Michigan K-12 Email Security Intelligence:
DNS Authentication Profiling of 903 School District LEAs

Lokentra Research Team

Lokentra U.S. Email Security Index (ESI) — State Intelligence Series

April 22, 2026

research@monitorworkspace.com • monitorworkspace.com/scorecard

Abstract

We present DNS email security profiling for 903 K-12 LEAs in Michigan, of which 771 have active domains (85.4% coverage). Domains were scored on the Lokentra 100-point Email Security Index (ESI) rubric (SPF 30 pts + DKIM 30 pts + DMARC 40 pts). Michigan K-12 districts achieve an average ESI score of 51.3/100, with 31.9% earning Grade A or B (strong posture) and 28.1% receiving Grade F (minimal authentication). Only 61.3% have any DMARC record, and just 29.7% have DMARC at an enforcement level (quarantine or reject) — leaving 38.7% of districts fully vulnerable to email domain spoofing. This report provides entity-level data for all 771 scored domains including provider classification, authentication status, and ESI score, sourced from NCES CCD 2024-2025 and live DNS resolution conducted April 22, 2026.

Keywords: Michigan, K-12 email security, DMARC, SPF, school district cybersecurity, DNS authentication, Google Workspace, education technology

1. Dataset Overview

Table 1. Michigan K-12 Dataset Summary
Metric	Value
Total K-12 LEAs in state	903
Regular school districts	541
Charter LEAs	302
Other LEA types (state-operated, regional, etc.)	60
LEAs with active internet domain	771 (85.4%)
Domains DNS-profiled	771
Data freshness (NCES CCD)	2024-2025 school year
DNS scan date	April 22, 2026

2. The Human Impact: Populations at Risk

To estimate human exposure, NCES national averages are applied to CCD 2024-2025 operational school counts: 381 students per school, 51 staff per school, and 2 parents or guardians per student. Michigan K-12 districts collectively operate approximately 3,465 schools.

Table 2. Estimated Population Exposure from K-12 Email Security Gaps — Michigan
Population	Total in Dataset	At Risk (No DMARC, 38.7%)	Critically Exposed (Grade F, 28.1%)
Students	1,320,165	510,903	370,966
Parents and guardians	2,640,330	1,021,807	741,932
Staff and educators	176,715	68,388	49,656
Total people	4,137,210	1,601,100	1,162,556

Estimates based on NCES national averages. Individual district enrollment data can be linked via NCES LEAID for precise counts.

3. Authentication Findings

3.1 Protocol Adoption

Table 3. Email Authentication Protocol Adoption — Michigan K-12
Protocol	Michigan	National K-12 (ESI)	vs. National
SPF (any configuration)	73.4%	79.7%	-6.3pp
DKIM (key published)	58.0%	59.6%	-1.6pp
DMARC (any policy)	61.3%	55.5%	+5.8pp
DMARC at enforcement (quarantine/reject)	29.7%	~21.0%	+8.7pp
DMARC at reject (full enforcement)	14.4%	~12.2%	+2.2pp
No MX records (not receiving email)	11.3%	~10.0%	+1.3pp

3.2 ESI Grade Distribution

Table 4. ESI Score Grade Distribution — Michigan K-12
Grade	Score	Districts	Share	Interpretation
A	90–100	110	14.3%	Full enforcement
B	70–89	136	17.6%	Strong posture
C	50–69	203	26.3%	Partial protection
D	30–49	105	13.6%	Weak configuration
F	0–29	217	28.1%	Minimal/no authentication
Average score		51.3 / 100

3.3 Email Provider Distribution

Table 5. Email Provider Distribution — Michigan K-12 (top providers)
Provider	Districts	Share
Google Workspace	532	69.0%
Microsoft 365	90	11.7%
Barracuda	15	1.9%
GoDaddy	4	0.5%
Proofpoint	2	0.3%
Mailgun	2	0.3%

4. District-Level Data

4.1 Top Performing Districts (Best ESI Scores)

Table 6. Top 15 Michigan K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Score	Grade
Marquette Area Public Schools	`mapsnet.org`	Marquette County	Google Workspace	✓	✓	reject	100	A
Joseph K. Lumsden Bahweting Anishnabe Academy	`jklschool.org`	Chippewa County	Google Workspace	✓	✓	reject	100	A
Byron Center Charter School	`byroncentercharter.org`	Kent County	Google Workspace	✓	✓	reject	100	A
Battle Creek Area Learning Center	`calhounhs.org`	Calhoun County	Google Workspace	✓	✓	reject	100	A
Outlook Academy	`outlookacademy.net`	Allegan County	Microsoft 365	✓	✓	reject	100	A
Lighthouse Academy	`lighthouseacademyschool.org`	Kent County	Google Workspace	✓	✓	reject	100	A
West Michigan Aviation Academy	`westmichiganaviation.org`	Kent County	Google Workspace	✓	✓	reject	100	A
Keys Grace Academy	`keysacademies.com`	Oakland County	Microsoft 365	✓	✓	reject	100	A
Addison Community Schools	`addisonschools.us`	Lenawee County	Microsoft 365	✓	✓	reject	100	A
Alba Public Schools	`albaschool.org`	Antrim County	Google Workspace	✓	✓	reject	100	A
Athens Area Schools	`athensk12.org`	Calhoun County	Google Workspace	✓	✓	reject	100	A
Baraga Area Schools	`baragaschools.org`	Baraga County	—	✓	✓	reject	100	A
Boyne Falls Public School District	`boynefalls.org`	Charlevoix County	Microsoft 365	✓	✓	reject	100	A
Britton Deerfield Schools	`bdschools.us`	Lenawee County	Microsoft 365	✓	✓	reject	100	A
Flat Rock Community Schools	`flatrockschools.org`	Wayne County	Google Workspace	✓	✓	reject	100	A

4.2 Districts Most in Need of Improvement (Lowest ESI Scores)

Table 7. Bottom 15 Michigan K-12 Districts by ESI Score
District	Domain	County	Provider	SPF	DKIM	DMARC Policy	Grade
St. Ignace Area Schools	`stignace.eupschools.org`	Mackinac County	—	✗	✗	—	F
L'Anse Area Schools	`lanseschools.org`	Baraga County	—	✗	✗	—	F
Bay-Arenac Community High School	`bachs.us`	Bay County	Google Workspace	✗	✗	—	F
Pansophia Academy	`pansophiaacademy.org`	Branch County	Google Workspace	✗	✗	—	F
Concord Academy - Petoskey	`concordpetoskey.com`	Emmet County	Google Workspace	✗	✗	—	F
West MI Academy of Environmental Science	`wma-es.com`	Kent County	Google Workspace	✗	✗	—	F
Vista Charter Academy	`vista.heritageacademies.com`	Kent County	—	✗	✗	—	F
Martin Luther King Jr. Education Center Academy	`users.ameritech.net`	Wayne County	—	✗	✗	—	F
Black River Public School	`blackriverpublicschool.org`	Ottawa County	—	✗	✗	—	F
Vanderbilt Charter Academy	`vanderbilt.heritageacademies.com`	Ottawa County	—	✗	✗	—	F
Cesar Chavez Academy	`chavezacademy.com`	Wayne County	Google Workspace	✗	✗	—	F
Walker Charter Academy	`walker.heritageacademies.com`	Kent County	—	✗	✗	—	F
Eagle Crest Charter Academy	`eaglecrest.heritageacademies.com`	Ottawa County	—	✗	✗	—	F
Washtenaw Technical Middle College	`themiddlecollege.org`	Washtenaw County	—	✗	✗	—	F
Dove Academy of Detroit	`doveacademy.net`	Wayne County	GoDaddy	✗	✗	—	F

4.3 County-Level Summary (Top 10 Counties by District Count)

Table 8. Michigan County Distribution
County	Districts	Website Coverage
Wayne County	138	89.9%
Oakland County	52	86.5%
Kent County	45	95.6%
Macomb County	39	89.7%
Genesee County	38	97.4%
Ingham County	23	91.3%
Washtenaw County	23	73.9%
Berrien County	20	100.0%
Saginaw County	19	84.2%
Muskegon County	19	84.2%

5. Policy Implications

These findings identify specific, actionable gaps in Michigan's K-12 email security posture. The 38.7% DMARC gap represents districts that can be impersonated by any sender, enabling phishing campaigns targeting parents, students, and educators with no authentication failure. Key observations:

Immediate risk: 217 districts (28.1%) have Grade F scores, indicating minimal or no email authentication. These represent the highest-priority remediation targets.
Mid-tier stagnation: 203 districts (26.3%) are in the C range — typically have SPF but no DMARC or weak DMARC (p=none). Upgrading to p=quarantine would move them to B without infrastructure changes.
Provider leverage: Google Workspace (used by 69.0% of scored districts) provides automated SPF/DKIM configuration. Districts on Google Workspace with Grade F scores have misconfigured or missing DMARC — a free and simple fix.

6. Data Availability

The full Michigan K-12 dataset — 903 entities with NCES CCD enrichment (phone, address, grade span, school count, LEAID) and DNS authentication profiles — is available as part of the Lokentra ESI State Pack.

Table 9. Licensing Tiers
Tier	Scope	Suggested Use
State Pack: Michigan	All 903 K-12 LEAs, full DNS profile + CCD enrichment	Regional studies, state policy, outreach
K-12 National	All 50 states, 20,021+ K-12 LEAs	National K-12 cybersecurity research
Full Registry	801,359+ entities across all sectors	Comprehensive multi-sector research
API + Updates	Quarterly re-scan, REST API	Longitudinal studies, live dashboards

Contact: research@monitorworkspace.com — Free demo at monitorworkspace.com/scorecard

Citation: Lokentra Research Team (2026). Michigan K-12 Email Security Intelligence: DNS Authentication Profiling of 903 School District LEAs. Lokentra U.S. Email Security Index (ESI) — State Intelligence Series. https://lokentra-site.web.app/research/states/mi-k12-paper.html

Data sources: NCES Common Core of Data (CCD) 2024-2025; DNS records resolved via Google Public DNS (8.8.8.8) and Cloudflare (1.1.1.1). All entity data derived from publicly accessible government registries.

National baseline figures from Lokentra U.S. Education Sector Email Security Intelligence Dataset (March 2026). See education-dataset-paper.html for full methodology.

Michigan K-12 Email Security Intelligence:DNS Authentication Profiling of 903 School District LEAs