Research

DMARC in US public school districts, by state: October 2026

A DNS scan of US public school districts on 14 October 2026: 40.3% of districts with mail enforce DMARC, and 59.7% do not. Results by state.

By Updated Last verified

On this page
  1. Results by state
  2. What the policies mean
  3. Prior work
  4. Method
  5. Check a district domain
  6. Sources

On 14 October 2026 we scanned the domains of US public school districts for DMARC. Of the 10,776 districts whose domain publishes a mail server (MX), per the aggregate dataset, 40.3% enforce DMARC with p=quarantine or p=reject. The other 59.7% do not: 32.8% have no DMARC policy in effect and 26.9% sit at p=none. The NCES file lists 13,412 open regular districts; 12,975 of them are in the states this page covers, and 10,776 of those count as mail districts. By state, the share that does not enforce runs from 29.8% in North Carolina to 100.0% in West Virginia, where only 21 of the 55 West Virginia districts in the file count as mail districts.

Results by state

Every percentage is a share of the districts in that row whose domain publishes MX, as the dataset README defines it. The not-enforcing column is no DMARC policy plus p=none. The numbers come from the aggregate dataset.

State Mail districts No DMARC policy p=none Enforced Not enforcing
Alabama 120 39.2% 17.5% 43.3% 56.7%
Arizona 177 39.0% 34.5% 26.6% 73.4%
Arkansas 204 40.7% 13.2% 46.1% 53.9%
Bureau of Indian Education 91 58.2% 17.6% 24.2% 75.8%
California 882 31.0% 23.6% 45.5% 54.5%
Colorado 158 36.7% 29.7% 33.5% 66.5%
Connecticut 155 27.7% 34.2% 38.1% 61.9%
Delaware 13 38.5% 15.4% 46.2% 53.8%
Florida 60 20.0% 21.7% 58.3% 41.7%
Georgia 59 35.6% 35.6% 28.8% 71.2%
Illinois 721 42.2% 25.2% 32.6% 67.4%
Indiana 276 25.4% 27.5% 47.1% 52.9%
Iowa 297 31.3% 25.3% 43.4% 56.6%
Kansas 267 40.1% 26.2% 33.7% 66.3%
Kentucky 119 2.5% 86.6% 10.9% 89.1%
Maine 185 30.3% 34.6% 35.1% 64.9%
Maryland 22 18.2% 36.4% 45.5% 54.5%
Massachusetts 296 24.3% 32.4% 43.2% 56.8%
Michigan 462 21.9% 32.3% 45.9% 54.1%
Minnesota 294 36.1% 25.9% 38.1% 61.9%
Mississippi 127 50.4% 15.7% 33.9% 66.1%
Missouri 458 37.1% 27.1% 35.8% 64.2%
Montana 264 37.1% 22.3% 40.5% 59.5%
Nevada 16 43.8% 25.0% 31.2% 68.8%
New Hampshire 44 59.1% 13.6% 27.3% 72.7%
New Jersey 525 28.6% 24.4% 47.0% 53.0%
New Mexico 82 43.9% 23.2% 32.9% 67.1%
New York 570 20.4% 40.0% 39.6% 60.4%
North Carolina 104 14.4% 15.4% 70.2% 29.8%
North Dakota 63 33.3% 60.3% 6.3% 93.7%
Ohio 527 43.3% 30.9% 25.8% 74.2%
Oklahoma 477 68.8% 19.7% 11.5% 88.5%
Oregon 157 28.7% 23.6% 47.8% 52.2%
Pennsylvania 479 27.1% 31.3% 41.5% 58.5%
South Carolina 72 22.2% 18.1% 59.7% 40.3%
South Dakota 16 50.0% 43.8% 6.2% 93.8%
Tennessee 107 42.1% 17.8% 40.2% 59.8%
Texas 972 20.2% 17.9% 61.9% 38.1%
Utah 37 24.3% 16.2% 59.5% 40.5%
Vermont 55 47.3% 21.8% 30.9% 69.1%
Virginia 121 24.0% 28.1% 47.9% 52.1%
Washington 180 28.3% 29.4% 42.2% 57.8%
West Virginia 21 85.7% 14.3% 0.0% 100.0%
Wisconsin 400 27.8% 26.5% 45.8% 54.2%
Wyoming 44 27.3% 40.9% 31.8% 68.2%
All covered districts 10,776 32.8% 26.9% 40.3% 59.7%

Seven jurisdictions with one or two districts each are left out of every row, the all-covered-districts row included, so no row describes or reveals a single district.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

What the policies mean

The three policy values (opens in a new tab) ask for different things. With p=none the domain owner offers no preference. With p=quarantine the owner considers failing mail suspicious. With p=reject the owner treats a failure as a clear sign that the use of the domain is not valid.

RFC 9989 defines Enforcement (opens in a new tab) as a state where the policy for an organizational domain and all subdomains below it is not p=none. The dataset README counts p=quarantine plus p=reject as enforced. Of the 4,342 enforced districts in the dataset, 320 set sp=none, which leaves subdomains at none, so their subdomains are not under Enforcement as RFC 9989 defines it, and 6 set pct=0.

Prior work

BuzzClan analyzed 19,281 K-12 school districts (opens in a new tab) in a study dated Apr 30, 2026 and reported 48.3% with no DMARC. Our aggregate dataset breaks the results down by state.

Method

The dataset README sets out the definitions. In short:

  • The input is the NCES Common Core of Data directory of local education agencies for school year 2024-25. We kept open regular public school districts that list a website.
  • Idaho, Louisiana and Nebraska list no district websites in that file, so their districts are not covered.
  • Each website address was reduced to its registrable domain. Where three or more districts share that domain, as in a state network, the district's own host name was scanned instead.
  • We scanned every domain with DemiSignal's DNS checker, the same DMARC, SPF and MX checks the free check runs. The scan read public DNS only. It sent no email and read no DMARC reports.
  • The unit is the district: districts that share a domain each count once, with that domain's result.
  • A district website domain is not always its mail domain. Districts whose domain publishes no MX record are left out of the percentages, which undercounts districts that receive mail elsewhere.

Check a district domain

The free DemiSignal check flags a missing DMARC record, a policy of none and a missing report address. No account needed.

Sources

Tools for this

Frequently asked questions

What share of US school districts enforce DMARC?

40.3% of the 10,776 districts whose domain publishes MX had p=quarantine or p=reject when we scanned them on 14 October 2026.

Does this page name districts?

No. The page and the CSV hold state totals only, and jurisdictions with one or two districts are left out of every row.

Why are Idaho, Louisiana and Nebraska missing?

Their districts list no website in the NCES directory file we used, so there was no domain to scan.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account