A responsibly disclosed measurement of public email-authentication records: not a vulnerability ranking, compromise assessment or claim about election integrity.
Why this matters
Without an enforcing policy, participating receivers have less domain-owner direction for forged messages that use a state office or campaign’s exact From domain; this does not establish that such messages were sent or delivered.
This page stays out of search until source, methodology, chart, accessibility, SEO and claims-language reviews pass. It contains no placeholder findings.
The published tracker will show one reviewed state election-office domain for every state and Washington, D.C. No pre-release findings appear on this page.
Public DNS records describe published configuration. They do not prove compromise, vulnerability or election interference.
01 · September 21
Campaign cohort freezes
02 · September 22
Initial public-DNS scan
03 · September 23
Private office notification
04 · October 8
Post-correction public-DNS scan
05 · October 13
Target release after review
Why this matters
Election offices and campaigns send high-trust, time-sensitive messages. A missing or monitoring-only policy leaves less protection at participating receivers when a forged message using their visible From domain fails aligned authentication.
Learn how DMARC evaluates a message →01 · DOMAIN IDENTITY
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 · PRACTICAL HARM
A forged message appearing to come from an election office or campaign could circulate false voting instructions, seek credentials or donations, or redirect a recipient. Public DNS state alone is not evidence that this happened, that a message was delivered, or that election systems were compromised.
Three different DNS states
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
September 21, 2026
51-authority cohort freeze
September 22, 2026
Initial scan
September 23, 2026
Private state-office notification
October 7, 2026
Corrections close
October 8, 2026
Post-correction rescan
October 13, 2026
Public release after legal/editorial review
Release is conditional on the stated evidence and review gates.
Media posture
Provide 3–5 specialist reporters an embargoed methodology and aggregate preview after disclosure closes.
Official starting point for all state election authorities.
Current IETF DMARC policy-record syntax, discovery and evaluation standard.
Current IETF specification for DMARC aggregate-report requests and report format.
IETF SPF record syntax, multiple-record error handling and DNS-lookup limit.
State election-authority domains may be named after ten business days of notice, correction review, and a post-window rescan. Legal and neutral-language approval are mandatory.
The U.S. election email security tracker measures public DMARC, SPF, BIMI and MX records for one reviewed organizational domain from every state election authority and Washington, D.C.
The U.S. election email security tracker does not evaluate private incidents or election integrity. A DNS record shows a domain owner's published email-authentication instructions at the observation time; it does not observe private controls, mail flow, incidents or voting systems.
The U.S. election email security tracker freezes its 51-authority cohort on September 21, scans on September 22, sends private state-office notices on September 23, and performs its post-correction rescan on October 8. Corrections received through October 7 are independently checked before the planned October 13 release.
After the U.S. election email security tracker is published, its aggregate data, charts and citation files are available under CC BY 4.0. Attribution should link to the report so readers can inspect the cohort, denominators, scan dates and limitations.