Colorado K-12 Email Security Intelligence:
DNS Authentication Profiling of 272 School District LEAs

Lokentra Research Team
Lokentra U.S. Email Security Index (ESI) — State Intelligence Series
April 22, 2026
research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 272 K-12 LEAs in Colorado, of which 206 have active domains (75.7% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Colorado K-12 districts achieve an average ESI score of 48.3/100, with 24.8% earning Grade A or B (strong posture) and 29.1% receiving Grade F (minimal authentication). Only 51.9% have any DMARC record, and just 25.2% have DMARC at an enforcement level (quarantine or reject) — leaving 48.1% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 206 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Colorado, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Colorado K-12 Dataset Summary
MetricValue
Total K-12 LEAs in state272
Regular school districts178
Charter LEAs2
Other LEA types (state-operated, regional, etc.)92
LEAs with active internet domain206 (75.7%)
Domains DNS-profiled206
Data freshness (NCES CCD)2024-2025 school year
DNS scan dateApril 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Colorado K-12 districts collectively operate approximately 1,900 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Colorado
PopulationTotal in DatasetAt Risk (No DMARC, 48.1%)Critically Exposed (Grade F, 29.1%)
Students723,900348,195210,654
Parents and guardians1,447,800696,391421,309
Staff and educators96,90046,60828,197
Total people2,268,6001,091,196660,162

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Colorado K-12
ProtocolColoradoNational K-12 (ESI)vs. National
SPF (any configuration)73.8%79.7%-5.9pp
DKIM (key published)55.8%59.6%-3.8pp
DMARC (any policy)51.9%55.5%-3.6pp
DMARC at enforcement (quarantine/reject)25.2%~21.0%+4.2pp
DMARC at reject (full enforcement)8.3%~12.2%-3.9pp
No MX records (not receiving email)10.7%~10.0%+0.7pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Colorado K-12
GradeScoreDistrictsShareInterpretation
A90–1002311.2%Full enforcement
B70–892813.6%Strong posture
C50–696230.1%Partial protection
D30–493316.0%Weak configuration
F0–296029.1%Minimal/no authentication
Average score48.3 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Colorado K-12 (top providers)
ProviderDistrictsShare
Google Workspace13766.5%
Microsoft 365209.7%
Barracuda62.9%
Proofpoint52.4%
Mimecast31.5%
GoDaddy31.5%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Colorado K-12 Districts by ESI Score
DistrictDomainCountyProviderSPFDKIMDMARC PolicyScoreGrade
Cherry Creek School District No. 5 in the county of Arapah cherrycreekschools.org Arapahoe County Barracuda ✓ ✓ reject 100 A
St. Vrain Valley School District No. Re1J svvsd.org Boulder County Google Workspace ✓ ✓ reject 100 A
Cheyenne Mountain School District No. 12 in the county of E cmsd12.org El Paso County Google Workspace ✓ ✓ reject 100 A
School District N. 14 in the county of Adams & State of Colo adams14.org Adams County Barracuda ✓ ✓ reject 100 A
Weld County School District No. Re-5J weldre5j.k12.co.us Weld County — ✓ ✓ reject 100 A
Gilpin County School District No. Re-1 gilpin.k12.co.us Gilpin County Google Workspace ✓ ✓ reject 100 A
East Grand School District No. 2 egsd.org Grand County Google Workspace ✓ ✓ reject 100 A
Meeker School District Re1 meeker.k12.co.us Rio Blanco County Google Workspace ✓ ✓ reject 100 A
West Grand School District No. 1 wgsd.us Grand County Google Workspace ✓ ✓ reject 100 A
Adams 12 Five Star Schools adams12.org Adams County Proofpoint ✓ ✓ reject 95 A
Pueblo County School District 70 district70.org Pueblo County Google Workspace ✓ ✓ reject 95 A
Alamosa School District No. Re-11J alamosaschools.org Alamosa County Google Workspace ✓ ✓ reject 95 A
Creede School District creedek12.net Mineral County Google Workspace ✓ ✓ reject 95 A
Crowley County School District No. Re-1-J cck12.net Crowley County Google Workspace ✓ ✓ reject 95 A
Manitou Springs School District No. 14 in the county of El mssd14.org El Paso County Google Workspace ✓ ✓ reject 95 A

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Colorado K-12 Districts by ESI Score
DistrictDomainCountyProviderSPFDKIMDMARC PolicyScoreGrade
Adams County BOCES adamsboces.org Adams County — ✗ ✗ — 0 F
Idalia RJ-3 School District idaliaco.us Yuma County Google Workspace ✗ ✗ — 0 F
North Park School District R-1 sites.google.com Jackson County — ✗ ✗ — 0 F
Northeast BOCES AU neboces.com Phillips County Google Workspace ✗ ✗ — 0 F
Englewood School District No. 1 in the county of Arapahoe englewoodschools.net Arapahoe County — ✗ ✗ — 0 F
Rio Blanco BOCES rioblancoboces.org Rio Blanco County — ✗ ✗ — 0 F
ELIZABETH SCHOOL DISTRICT elizabethschooldistrict.org Elbert County — ✗ ✗ — 0 F
Aguilar Reorganized School District No. 6 aguilarschools.com Las Animas County Google Workspace ✗ ✗ — 0 F
Archuleta County School District No. 50 Jt mypagosaschools.com Archuleta County GoDaddy ✗ ✗ — 0 F
Branson Reorganized School District No. 82 bransonschooldistrict.com Las Animas County — ✗ ✗ — 0 F
Bethune School District No. R- 5 bethuneschool.com Kit Carson County Google Workspace ✗ ✗ — 0 F
Cheraw School District No. 31 in the county of Otero and S cheraw.k12.co.us Otero County Google Workspace ✗ ✗ — 0 F
Dolores School District No. Re-4A doloresschools.org Montezuma County — ✗ ✗ — 0 F
De Beque Joint District No. 49 of the counties of Mesa and dbschools.org Mesa County GoDaddy ✗ ✗ — 0 F
Genoa-Hugo School District No. C-113 genoahugo.org Lincoln County Google Workspace ✗ ✗ — 0 F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Colorado County Distribution
CountyDistrictsWebsite Coverage
El Paso County32100.0%
Weld County18100.0%
Adams County13100.0%
Arapahoe County12100.0%
Pueblo County8100.0%
Denver County7100.0%
Otero County7100.0%
Garfield County7100.0%
Larimer County6100.0%
La Plata County6100.0%

5. Policy Implications

These findings identify specific, actionable gaps in Colorado's K-12 email security posture. The 48.1% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

6. Data Availability

The full Colorado K-12 dataset — 272 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
TierScopeSuggested Use
State Pack: ColoradoAll 272 K-12 LEAs, full DNS profile + CCD enrichmentRegional studies, state policy, outreach
K-12 NationalAll 50 states, 20,021+ K-12 LEAsNational K-12 cybersecurity research
Full Registry801,359+ entities across all sectorsComprehensive multi-sector research
API + UpdatesQuarterly re-scan, REST APILongitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Colorado K-12 Email Security Intelligence: DNS Authentication Profiling of 272 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/co-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.