2026 County Election Website Security Census: Key Findings

The four figures this census turns on. Every rate is stated over the counties it was measured in.

get.gov, the registrar for the .gov top-level domain, states the rule plainly: only verified US government organizations can register a .gov. On the other hand, anyone with a bank card can register the .com, the .org, or the .us.

A voter who goes to countyname-elections.com has no way to tell whether the county actually runs it. Ahead of the 2024 election, the FBI and CISA warned that spoofed election websites were already being used to push disinformation and harvest personal data.

We identified a county-run page displaying election information for 2,081 of the 3,144 counties. 869 of them publish it somewhere other than .gov.

Where county election websites live, 2024 against 2026. .gov is the only ending a voter can verify

That's a fifteen-point improvement on 2024, and it's a real migration rather than a quirk of how we measured. Dozens of counties that used a co.<name>.<st>.us or .org address two years ago now redirect to a new .gov.

The gain sits with the larger counties. Weighted by population, 28% of Americans live in a county whose election page doesn't end in .gov.

The weakest states are mostly the same as in 2024, with slow improvement. At the other end, Arizona and Nebraska have no non-.gov county election sites at all among those we identified, and Iowa has one.

States with at least five identified county election sites. Texas alone accounts for 169 non-.gov sites, 134 of them on the co.<county>.tx.us pattern that predates .gov opening to local government.

51% of County Election Email Domains Can Be Impersonated

This finding didn't improve, and it matters most to you as an individual voter. Email is where the conversation moves once the website has done its job.

Of the 1,977 election pages whose content we could read, 965 display a contact address. Twenty-three of those are at consumer providers like Gmail. As in 2024, we set them aside, because Gmail's security policy is Gmail's, not the county's. That leaves 942 county-controlled election email domains.

A domain's DMARC record can be missing, or it can be set to one of three policies, from weakest to strongest:

In 2024, 41% of contact domains had no DMARC at all. That figure has improved to 23%. Count only the policies that act, though, and 51% of county election email domains would deliver a spoofed message to a voter's inbox.

p=none is the setting every monitoring vendor recommends as step one, and it's the setting a great many domains never leave.

Two Things Qualify the Improvement

• Coverage: This census reaches fewer of the smallest counties than the 2024 manual one did, and small counties are where DMARC is rarest. Among the one-third of counties with the fewest residents, 34% of election contact domains have no record at all, compared with 12% in the largest third.
• The domain: Election addresses on a .gov lack DMARC 16% of the time and lack an enforced policy 44% of the time. On non-.gov domains, those figures are 32% and 60%. Moving to .gov is dragging email security along behind it.

SPF, an older and weaker sender check, is nearly universal at 98%. Twelve domains have neither SPF nor DMARC.

The Worst States for Email Protection

Counting only states with at least five domains checked, these have the most election email domains without an enforced policy:

• North Dakota: 11 of 11
• Louisiana: 11 of 12
• Mississippi: 9 of 11
• Nevada: 8 of 11
• Kentucky: 10 of 14

The 23 counties doing election business from a consumer mailbox cluster in Arkansas and Georgia (five each), followed by Texas (three), Tennessee (two), and Alabama (one).

28 Pages Can’t Be Reached Securely

In 2024, "Has SSL" was a yes-or-no question, and 85 county election websites failed it. This time, we checked every host twice and counted only consistent failures. A single timeout is a bad day on a server, not a finding.

Of 2,081 hosts, 28 fail:

• 15 have no working HTTPS listener;
• 7 answer with a certificate issued for a different name;
• 2 have an expired certificate;
• 2 are self-signed or untrusted;
• 2 fail the secure handshake outright.

The quieter number is 178. That's how many hosts will happily serve the election page over unencrypted HTTP if the voter types the address without the https://. Only 34% send an HSTS header, a setting that tells the browser never to accept the unencrypted version. Sixty-three certificates expire within 30 days of Election Day.

What the Website Does Before the Voter Touches Anything

For the first time, we also opened every readable election page in a clean browser and recorded what it did on its own: no clicks, no scrolling, one load.

84% of 1,930 pages contacted at least one company on the Disconnect or DuckDuckGo tracker lists. The median page spoke to six third-party domains before showing the voter a word about voting.

None of this is illegal, and almost none of it is deliberate. It's the default behavior of the content-management platforms counties buy, switched on by a vendor and never revisited.

It's still a choice. A page whose entire job is to tell a citizen where and how to vote doesn't need to tell an advertising network that the citizen was there.

The Name Is Still Free

The case for .gov is that it can't be imitated. The case for not stopping at .gov is that the name can be.

For every county and state election domain whose name clearly refers to a county or voting, we checked whether the same name exists under .gov, .com, .org, .net, .us, .info, .vote, .co, and .online.

2,074 of those twins resolve to a live address. Most show nothing on the web. They're leftovers from wildcard DNS settings and dormant registrations. Forty-eight redirect to the official website, which means counties bought their own copies. That's the right answer.

121 are registered and not under government control:

• 38 serve a live site unrelated to the county;
• 8 are openly for sale;
• 73 show a bare server or hosting placeholder;
• 2 serve gambling or spam.

Seventy-three counties whose election page isn't on .gov already have a .gov version of the same name registered and working. The migration has been paid for but not finished.

One Keystroke Away

We also generated every single-keystroke misspelling of 77 state and large-county election domains (14,456 variants) and checked which ones exist. 245 are registered.

Counting only names long enough that a match isn't a coincidence, 26 serve parked, placeholder, or unrelated pages. These include a cluster of misspellings of Florida's myflorida.com, one of which serves an online casino.

We don't know who registered these domains or why, and we don't claim that any of them is malicious. What we know is narrower, and it's enough: a voter who guesses the .com, or mistypes one character, doesn't reach the county. Anyone can buy the parked ones today for about the price of a sandwich.

Where This Lands on 3rd November

Across the seven states that decided the 2024 presidential election, 43% of identified county election websites are not .gov, compared with 55% two years ago. 26% of election contact domains have no DMARC at all, improved from 39%, but 55% have no enforced policy.

The 2026 Senate map is a different set of states and a worse picture. In the nine states rated toss-up or lean in mid-October, 53% of identified county election websites are not .gov, and 44% of election contact domains have no enforced DMARC.

What Should Change

• Finish the .gov move: It's free for US government organizations through CISA, and 73 counties have already registered the name they aren't using. Point it at the website and redirect the old one.
• Change p=none to p=quarantine: It's one DNS record. It's the difference between being told about a forged email from your election office and never receiving it.
• Redirect HTTP to HTTPS and send HSTS: 178 counties are one typed address away from serving a voter an unencrypted page.
• Take advertising pixels off voter-information pages: Analytics for the county is defensible. A Meta Pixel on a polling-place lookup is not.
• Buy your own name-twins, or at least check them: Thirty dollars a year beats explaining to a reporter what the .com version of your county is serving.

For Voters, on the Day

• Start with your state's election office, as listed on usa.gov, and follow its link to your county.
• Type the address yourself rather than trusting a search result or a link in an email.
• On the county page, look for .gov in the address bar and a padlock with no warning attached.
• If you email an election office and the reply comes from a .com or Gmail address, call the courthouse. It takes two minutes.

Methodology

We started with the Census Bureau's list of 3,144 counties and county equivalents. For each one, we took the county's official website from Wikidata and cross-checked it against CISA's public .gov registry, which also lists 324 dedicated county election-office domains.

We then followed the site's links to the page showing election or voter information. As in 2024, we never used a state site or a national aggregator. Sites built on JavaScript menus were re-run in a real browser.

On each page, we recorded the displayed contact address. We then checked that domain's DMARC, SPF, and MX records over DNS, along with the page host's certificate, redirect behavior, and HSTS header.

Each readable page was loaded once in a fresh Chromium browser profile, and every third-party request was matched against the Disconnect and DuckDuckGo lists. Lookalike domains were resolved over DNS and classified from a single fetch.

391 county sites refused our automated request. We didn't retry them with a different identity, route, or tool. A website that declines to talk to a bot is making a defensible choice, and working around it would have made every number in this study impossible to reproduce. Those counties are reported as their own category and excluded from every rate. For the 44 largest of them, the research team identified the official election site by hand from ordinary search results.

Every figure here was recomputed by a separate script that reads only the raw per-county files and rebuilds the definitions from scratch. The county-level dataset is published alongside the study, so any number in it can be checked against the row it came from.

Limitations

We identified an election page for 2,081 counties. The 2024 manual census found 2,913. Automated discovery favors larger counties with well-structured websites. That means the comparison with 2024 is indicative rather than exact, and the smallest counties are underrepresented in exactly the measures where they perform worst.

DMARC and SPF are checked on the domain of the address the page displays. A county may route mail through something else internally. Still, the displayed address is what a voter replies to and what an attacker imitates.

The tracker measurement is one page load from one location. Sites that vary by region, or that load trackers only after a click, are undercounted. Lookalike classification is automated and deliberately conservative.

Everything here was true on October 17th, 2026. Certificates expire, DNS records change, and some of these figures will have moved by the time you read this.

Summary

On 3rd November, millions of Americans will do the same small thing: open a browser and look up their county. Where do I vote, am I registered to vote, who do I email about the ballot I never received? Almost none of them will think about the letters in the address bar.

A 2024 manual census of every US county found that 57% of county election websites sat on domains anyone can register, and that 41% of the contact addresses on those pages had no DMARC record (an email security protocol that stops spoofing, phishing, and business email compromise) protecting them from forgery. 

We rebuilt that census for 2026, automated and repeatable, keeping every raw observation, and added the things the 2024 study couldn’t measure: whether the DMARC that exists is actually switched on, whether the website forces HTTPS, which companies are told that a voter visited, and how many copies of official election domain names are sitting in other people's hands.

42% of county election pages are still not on .gov, down fifteen points. But of the 942 election contact domains we could check, only 49% publish a DMARC policy that does anything. The rest either have no record or have one set to p=none, which tells the county about forged mail but still delivers it.