Maryland K-12 Email Security Intelligence:
DNS Authentication Profiling of 26 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 26 K-12 LEAs in Maryland, of which 25 have active domains (96.2% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Maryland K-12 districts achieve an average ESI score of 58.0/100, with 48.0% earning Grade A or B (strong posture) and 24.0% receiving Grade F (minimal authentication). Only 72.0% have any DMARC record, and just 36.0% have DMARC at an enforcement level (quarantine or reject) — leaving 28.0% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 25 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Maryland, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Maryland K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	26
Regular school districts	24
Charter LEAs	0
Other LEA types (state-operated, regional, etc.)	2
LEAs with active internet domain	25 (96.2%)
Domains DNS-profiled	25
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Maryland K-12 districts collectively operate approximately 1,408 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Maryland
Population	Total in Dataset	At Risk (No DMARC, 28.0%)	Critically Exposed (Grade F, 24.0%)
Students	536,448	150,205	128,747
Parents and guardians	1,072,896	300,410	257,495
Staff and educators	71,808	20,106	17,233
Total people	1,681,152	470,722	403,476

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Maryland K-12
Protocol	Maryland	National K-12 (ESI)	vs. National
SPF (any configuration)	68.0%	79.7%	-11.7pp
DKIM (key published)	68.0%	59.6%	+8.4pp
DMARC (any policy)	72.0%	55.5%	+16.5pp
DMARC at enforcement (quarantine/reject)	36.0%	~21.0%	+15.0pp
DMARC at reject (full enforcement)	20.0%	~12.2%	+7.8pp
No MX records (not receiving email)	12.0%	~10.0%	+2.0pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Maryland K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	5	20.0%	Full enforcement
B	70–89	7	28.0%	Strong posture
C	50–69	5	20.0%	Partial protection
D	30–49	2	8.0%	Weak configuration
F	0–29	6	24.0%	Minimal/no authentication
Average score		58.0 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Maryland K-12 (top providers)
Provider	Districts	Share
Microsoft 365	9	36.0%
Google Workspace	7	28.0%
Proofpoint	2	8.0%
Barracuda	1	4.0%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Maryland K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Carroll County Public Schools	`carrollk12.org`	Carroll County	Microsoft 365	✓	✓	reject	100	A
Cecil County Public Schools	`ccps.org`	Cecil County	Proofpoint	✓	✓	reject	100	A
Talbot County Public Schools	`tcps.k12.md.us`	Talbot County	Google Workspace	✓	✓	reject	100	A
Somerset County Public Schools	`somerset.k12.md.us`	Somerset County	Google Workspace	✓	✓	reject	95	A
Harford County Public Schools	`hcps.org`	Harford County	Microsoft 365	✓	✓	quarantine	90	A
Anne Arundel County Public Schools	`aacps.org`	Anne Arundel County	Microsoft 365	✓	✓	quarantine	88	B
Baltimore County Public Schools	`bcps.org`	Baltimore County	Barracuda	⚠	✓	reject	85	B
Queen Anne's County Public Schools	`qacps.org`	Queen Anne's County	Google Workspace	⚠	✓	quarantine	75	B
Prince George's County Public Schools	`pgcps.org`	Prince George's County	Google Workspace	⚠	✓	quarantine	75	B
Calvert County Public Schools	`calvertnet.k12.md.us`	Calvert County	Microsoft 365	✓	✓	none	70	B
Charles County Public Schools	`ccboe.com`	Charles County	—	✓	✓	none	70	B
Wicomico County Public Schools	`wcboe.org`	Wicomico County	Microsoft 365	✓	✓	none	70	B
Allegany County Public Schools	`acpsmd.org`	Allegany County	Google Workspace	✓	✓	none	65	C
Garrett County Public Schools	`garrettcountyschools.org`	Garrett County	Proofpoint	✓	✓	none	65	C
Frederick County Public Schools	`fcps.org`	Frederick County	Microsoft 365	✓	✓	none	65	C

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Maryland K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Baltimore City Public Schools	`baltimorecityschools.org`	Baltimore city	—	✗	✗	—	0	F
Caroline County Public Schools	`carolineschools.org`	Caroline County	—	✗	✗	—	0	F
Dorchester County Public Schools	`dcps.k12.md.us`	Dorchester County	—	✗	✗	—	0	F
Montgomery County Public Schools	`montgomeryschoolsmd.org`	Montgomery County	—	✗	✗	—	0	F
Howard County Public Schools	`hcpss.org`	Howard County	Microsoft 365	⚠	✗	none	23	F
Kent County Public Schools	`kent.k12.md.us`	Kent County	Google Workspace	✓	✗	—	25	F
SEED School of Maryland	`seedschoolmd.org`	Baltimore city	Microsoft 365	✓	✗	—	30	D
Worcester County Public Schools	`worcesterk12.org`	Worcester County	Microsoft 365	✓	✗	—	30	D
Allegany County Public Schools	`acpsmd.org`	Allegany County	Google Workspace	✓	✓	none	65	C
Garrett County Public Schools	`garrettcountyschools.org`	Garrett County	Proofpoint	✓	✓	none	65	C
Frederick County Public Schools	`fcps.org`	Frederick County	Microsoft 365	✓	✓	none	65	C
St. Mary's County Public Schools	`smcps.org`	St. Mary's County	Google Workspace	✓	✓	none	65	C
Washington County Public Schools	`wcpsmd.com`	Washington County	—	✓	✓	none	65	C
Calvert County Public Schools	`calvertnet.k12.md.us`	Calvert County	Microsoft 365	✓	✓	none	70	B
Charles County Public Schools	`ccboe.com`	Charles County	—	✓	✓	none	70	B

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Maryland County Distribution
County	Districts	Website Coverage
Anne Arundel County	2	50.0%
Baltimore city	2	100.0%
Allegany County	1	100.0%
Baltimore County	1	100.0%
Calvert County	1	100.0%
Caroline County	1	100.0%
Carroll County	1	100.0%
Cecil County	1	100.0%
Charles County	1	100.0%
Dorchester County	1	100.0%

5. Policy Implications

These findings identify specific, actionable gaps in Maryland's K-12 email security posture. The 28.0% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 6 districts (24.0%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 5 districts (20.0%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 28.0% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full Maryland K-12 dataset — 26 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: Maryland	All 26 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Maryland K-12 Email Security Intelligence: DNS Authentication Profiling of 26 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/md-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

Maryland K-12 Email Security Intelligence:DNS Authentication Profiling of 26 School District LEAs