Study finds 42% of US county election sites lack .gov domains

Researchers from Mysterium VPN conducted the 2026 County Election Website Security Census, examining 2,081 county election websites across the United States. The study finds that 42% of identified county pages are not using a .gov domain (869 of 2,081), down from 57% in 2024, with weighting by population showing 28% of residents live in counties whose election pages use non-[.]gov domains because larger counties progressed more quickly.

Texas accounted for 169 non-[.]gov sites, including 134 using the older co.<county>.tx[.]us structure; Arizona and Nebraska had no identified non-[.]gov county election sites. The researchers emphasise that the findings concern public information websites and contact domains, not voting machines or ballot-counting systems.

The census reports weak email and web protections: of 1,977 readable election pages, 965 displayed a contact address, and after excluding consumer email services there were 942 county-controlled election email domains. Twenty-three percent had no DMARC record, 28% used a p=none policy, 30% requested quarantine and 19% rejection, collectively leaving about 51% without an enforced DMARC policy. SPF appeared on 98% of domains.

HTTPS problems persisted: 28 sites showed consistent HTTPS failures, 178 would serve pages over unencrypted HTTP if requested, and only 34% sent an HSTS header. Third-party tracking remained pervasive in a clean-browser test: 84% of 1,930 pages contacted at least one tracker, with Google Analytics or Tag Manager on 60% and Meta Pixel on 3%.

The researchers caution that DMARC and domain moves to .gov do not guarantee security, but recommend completing the migration, tightening email authentication, configuring redirects and reviewing third-party connections. The observations reflect the situation as of 17 October 2026.