US County Election Websites Face Persistent Security and Domain Vulnerabilities
Analysis reveals significant reliance on non-.gov domains and weak email authentication protocols.
1Domain Security Progress
The 2026 census of 2,081 US county election websites shows 42% still operate outside the .gov domain space. While this marks an improvement from 57% in 2024, smaller counties lag behind larger jurisdictions. Population-weighted data indicates that 28% of residents currently rely on election pages hosted on non-official government domain structures.
2Email Authentication Gaps
Among 942 county-controlled email domains, 51% lack an enforced DMARC policy, leaving them vulnerable to spoofing. While 98% of domains implemented SPF, 23% have no DMARC record at all. Smaller counties demonstrate higher risk, with 34% lacking DMARC compared to only 12% among the largest counties surveyed by the researchers.
3Encryption and HTTPS Failures
Technical audits identified 28 websites with critical HTTPS failures, including expired certificates or incorrect domain matching. Furthermore, 178 sites serve content over unencrypted HTTP, and only 34% utilize HSTS headers to force secure connections. Sixty-three security certificates are scheduled to expire within 30 days of the upcoming November 3 election date.
4Third-Party Tracking Risks
Analysis of 1,930 election pages revealed that 84% contact at least one third-party tracker upon loading. Google Analytics or Tag Manager appeared on 60% of these sites, while Meta Pixel was present on 3%. These connections often stem from default platform settings rather than deliberate decisions made by local election officials.
5Lookalike Domain Threats
Researchers identified 121 election-related domains registered outside government control, with some hosting gambling or spam content. Automated tests generated 14,456 misspellings of official domains, finding 245 registered variants. These lookalike sites pose risks to voters who might mistype an address or guess the wrong domain ending when searching for official information.
6Regional Security Disparities
Texas accounts for 169 non-.gov sites, including 134 using older county-based structures, while Arizona and Nebraska reported zero non-.gov election sites. In key battleground states, 43% of county election websites remain outside the .gov registry. These regional variations highlight inconsistent adoption of federal security standards across different state-level election administration frameworks.
7Methodology and Scope Constraints
The study utilized automated discovery to analyze 2,081 websites, favoring larger counties with structured digital footprints. Researchers combined Census Bureau data with Wikidata and CISA registry checks to verify findings. The results represent a snapshot taken on October 17, 2026, and do not imply that voting machines or ballot systems were compromised.
8Strategic Recommendations for Officials
Mysterium advises counties to complete migrations to .gov domains and enforce strict DMARC policies after inventorying legitimate senders. Officials should also remove unnecessary third-party tracking code and configure HSTS to ensure encrypted traffic. Voters are encouraged to verify information through USA.gov to avoid potential risks from unofficial or misleading web sources.