Arizona K-12 Email Security Intelligence:
DNS Authentication Profiling of 770 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 770 K-12 LEAs in Arizona, of which 525 have active domains (68.2% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Arizona K-12 districts achieve an average ESI score of 40.5/100, with 16.8% earning Grade A or B (strong posture) and 34.9% receiving Grade F (minimal authentication). Only 47.0% have any DMARC record, and just 18.7% have DMARC at an enforcement level (quarantine or reject) — leaving 53.0% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 525 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Arizona, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Arizona K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	770
Regular school districts	277
Charter LEAs	452
Other LEA types (state-operated, regional, etc.)	41
LEAs with active internet domain	525 (68.2%)
Domains DNS-profiled	525
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Arizona K-12 districts collectively operate approximately 2,427 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Arizona
Population	Total in Dataset	At Risk (No DMARC, 53.0%)	Critically Exposed (Grade F, 34.9%)
Students	924,687	490,084	322,715
Parents and guardians	1,849,374	980,168	645,431
Staff and educators	123,777	65,601	43,198
Total people	2,897,838	1,535,854	1,011,345

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Arizona K-12
Protocol	Arizona	National K-12 (ESI)	vs. National
SPF (any configuration)	69.3%	79.7%	-10.4pp
DKIM (key published)	41.3%	59.6%	-18.3pp
DMARC (any policy)	47.0%	55.5%	-8.5pp
DMARC at enforcement (quarantine/reject)	18.7%	~21.0%	-2.3pp
DMARC at reject (full enforcement)	7.0%	~12.2%	-5.2pp
No MX records (not receiving email)	17.7%	~10.0%	+7.7pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Arizona K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	29	5.5%	Full enforcement
B	70–89	59	11.2%	Strong posture
C	50–69	149	28.4%	Partial protection
D	30–49	105	20.0%	Weak configuration
F	0–29	183	34.9%	Minimal/no authentication
Average score		40.5 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Arizona K-12 (top providers)
Provider	Districts	Share
Google Workspace	270	51.4%
Microsoft 365	80	15.2%
GoDaddy	13	2.5%
Sophos	11	2.1%
Barracuda	8	1.5%
Mimecast	7	1.3%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Arizona K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Salt River Pima-Maricopa Community Schools (4320)	`saltriverschools.org`	Maricopa County	Microsoft 365	✓	✓	reject	100	A
American Leadership Academy Inc. (4348)	`alaschools.org`	Maricopa County	Google Workspace	✓	✓	reject	100	A
Challenge School Inc. (6362)	`challengecharterschool.net`	Maricopa County	Microsoft 365	✓	✓	reject	100	A
Mary Ellen Halvorson Educational Foundation. dba: (10965)	`tricityprep.org`	Yavapai County	Microsoft 365	✓	✓	reject	100	A
Pima Prevention Partnership dba Pima Partnership S (79959)	`partnershipschools.us`	Pima County	—	✓	✓	reject	100	A
Concordia Charter School Inc. (89556)	`concordiacharter.org`	Maricopa County	Microsoft 365	✓	✓	reject	100	A
Candeo Schools Inc. (1001161)	`candeoschools.com`	Maricopa County	Google Workspace	✓	✓	reject	100	A
Peoria Unified School District (4237)	`peoriaunified.org`	Maricopa County	—	✓	✓	reject	100	A
Phoenix Union High School District (4286)	`phoenixunion.org`	Maricopa County	Microsoft 365	✓	✓	reject	100	A
Scottsdale Unified District (4240)	`susd.org`	Maricopa County	—	✓	✓	reject	100	A
Whiteriver Unified District (4394)	`wusd.us`	Navajo County	Barracuda	✓	✓	reject	100	A
Archway Classical Academy Trivium West (1001937)	`greatheartsonline.org`	Maricopa County	Microsoft 365	✓	✓	reject	100	A
Flagstaff Junior Academy (4207)	`fjacademy.com`	Coconino County	Sophos	✓	✓	reject	95	A
American Charter Schools Foundation d.b.a. Peoria (79875)	`peoriabulldogs.com`	Maricopa County	Google Workspace	✓	✓	reject	95	A
New World Educational Center (78882)	`nweccharter.com`	Maricopa County	Google Workspace	✓	✓	reject	95	A

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Arizona K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Grade
Colorado City Unified District (4370)	`ccschools.us`	Mohave County	Google Workspace	✗	✗	—	F
Center for Academic Success Inc. (4191)	`casschools.com`	Cochise County	—	✗	✗	—	F
Heber-Overgaard Unified District (4392)	`heberovergaardschools.org`	Navajo County	—	✗	✗	—	F
Heritage Academy Inc. (4336)	`hamesa.com`	Maricopa County	—	✗	✗	—	F
Victory High School Inc. (4358)	`victoryhigh.com`	Maricopa County	Google Workspace	✗	✗	—	F
PAS Charter Inc. dba Intelli-School (79953)	`intellischool.org`	Maricopa County	Google Workspace	✗	✗	—	F
Skyview School Inc. (4496)	`skyviewschool.org`	Yavapai County	Google Workspace	✗	✗	—	F
Ombudsman Educational Services Ltd.a subsidiary (4323)	`az.ombudsman.com`	Maricopa County	—	✗	✗	—	F
Az-Tec High School (4508)	`aztechs.org`	Yuma County	—	✗	✗	—	F
Montessori Schoolhouse of Tucson Inc. (4428)	`themontessorischoolhouse.com`	Pima County	Google Workspace	✗	✗	—	F
Genesis Program Inc. (4332)	`genesiscity.org`	Maricopa County	Google Workspace	✗	✗	—	F
Edkey Inc. dba American Heritage Academy (6365)	`americanheritageacademy.org`	Yavapai County	GoDaddy	✗	✗	—	F
Discovery Plus Academy (6357)	`myweb.cableone.net`	Graham County	—	✗	✗	—	F
Gem Charter School Inc. (6372)	`gemcharter.com`	Maricopa County	—	✗	✗	—	F
Phoenix School of Academic Excellence The (6379)	`phoenixschoolofacademicexcellence.com`	Maricopa County	—	✗	✗	—	F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Arizona County Distribution
County	Districts	Website Coverage
Maricopa County	385	87.5%
Pima County	81	81.5%
Yavapai County	46	80.4%
Pinal County	43	90.7%
Navajo County	37	43.2%
Cochise County	30	83.3%
Coconino County	28	60.7%
Apache County	27	37.0%
Mohave County	23	82.6%
Yuma County	18	88.9%

5. Policy Implications

These findings identify specific, actionable gaps in Arizona's K-12 email security posture. The 53.0% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 183 districts (34.9%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 149 districts (28.4%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 51.4% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full Arizona K-12 dataset — 770 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: Arizona	All 770 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Arizona K-12 Email Security Intelligence: DNS Authentication Profiling of 770 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/az-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

Arizona K-12 Email Security Intelligence:DNS Authentication Profiling of 770 School District LEAs