Mysterium census: 42% of US county election websites still lack .gov domains; weak DMARC, HTTPS and tracking persist

Linha do tempo

1. securityaffairs.com ↗ · pub. 29/10/2026 06:21 · coletado 29/10 08:00 primeiro registro

   Mysterium census: 42% of US county election websites still lack .gov domains; weak DMARC, HTTPS and tracking persist

   ler a análise desta fonte ocultar

   Mysterium VPN's 2026 County Election Website Security Census examined 2,081 US county election websites ahead of the November 3 election. It found that 42% (869) are still outside .gov, down from 57% in 2024, or 28% when weighted by population. The findings cover public information sites and contact domains only. They do not show that voting machines, ballot counting or results have been compromised. The weaknesses could still enable voter impersonation, misleading lookalike sites and unnecessary data collection.

   Technical Details

   • Email authentication: Of 942 county-controlled election email domains, 23% had no DMARC record, 28% used p=none, 30% used quarantine and 19% used reject. Domains without DMARC fell from 41% in 2024 to 23%. SPF was present on 98%. The report's counts total 941, not 942.
   • Smaller counties and non-.gov domains: Among the smallest third of counties, 34% lacked DMARC, versus 12% among the largest. Non-.gov domains lacked DMARC at 32%, versus 16% for .gov domains. This is an association, not proof of causation.
   • HTTPS: 28 sites had consistent HTTPS failures, including 15 with no working HTTPS and 7 with certificates for the wrong domain. Another 178 would serve pages over plain HTTP, and only 34% sent an HSTS header. 63 certificates were due to expire within 30 days of Election Day.
   • Tracking: Of 1,930 pages, 84% contacted at least one known tracker, and the median page contacted six third-party domains. Google Analytics or Tag Manager appeared on 60% of sites and Meta Pixel on 3%. Mysterium suggests much of this stems from platform defaults.
   • Lookalike and unowned domains: Of 2,074 resolving election-related names, 121 were registered outside government control. Of these, 38 hosted unrelated sites, 8 were for sale and 2 served gambling or spam content. Of 14,456 single-character typo variants of 77 state and large-county domains, 245 were registered and 26 served parked or unrelated pages. 73 counties had a working .gov version of their name but had not completed migration. The study does not establish malicious intent.
   • Geography: Texas had 169 non-.gov sites, while Arizona and Nebraska had none identified. In the seven 2024 swing states, 43% of sites were outside .gov and 55% of domains lacked enforced DMARC. In nine toss-up or lean 2026 Senate states, 53% were outside .gov and 44% lacked enforced DMARC.
   • Methodology limits: The snapshot dates from October 17, 2026. Automated discovery found 2,081 pages versus 2,913 in the 2024 manual survey, so smaller counties are underrepresented. The tracking test was a single page load from one location, and the comparison with 2024 is not perfectly matched.

   Remediation

   • Eligible counties should complete the move to .gov and redirect old addresses.
   • Counties should inventory legitimate email senders, then enforce DMARC.
   • Sites should use HTTP-to-HTTPS redirects and HSTS, and certificate expiry should be monitored.
   • Counties should remove unnecessary advertising pixels and third-party connections, and consider registering defensive domain variants.
   • Voters should start from the state election office listed on USA.gov, avoid unsolicited messages and unverified search results, and verify unexpected emails through an independently obtained phone number.