org
D+Web Security3/8
Web Security
✓ SSL/TLS
✓ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
B-Email Security3/5
Email Security
✓ SPF
✓ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
FDNS & Infrastructure0/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✗ RPKI
portofpt.com
D+Web Security3/8
Web Security
✓ SSL/TLS
✓ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
C-Email Security2/5
Email Security
✗ SPF
✓ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
swparks.org
CWeb Security4/8
Web Security
✓ SSL/TLS
✓ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✓ sec.txt
D-Email Security1/5
Email Security
✓ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
FDNS & Infrastructure0/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✗ RPKI
freelandwsd.com
D+Web Security3/8
Web Security
✓ SSL/TLS
✗ HTTPS
✗ HSTS
✓ Cert
✓ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
FEmail Security0/5
Email Security
✗ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
islandtransit.org
B+Web Security6/8
Web Security
✓ SSL/TLS
✓ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✓ X-Frame
✓ X-Content
✗ sec.txt
D-Email Security1/5
Email Security
✗ SPF
✗ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
mapleleafcemetery.com
FWeb Security1/8
Web Security
✓ SSL/TLS
✗ HTTPS
✗ HSTS
✗ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
D-Email Security1/5
Email Security
✓ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI

The Numbers Tell a Troubling Story

Only 24% of government domains enforce DMARC -- meaning attackers can impersonate 76% of government agencies via email. Only 5% use DNSSEC. Only 28% enforce HSTS. When these gaps overlap, the risk compounds into real-world attacks that cost taxpayers millions.

In early 2026, the City of Arab, Alabama lost over $430,000 to a phishing attack -- entirely preventable with basic email security that costs under $250/year. Read the full story.

Check Your Local Government Get Professional Help — Starting at $250/year

Make Your Voice Heard

Your tax dollars fund government IT. When basic security isn't implemented, you pay for the breach recovery, ransomware payments, and legal settlements. Share your local government's security grade with your community -- post it on Facebook, tag your representatives on X, or bring it up at your next city council meeting.

Public awareness is the single most effective way to drive change in government cybersecurity.