Connecticut K-12 Email Security Intelligence:
DNS Authentication Profiling of 209 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 209 K-12 LEAs in Connecticut, of which 191 have active domains (91.4% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Connecticut K-12 districts achieve an average ESI score of 52.7/100, with 27.2% earning Grade A or B (strong posture) and 22.5% receiving Grade F (minimal authentication). Only 61.8% have any DMARC record, and just 23.0% have DMARC at an enforcement level (quarantine or reject) — leaving 38.2% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 191 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Connecticut, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Connecticut K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	209
Regular school districts	170
Charter LEAs	21
Other LEA types (state-operated, regional, etc.)	18
LEAs with active internet domain	191 (91.4%)
Domains DNS-profiled	191
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Connecticut K-12 districts collectively operate approximately 1,007 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Connecticut
Population	Total in Dataset	At Risk (No DMARC, 38.2%)	Critically Exposed (Grade F, 22.5%)
Students	383,667	146,560	86,325
Parents and guardians	767,334	293,121	172,650
Staff and educators	51,357	19,618	11,555
Total people	1,202,358	459,300	270,530

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Connecticut K-12
Protocol	Connecticut	National K-12 (ESI)	vs. National
SPF (any configuration)	80.6%	79.7%	+0.9pp
DKIM (key published)	64.4%	59.6%	+4.8pp
DMARC (any policy)	61.8%	55.5%	+6.3pp
DMARC at enforcement (quarantine/reject)	23.0%	~21.0%	+2.0pp
DMARC at reject (full enforcement)	7.9%	~12.2%	-4.3pp
No MX records (not receiving email)	8.9%	~10.0%	-1.1pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Connecticut K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	18	9.4%	Full enforcement
B	70–89	34	17.8%	Strong posture
C	50–69	73	38.2%	Partial protection
D	30–49	23	12.0%	Weak configuration
F	0–29	43	22.5%	Minimal/no authentication
Average score		52.7 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Connecticut K-12 (top providers)
Provider	Districts	Share
Google Workspace	105	55.0%
Microsoft 365	28	14.7%
Barracuda	22	11.5%
Mimecast	5	2.6%
Proofpoint	3	1.6%
GoDaddy	1	0.5%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Connecticut K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Regional School District 19	`eosmith.org`	Capitol Planning Region	Microsoft 365	✓	✓	reject	100	A
Area Cooperative Educational Services	`aces.org`	South Central Connecticut Planning Region	Microsoft 365	✓	✓	reject	100	A
Hartford School District	`hartfordschools.org`	Capitol Planning Region	Microsoft 365	✓	✓	reject	100	A
Sterling School District	`sterlingschool.org`	Northeastern Connecticut Planning Region	Google Workspace	✓	✓	reject	100	A
New Fairfield School District	`newfairfieldschools.org`	Western Connecticut Planning Region	Google Workspace	✓	✓	reject	95	A
New Canaan School District	`ncps-k12.org`	Western Connecticut Planning Region	Google Workspace	✓	✓	reject	95	A
Newington School District	`npsct.org`	Capitol Planning Region	Google Workspace	✓	✓	reject	95	A
Oxford School District	`oxfordpublicschools.org`	Naugatuck Valley Planning Region	Google Workspace	✓	✓	reject	95	A
Plainville School District	`plainvilleschools.org`	Capitol Planning Region	Google Workspace	✓	✓	reject	95	A
Regional School District 10	`region10ct.org`	Northwest Hills Planning Region	Proofpoint	✓	✓	reject	95	A
Regional School District 01	`region1schools.org`	Northwest Hills Planning Region	Google Workspace	✓	✓	reject	95	A
Wolcott School District	`wolcottps.org`	Naugatuck Valley Planning Region	—	✓	✓	reject	95	A
Wilton School District	`wiltonps.org`	Western Connecticut Planning Region	Google Workspace	✓	✓	reject	93	A
Jumoke Academy District	`jumokeacademy.org`	Capitol Planning Region	Microsoft 365	✓	✓	quarantine	90	A
Berlin School District	`berlinschools.org`	Capitol Planning Region	Google Workspace	✓	✓	quarantine	90	A

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Connecticut K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Grade
Department of Mental Health and Addiction Services	`portal.ct.gov`	Capitol Planning Region	—	✗	✗	—	F
Department of Social Services	`dss.state.ct.us`	Capitol Planning Region	—	✗	✗	—	F
Office of Higher Education	`ctohe.org`	Capitol Planning Region	—	✗	✗	—	F
Bozrah School District	`fmsbozrah.org`	Southeastern Connecticut Planning Region	—	✗	✗	—	F
Brookfield School District	`brookfield.k12.ct.us`	Western Connecticut Planning Region	Google Workspace	✗	✗	—	F
Bloomfield School District	`bloomfieldschools.org`	Capitol Planning Region	Google Workspace	✗	✗	—	F
Bristol School District	`bristol.k12.ct.us`	Naugatuck Valley Planning Region	—	✗	✗	—	F
Coventry School District	`coventrypublicschools.org`	Capitol Planning Region	—	✗	✗	—	F
East Windsor School District	`eastwindsork12.org`	Capitol Planning Region	—	✗	✗	—	F
Ellington School District	`ellingtonschools.org`	Capitol Planning Region	—	✗	✗	—	F
Franklin School District	`franklinschoolct.org`	Southeastern Connecticut Planning Region	Google Workspace	✗	✗	—	F
Groton School District	`grotonschools.org`	Southeastern Connecticut Planning Region	—	✗	✗	—	F
Hampton School District	`hamptonschool.org`	Northeastern Connecticut Planning Region	Google Workspace	✗	✗	—	F
Kent School District	`kentcenterschool.org`	Northwest Hills Planning Region	—	✗	✗	—	F
Litchfield School District	`litchfieldschools.org`	Northwest Hills Planning Region	Microsoft 365	✗	✗	—	F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Connecticut County Distribution
County	Districts	Website Coverage
Capitol Planning Region	53	94.3%
South Central Connecticut Planning Region	25	96.0%
Northwest Hills Planning Region	24	95.8%
Southeastern Connecticut Planning Region	23	95.7%
Northeastern Connecticut Planning Region	19	94.7%
Western Connecticut Planning Region	18	100.0%
Naugatuck Valley Planning Region	17	100.0%
Lower Connecticut River Valley Planning Region	16	93.8%
Greater Bridgeport Planning Region	14	92.9%

5. Policy Implications

These findings identify specific, actionable gaps in Connecticut's K-12 email security posture. The 38.2% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 43 districts (22.5%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 73 districts (38.2%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 55.0% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full Connecticut K-12 dataset — 209 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: Connecticut	All 209 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Connecticut K-12 Email Security Intelligence: DNS Authentication Profiling of 209 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/ct-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

Connecticut K-12 Email Security Intelligence:DNS Authentication Profiling of 209 School District LEAs