National Government Security Report Card

Real-time security posture data across 29,258 tracked government domains

78,906

Government organizations in the U.S. Census directory

21,134

Domains assessed for security

51

States and territories covered

Web Security

93%

Valid SSL/TLS

19,729 of 21,134

70%

HTTPS Redirect

14,749 of 21,134

28%

HSTS Enabled

5,880 of 21,134

91%

Certificate Valid

19,198 of 21,134

2%

CAA Record

354 of 21,134

27%

X-Frame-Options

5,614 of 21,134

44%

X-Content-Type

9,401 of 21,134

1%

security.txt

172 of 21,134

Email Security

47%

SPF Configured

10,027 of 21,134

45%

DKIM Signing

9,571 of 21,134

24%

DMARC Enforced

4,983 of 21,134

0%

MTA-STS

71 of 21,134

1%

TLS-RPT

186 of 21,134

DNS & Infrastructure

5%

DNSSEC

961 of 21,134

13%

IPv6 Support

2,839 of 21,134

67%

RPKI Valid

14,255 of 21,134

17%

.gov Domain

3,616 domains on .gov

Top States by Website Coverage

StateGovernmentsWith WebsitesCoverage
California 3,518 1,825 52%
Illinois 6,043 1,621 27%
Pennsylvania 4,311 1,579 37%
Texas 4,575 1,431 31%
New York 2,775 1,386 50%
Michigan 2,293 1,300 57%
Colorado 3,875 1,291 33%
Ohio 3,300 1,174 36%
Florida 2,072 1,113 54%
Minnesota 3,310 1,047 32%
Wisconsin 2,598 1,017 39%
Washington 1,583 753 48%

Recently Checked Domains

DomainCheckedSecurity Checks
portofcleveland.com
CWeb Security4/8
Web Security
✓ SSL/TLS
✓ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
B-Email Security3/5
Email Security
✓ SPF
✓ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
B-DNS & Infrastructure2/3
DNS & Infrastructure
✗ DNSSEC
✓ IPv6
✓ RPKI
ritaohio.com
B-Web Security5/8
Web Security
✓ SSL/TLS
✗ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✓ X-Frame
✓ X-Content
✗ sec.txt
C-Email Security2/5
Email Security
✗ SPF
✓ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
csuohio.edu
B+Web Security6/8
Web Security
✓ SSL/TLS
✓ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✓ X-Frame
✓ X-Content
✗ sec.txt
B-Email Security3/5
Email Security
✓ SPF
✓ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
B-DNS & Infrastructure2/3
DNS & Infrastructure
✗ DNSSEC
✓ IPv6
✓ RPKI
cuyahogaswcd.org
D-Web Security2/8
Web Security
✓ SSL/TLS
✗ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
C-Email Security2/5
Email Security
✓ SPF
✓ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
FDNS & Infrastructure0/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✗ RPKI
clevelandmetroparks.com
B-Web Security5/8
Web Security
✓ SSL/TLS
✓ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✓ X-Content
✗ sec.txt
C-Email Security2/5
Email Security
✗ SPF
✓ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
B-DNS & Infrastructure2/3
DNS & Infrastructure
✗ DNSSEC
✓ IPv6
✓ RPKI
coshoctonlibrary.org
B+Web Security6/8
Web Security
✓ SSL/TLS
✓ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✓ X-Frame
✓ X-Content
✗ sec.txt
C-Email Security2/5
Email Security
✓ SPF
✓ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
crawfordparkdistrict.org
D-Web Security2/8
Web Security
✓ SSL/TLS
✗ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
D-Email Security1/5
Email Security
✓ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
cuyahogalibrary.org
B+Web Security6/8
Web Security
✓ SSL/TLS
✓ HTTPS
✓ HSTS
✓ Cert
✗ CAA
✓ X-Frame
✓ X-Content
✗ sec.txt
C-Email Security2/5
Email Security
✗ SPF
✓ DKIM
✓ DMARC
✗ MTA-STS
✗ TLS-RPT
B-DNS & Infrastructure2/3
DNS & Infrastructure
✗ DNSSEC
✓ IPv6
✓ RPKI
crawfordswcd.org
FWeb Security1/8
Web Security
✗ SSL/TLS
✗ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✗ X-Content
✗ sec.txt
FEmail Security0/5
Email Security
✗ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI
clermontmha.org
CWeb Security4/8
Web Security
✓ SSL/TLS
✓ HTTPS
✗ HSTS
✓ Cert
✗ CAA
✗ X-Frame
✓ X-Content
✗ sec.txt
D-Email Security1/5
Email Security
✓ SPF
✗ DKIM
✗ DMARC
✗ MTA-STS
✗ TLS-RPT
D+DNS & Infrastructure1/3
DNS & Infrastructure
✗ DNSSEC
✗ IPv6
✓ RPKI

The Numbers Tell a Troubling Story

Only 24% of government domains enforce DMARC -- meaning attackers can impersonate 76% of government agencies via email. Only 5% use DNSSEC. Only 28% enforce HSTS. When these gaps overlap, the risk compounds into real-world attacks that cost taxpayers millions.

In early 2026, the City of Arab, Alabama lost over $430,000 to a phishing attack -- entirely preventable with basic email security that costs under $250/year. Read the full story.

Check Your Local Government Get Professional Help — Starting at $250/year

Make Your Voice Heard

Your tax dollars fund government IT. When basic security isn't implemented, you pay for the breach recovery, ransomware payments, and legal settlements. Share your local government's security grade with your community -- post it on Facebook, tag your representatives on X, or bring it up at your next city council meeting.

Public awareness is the single most effective way to drive change in government cybersecurity.